Privacy Policy
The short version
- Shakey works without an account. Until you sign in, your workouts, meals, habits and weight stay on your phone.
- Sign in with Google or Apple and Shakey backs them up to our server in the EU, so you can restore them on a new phone.
- A food photo you scan is sent to Google’s Gemini to be read. We don’t keep the photo.
- No ads, no selling your data, no tracking you across other apps.
- You can export your data, turn off analytics and delete your account in Settings.
Who we are
Shakey is made by Mijo Majić, Bračka ulica 136, 31000 Osijek, Croatia (“we”, “us”). We’re the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, email support@shakeyapp.com.
This policy covers the Shakey app for iPhone and Android, and this website, shakeyapp.com.
What Shakey collects
What you tell the app
- Your profile: goal, sex, birth year, height, current and goal weight, weekly pace, how active you are, training days, training experience and diet preference. Shakey uses these to work out your calorie and protein targets. Your name is optional.
- What you log: workouts (exercises, sets, reps, weights, notes and personal records), meals and foods, water, weigh-ins, habits (including habits you’re quitting, check-ins and slips), and Shakey’s XP and level.
- Meal photos: saved on your phone only. A photo you scan is sent once to be read (see Food scans and search).
- Feedback you send from Settings → Send feedback, with your app version, phone model and operating system.
During setup Shakey also asks what usually gets in your way. That answer only shapes your first plan and is deleted when setup ends.
Some of this is health data: your weight, body measurements, what you eat, how you train and some habits. Health data gets extra protection under the GDPR. It only reaches our server if you sign in to back up and agree to that first, and we only use it to run Shakey for you.
From Apple Health (iPhone, optional)
If you allow it, Shakey reads your weight (up to the last 90 days) and step count from Apple Health. Weights become weigh-ins in Shakey. Steps stay on your phone and only adjust your calorie target. Shakey never writes to Apple Health, and nothing from Apple Health is used for advertising or marketing or shared with anyone for those purposes.
When you sign in
Before your first backup, Shakey asks whether you agree to it, and we keep the date you agreed with your account. Signing in with Google or Apple gives us your account’s email address and an ID from that provider. We use them to keep your backup yours, and the email to reply if you write to us. If Apple offers to share your name, Shakey doesn’t use it.
Collected automatically
- A random app ID. The first time Shakey runs, our server creates a random ID for your copy of the app. It holds your subscription status and how many free AI scans you’ve used. It isn’t linked to your name or email unless you sign in.
- Usage analytics (PostHog, EU): which screens you open and actions like “workout finished” or “habit checked”, plus your app version, units, Shakey’s level, whether you have Pro and days since install. For built-in habits you’re building, an event can name the preset (for example “drink water”). Habits you’re quitting are never named, and habit names you type yourself are never sent. Events are tied to the random ID, and to your account ID after you sign in, never to your name or email.
- Crash reports (Sentry, EU): what went wrong, your phone model, operating system and app version, and your account ID if you’re signed in.
- Purchases (RevenueCat): whether you have Pro and which plan, tied to the random ID. Apple or Google handle the payment; we never see your card details.
You can turn usage analytics and crash reports off in Settings → Data & privacy → Help improve Shakey.
Food scans and search
- Photo scans. When you scan a meal, Shakey sends the photo (resized to at most 1,024 pixels) and your phone’s language setting to our server, which asks Google’s Gemini what’s on the plate. No name, email or account ID goes to Google. We don’t store the photo or the answer. We use Gemini’s paid service: Google doesn’t use the photos to improve its products, and keeps them only for a limited time to detect abuse. Shakey asks before your first scan.
- Food lookups. Food names from a scan, and what you type into food search, are looked up in USDA FoodData Central and Open Food Facts. Barcodes go to Open Food Facts. No account ID is sent with these lookups.
