Privacy Policy
Privacy Policy
Shakeout works out your training on your phone. This page explains what leaves your phone, why, who else handles it, and how to get rid of it.
The short version
- You need an account. You sign in with Apple, or with a code we email you.
- A copy of your training, including runs read from Apple Health, is kept on our server so you can restore it on a new phone.
- The GPS routes of your runs, and any video you use for a form check, stay on your phone.
- We use analytics and crash reporting to fix faults. You can switch them off in the app.
- We do not sell your data, show you ads, or use anything from Apple Health for advertising.
- You can delete your account and everything with it from inside the app.
1. Who we are
Shakeout Labs Ltd (company number 17482867, 42 Woodyard Avenue, Chesterfield, S41 7WF) is the data controller for the Shakeout app for iOS and this website, shakeout.io. Contact details are in section 10.
2. What we collect
2.1 Your account
Signing in is required to use Shakeout. If you sign in with Apple, or Google where the app offers it, the provider tells us an identifier for you and, if it passes one on, your email address. Apple lets you hide your address behind a private relay address, and then that is all we see. If you sign in with an emailed code, we keep your email address, because it identifies your account. We never see a password.
Your account is filed under a random account number of our own, with when it was created and last used. The free trial is counted from when your account was created.
2.2 Apple Health
If you allow it, Shakeout reads your running, walking and hiking workouts from Apple Health so that sessions tick themselves off and your fitness score stays current. For each workout it can read the distance, duration, heart rate, steps (for cadence), running dynamics and route. It also reads the active calories your watch measured during a strength session you finish, to save with that session.
If you allow it, Shakeout writes each strength session you finish to Apple Health as a workout. It writes nothing else there.
You can allow or refuse each of these in the iOS Settings app, under Privacy and Security, then Health, and withdraw them at any time. Runs already logged stay in your training until you delete them or your account.
Information from Apple Health is used only to provide Shakeout's training features. It is never used for advertising or marketing, never sold, and never shared except with the service providers in section 4 who store it for us, or with a service you connect and ask us to send it to.
2.3 Your training backup
So that a lost or replaced phone does not cost you your training, we keep a copy of it on our server, linked to your account. It holds your plan, races and race times, fitness score, the runs and strength sessions you have logged (including details read from Apple Health), how runs felt and any time you told the app you were ill or injured, the answers you gave when setting up, and your settings.
The GPS route of your runs is not in it. Routes stay on your phone. A race course you add from a GPX file is saved with that race, so it is in the backup.
2.4 Maps
To draw a map, the app downloads map images from OpenFreeMap, a public map service. Your route is not sent, but each request shows OpenFreeMap the area being drawn, along with your phone's internet address. We have no agreement with OpenFreeMap and send it nothing ourselves.
2.5 Form check
The form check reads a clip of you running that you pick from your photo library. It is analysed on your phone and is never uploaded. The app keeps only the result, such as a fault to work on, which goes in your backup.
2.6 Calendar, reminders and files
If you turn on calendar sync, Shakeout adds your sessions to a calendar of its own on your device. It does not read your other calendars. If you turn on run reminders, they are scheduled on your phone. Files you import, such as a run or a race course, are read on your phone. None of this reaches us except as part of your backup.
2.7 Analytics, crash reports and screen recordings
We use PostHog to see which screens are used and which actions are taken, and to collect crash and error reports. These carry a random identifier for this installation of the app, not your account number, and they do not include readings from Apple Health, such as your heart rate, distances or routes. PostHog also receives your phone's internet address as part of delivering them.
PostHog also records your screen while you use the app, so we can see how a fault played out. What you type and images are hidden before a recording leaves your phone, but other text on screen is not, so a recording can show your training figures.
To opt out, switch Analytics off in the app under Me, then Privacy. That also stops crash reports, screen recordings and in-app feedback from that phone.
2.8 Feedback
If you send feedback from the app, we receive what you write, the kind of feedback you chose, the page you were on and a link to your screen recording. It is kept in our private issue tracker.
2.9 Subscriptions
Subscriptions are sold and billed by Apple. We never see your payment details. We use RevenueCat to check whether your subscription is active, which means sharing your purchases with it under an identifier derived from your account.
If you subscribe through the UK App Store, RevenueCat tells us when you pay, renew or cancel. We keep the dates and the price while the subscription runs, and use them to email you the terms, renewal reminders and cancellation notices the law requires.
