SHREDY
EN FR ES PT
Back

Privacy Policy

Data collected by Shredy, processing purposes, providers, retention periods, and user rights.

Updated on July 9, 2026.

Controller

The controller is Bastien Vanhove EI, 78, Avenue des Champs-Élysées, Bureau 326, 75008 Paris, France.

For privacy questions: contact@shredy.app.

Data collected

Shredy collects only the data needed to run the app, secure the service, provide support, and manage premium rights.

  • Account: name, email, encrypted password, Apple or Google identifiers when OAuth login is used.
  • Profile and onboarding: goal, level, measurements, height, weight, weak muscle points, and program preferences.
  • Training and nutrition data: sessions, exercises, routines, programs, meals, foods, recipes, nutrition goals, and progress.
  • Optional health data: data read from or written to Apple Health or Health Connect only after device-level authorization.
  • Support: subject, message, language, reply email, and technical details useful to process the request.
  • Notifications: Expo Push token, platform, and token update date when notifications are enabled.
  • App activity: installation ID, language, app version, first open, last activity, and sampled API events for internal analytics.
  • Subscriptions: premium status, product ID, activation or expiration dates, and RevenueCat data needed to verify rights.

Mobile payments

Shredy does not collect or store bank card details. Payments are made exclusively in the mobile app through Apple App Store or Google Play.

RevenueCat may process technical subscription data to verify premium rights, restore purchases, and synchronize access between the app and Shredy backend.

Legal bases and purposes

Processing is based on contract performance when data is required to provide the app, synchronize data, manage the account, process support, or activate purchases.

Some processing relies on consent, including notifications, access to Apple Health or Health Connect, and marketing communications if introduced.

Security logs, abuse prevention, and technical analytics rely on Shredy’s legitimate interest in maintaining a reliable and secure service. Billing and accounting requirements rely on legal obligations.

Recipients and providers

Your data is never sold. It may only be shared with providers needed to operate the service.

  • Hetzner: API, database, and technical hosting.
  • Apple and Google: OAuth login, app distribution, and in-app payments.
  • RevenueCat: in-app purchase and subscription verification.
  • Expo: push notifications when enabled.
  • Brevo or configured email provider: support and transactional emails.
  • Meilisearch: internal admin, food, recipe, and exercise search when enabled.
  • OpenFoodFacts: public food data source, without Shredy sharing your personal data with OpenFoodFacts.

Local storage and synchronization

The app uses SQLite as a local source of truth for some data and Expo Secure Store for the authentication token. Tokens are not stored in SQLite.

When signed in, some data may synchronize with the Shredy backend for backup and multi-device use.

Retention periods

  • Account and synchronized data: while the account is active, then deleted on account deletion unless legal obligations require retention.
  • Authentication tokens: until logout, account deletion, or technical expiration/revocation.
  • Support messages: for the time required to handle and follow up the request.
  • Billing data: mainly handled by Apple or Google. Technical or accounting records may be kept for up to 10 years.
  • Technical analytics and API events: kept as long as needed for product health, security, and improvement.

Your rights

You may exercise access, rectification, erasure, restriction, objection, and portability rights where applicable.

You can use app features when available or write to contact@shredy.app. You may also lodge a complaint with the CNIL.

Security and transfers

Shredy uses technical and organizational measures to protect data: password hashing, token authentication, secure mobile token storage, access restrictions, and secure hosting.

Some providers, including Apple, Google, RevenueCat, or Expo, may process data outside the European Economic Area. In that case, GDPR safeguards or applicable contractual mechanisms are used.

Updates

This policy may change to follow app, backend, or legal developments. The update date appears at the top of the page.