Why we use it
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Backup and sync | To keep your data safe and move it to a new phone | Your explicit consent, given when you sign in to back up (Art. 6(1)(a) and 9(2)(a)). Withdraw it any time by deleting your account. |
| Food scans and lookups | To estimate what you ate | Providing the app you asked for (Art. 6(1)(b)), and your consent before your first scan |
| Pro and purchases | To unlock Pro and restore purchases | Providing the app you asked for (Art. 6(1)(b)) |
| Analytics and crash reports | To fix bugs and learn which features help | Our legitimate interest in a working app (Art. 6(1)(f)). You can turn them off. |
| Support and feedback | To answer you | Our legitimate interest (Art. 6(1)(f)) |
| Required records | Tax and legal duties | Legal obligation (Art. 6(1)(c)) |
Data that stays on your phone never reaches us, so we don’t process it.
Who else handles your data
These providers work for us and get only what they need for their job:
| Provider | What for | Where the data is |
|---|---|---|
| Supabase | Backup database, sign-in, scan counts | EU (Frankfurt) |
| Gemini (reading food photos), Sign in with Google | Google’s data centres | |
| Apple | Sign in with Apple, Apple Health on your phone | Apple |
| PostHog | Usage analytics | EU |
| Sentry | Crash reports | EU (Germany) |
| RevenueCat | Subscription status | United States |
| Apple App Store, Google Play | Payments and refunds | Under their own privacy policies |
| Open Food Facts, USDA FoodData Central | Food lookups | France, United States |
| Cloudflare | Hosting this website | Cloudflare’s global network |
Some of these companies are based in the United States. Where data leaves the EU, they rely on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
We don’t sell your personal data, use it for ads, or share it with data brokers. We’ll only disclose it to authorities when the law requires us to.
How long we keep it
- On your phone: until you delete it (Settings → Data & privacy → Delete all data) or delete the app.
- Your backup: until you delete your account. It’s deleted straight away.
- Food photos: we don’t keep them. Google keeps scans for a limited time to detect abuse.
- Analytics and crash reports: kept by PostHog and Sentry for a limited time, then deleted automatically. Ask and we’ll delete yours sooner.
- Feedback: kept while it’s useful. If you delete your account, it’s no longer linked to you.
- Purchase records: kept by Apple, Google and RevenueCat for as long as tax law requires.
Your rights
Under the GDPR you can ask to see your data, correct it, delete it, get a copy, restrict or object to how we use it, and withdraw your consent at any time. Most of this works in the app:
- See and correct: everything you’ve logged is in the app, and you can edit or delete any entry.
- Get a copy: Settings → Data & privacy → Export my data gives you your workouts, meals, habits and weigh-ins as spreadsheet files.
- Delete: Settings → Account & backup → Delete account. See how to delete your account.
- Object to analytics: Settings → Data & privacy → Help improve Shakey.
For anything else, email support@shakeyapp.com. We’ll reply within one month. You can also complain to the data protection authority in your country.
Notifications and widgets
Reminders are scheduled on your phone; we don’t collect push tokens. A reminder shows the habit’s name on your lock screen. Home Screen widgets read today’s numbers from storage on your phone. Habits you’re quitting never appear on widgets.
Security
Everything travels encrypted. Your backup sits behind access controls, so each account can only reach its own data. No system is perfectly secure, so if a breach ever puts your data at risk, we’ll tell you.
Children
Shakey is for people aged 13 and over. We don’t knowingly collect data from anyone younger. Some countries set a higher age, often 16, for agreeing to how your data is used. If you’re under that age where you live, ask a parent or guardian to agree before you sign in to back up or scan food. If you think a child under 13 has given us data, email support@shakeyapp.com and we’ll delete it.
This website
shakeyapp.com sets no cookies and runs no ads or trackers. It’s hosted by Cloudflare, which processes your IP address to deliver pages and protect the site. We count visits with Cloudflare Web Analytics, which doesn’t use cookies or identify you. Links to TikTok, Instagram and YouTube follow those companies’ own privacy policies.
Changes
If we change this policy, we’ll update the date at the top. If a change matters, we’ll also tell you in the app.