2.10 Connected services
If you connect Strava, COROS or Garmin, our server holds the access that service grants, kept encrypted, and the identifiers needed to match its activities to your account. It passes your activities to your phone without keeping them, and sends the service what you asked for:
- Strava: the strength sessions you finish, and a short read added to the description of your runs. Anyone who can see that activity on Strava can read it. A run's read may wait on our server for a few days at most, until Strava has the run.
- COROS or Garmin: your upcoming planned sessions, so they appear on your watch. Your runs come back to your phone and are logged like runs from Apple Health.
Disconnecting in the app, or deleting your account, removes our access and what we hold for that service. Each service is a separate company with its own privacy policy.
2.11 The launch waitlist
If you leave your email address on this website, we keep it, with the date, to tell you when Shakeout launches, and nothing else.
2.12 Security
To protect sign-in and the backup from abuse, we keep short-lived records of requests, linked to a scrambled form of your internet address, email address or account number.
3. How we use it
We use the information above to run your account, build and adapt your plan, keep your backup, connect the services you choose, check your subscription, answer your feedback, find and fix faults, and keep the service secure. Your plan is generated by the app on your phone; you can change the answers behind it or edit it at any time.
4. Who handles it
These companies process data for us and act only on our instructions:
- Cloudflare hosts our server, your account and your backup, and sends sign-in and subscription emails.
- PostHog handles analytics, crash reports, screen recordings and feedback, and website visit counts if you accept cookies.
- GitHub holds our private issue tracker.
- RevenueCat checks subscription status and tells us when it changes.
- Expo delivers app updates, which means your phone contacts it when the app starts.
- Apple and Google provide sign-in, and Apple takes payment.
Some of these handle data outside the UK. Where they do, the transfer is covered by safeguards approved under UK law.
We may also disclose information where the law requires it. We do not sell or rent your data, we do not show advertising, and we do not track you across other apps or websites.
5. Cookies on this website
This website sets no cookies unless you accept the banner. If you accept, PostHog sets a cookie and records which pages you open and how you use them, and roughly where you are from your internet address. It never records what you type into a form. If you decline, nothing loads, and your browser keeps a note of your answer so the banner does not ask again. You can change your mind from the Cookies link at the bottom of any page. The app does not use cookies.
6. Your rights and choices
Under UK data protection law you can ask to see the data we hold about you, have it corrected or deleted, have a copy to take elsewhere, and object to or restrict how we use it. Where we rely on your consent, you can withdraw it at any time. To do any of this, emailsupport@shakeout.io. We answer within one month.
To delete everything: in the app, go to Me, then Account & backup, and choose Delete account. If your trial has ended, the same page is under Account and data on the subscription screen. This deletes your account, your backup and the training on your phone, and disconnects any connected services. It cannot be undone. Copies in our system backups are deleted as those backups expire. Analytics, crash reports and feedback are not linked to your account, so deleting it does not reach them; email us and we will remove them.
Signing out is not the same thing: it leaves your account and backup in place.
If you are unhappy with how we have handled your data, email us and say it is a complaint. We will acknowledge it within 30 days and tell you what we have done. You can also complain to the Information Commissioner's Office at ico.org.uk.
7. Age
Shakeout is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe someone under 16 has given us information, contact us and we will delete it.
8. Keeping it
8.1 How long
- Your account, backup and connected services: until you delete your account or disconnect the service.
- Subscription dates and price: while the subscription runs.
- Sign-in codes and security records: short-lived, and deleted after they expire.
- Analytics and crash reports: 12 months. Screen recordings: 30 days.
- Feedback: as long as we need it to deal with what you reported.
- The waitlist: until we have told you the app is out, or you ask us to remove you.
8.2 Legal basis
| What we do | Legal basis |
|---|---|
| Run your account, your plan, your backup and your subscription | Performance of our contract with you |
| Read and store health and fitness data, including from Apple Health and connected services | Your explicit consent, given when you allow Apple Health or connect a service, and withdrawable at any time |
| Analytics, crash reports, screen recordings and feedback | Our legitimate interest in finding and fixing faults and improving the app |
| Email UK subscribers the terms, reminders and notices the law requires | Legal obligation |
| Protect the service from abuse | Our legitimate interest in keeping the service secure |
| Calendar sync, run reminders, the waitlist and website cookies | Your consent, withdrawable at any time |
9. Changes
If we change how we handle your data, we will update this page and the date at the top.
10. Contact us
For anything about your data, contact support@shakeout.io. We areShakeout Labs Ltd, company number 17482867, 42 Woodyard Avenue, Chesterfield, S41 7WF.