Privacy Policy

Shift Performance Club ehf. (trading as Shift Performance Club) is the controller of the personal data processed through the Service.

• Company registration: [kennitala — pending company registration]
• Registered address: [registered address — pending company registration]
• Privacy contact: support@shiftperformanceclub.com

Company registration and address are being finalized as Shift Performance Club ehf. completes registration; this page will be updated with the final details.

We collect only what we need to run the Service:

• Account data: name, email, password hash, profile photo, birth date, height, weight.
• Training data: 1RMs, workout history, session logs, phase selection, RPE, notes.
• Subscription data: tier, status, renewal date. Payment details are handled by our payment processor — we never see your card number.
• Communications: messages to and from your coach, problem reports, and any attachments you send.
• Device and usage data: device type, app version, session timestamps, IP address, and basic diagnostic and analytics events used to keep the Service secure and improve the product.

• provide and personalize your training programs;
• operate your subscription and process payments;
• allow your coach to plan and review your training;
• protect the Service against abuse, fraud, and misuse;
• respond to your support requests and problem reports;
• send essential service messages (e.g., security alerts, billing notices). Marketing emails are sent only with your consent.

We process personal data under the following bases: performance of a contract (delivering the Service you subscribed to), legitimate interest (security, fraud prevention, product improvement), consent (marketing, optional features), and legal obligation (tax, accounting, responding to lawful requests).

We share data only with processors that help us run the Service, and only to the extent needed:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Sentry — error monitoring and diagnostics (may include IP address and technical details when an error occurs).
• Zoho and Resend — email delivery and support correspondence.
• Our payment processor — subscription billing and payments (added once paid plans go live).

We do not sell your personal data. We do not share training data with advertisers.

Some of our processors are located outside the European Economic Area. When data is transferred internationally we rely on Standard Contractual Clauses or equivalent safeguards approved under GDPR.

Account and training data are kept for as long as your account is active. When you delete your account we erase or anonymize your data within 30 days, except where we are required to keep records for tax, accounting, or legal reasons (typically up to 7 years for financial records).

You can access, correct, export, restrict, or delete your personal data, and object to certain processing. You can also withdraw consent for marketing at any time. To exercise these rights email support@shiftperformanceclub.com. You also have the right to lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd) or your local supervisory authority.

We use a minimal set of first-party cookies and local storage to keep you signed in and remember your preferences. We may use privacy- respecting analytics to understand how the Service is used in aggregate. We don't run third-party advertising trackers.

Passwords are hashed and access to production data is restricted to staff who need it. We continue to add safeguards for protected media and account access as the Service grows. No system is perfect — if you suspect a security issue, email support@shiftperformanceclub.com.

The Service is not directed at children under 16. If you believe a child has created an account, contact us and we'll remove it.

We'll update this policy as the Service evolves. Material changes will be notified through the app or by email.