Skip to main content

Legal

Privacy Policy

Effective

This Privacy Policy explains how Build The Shelf ("we", "us", "our") collects, uses, shares, and safeguards your personal data when you use our website, join our waitlist, and use the Build The Shelf mobile app for iOS (collectively, the "Service"). It applies to website visitors, waitlist subscribers, app users, and anyone who contacts us.

1. Who we are

The Service is operated by [legal entity name — e.g. Build The Shelf LLC], of [registered business address], which is the data controller for the personal data described in this policy. For any privacy question, or to exercise your rights, you can reach us at hello@buildtheshelf.com.

2. What this policy covers

  • Website & waitlist — browsing buildtheshelf.com and joining the launch waitlist.
  • The Build The Shelf app — creating an account and using the adaptive training features on iOS.
  • Support & communications — when you email us or contact in-app support.

3. The data we collect

We collect the categories of personal data below, depending on how you interact with us. We only collect data that is relevant to providing the Service.

  • Account & identity data: your name, email address, and a securely hashed password when you create an app account. If you sign in with Apple, we receive the identifier Apple provides and the email you choose to share.
  • Training profile: your fitness goals, age, weight, target date, experience level, and equipment access, which you enter so the app can build and adapt your program. Your age and weight are treated as sensitive data.
  • Workout & progress data: the workouts you log (sets, reps, loads) and the progress you track over time.
  • Form-check videos & progress photos (user content): videos and photos you choose to submit for coaching feedback or to track your own progress. These are treated as sensitive and are never used for advertising or marketing.
  • Purchases & subscriptions: subscriptions and in-app purchases are processed by the Apple App Store. We do not see or store your full card number — we receive transaction references and subscription status so we can unlock the features you paid for.
  • Device, usage & diagnostics data: device model and OS version, app interactions, and crash/diagnostic reports collected to keep the app stable. On the website we also collect browser, pages visited, referral and campaign parameters (such as UTM tags), and a randomly generated analytics identifier stored on your device. We instruct our analytics provider to discard IP addresses once approximate country-level location has been derived, so we do not store your IP address.
  • Website behaviour data: we use PostHog to understand how our website is used, across four activities — analytics events (pages viewed, time on page, drop-off), heatmaps (where people click and scroll), session recordings (a replay of mouse movement, scrolling, and clicks on a page), and A/B testing (showing two versions of a page and measuring which performs better). Anything you type is masked and never captured, including the name, email, and message fields on our waitlist and contact forms. All of this is tied to an anonymous identifier, not to your name or email address. You can switch all four off using the Do Not Track or Global Privacy Control setting in your browser (see section 8).
  • Waitlist data: the email address (and any program-interest selections) you submit when joining the waitlist.
  • Support communications: messages you send to our support, press, or partnerships addresses, and our replies.

4. How we collect it

  • Directly from you — when you join the email list, take the quiz, or contact us.
  • Automatically — usage, device, and diagnostic data generated as you use the Service.
  • From Apple — subscription status and, if you use Sign in with Apple, the identifier and email you approve.

5. How we use your data

We process personal data to:

  • Create and secure your account and deliver the app's adaptive training features
  • Build, personalize, and adjust your training program week to week
  • Provide form-check feedback on videos you submit
  • Process subscriptions and unlock the features you purchase
  • Add you to the email list and send a short note when new programs or guides go up
  • Send you marketing about Build The Shelf, and measure how our marketing and paid campaigns perform — including conversion from website or ad to signup — where you have consented
  • Respond to support, press, and partnership inquiries
  • Keep the Service stable and secure and fix bugs using diagnostic data
  • Improve the Service via aggregated, non-identifying analytics
  • Run A/B tests of website content — for example, comparing two versions of a page headline — and measure which version performs better
  • Comply with legal obligations and enforce our Terms of Use

We do not use your form-check videos, progress photos, or sensitive body data (such as your weight) for advertising or marketing without your separate, explicit consent, and we do not use data collected for one purpose for a materially different purpose without first obtaining your consent.

6. Our legal bases (UK / EU residents)

If you are in the UK or EU, we rely on the following lawful bases under UK GDPR / GDPR:

  • Consent: joining the waitlist, receiving waitlist or marketing emails, and any use of your data to market to you. You can withdraw consent at any time (see section 8).
  • Contract: processing necessary to provide the app and subscription you signed up for.
  • Legitimate interests: running our business, securing the Service, measuring the effectiveness of our marketing, and improving our product.
  • Legal obligation: tax, accounting, and dispute records.

7. Third-party services and sharing

We do not sell your personal data for money. We share data only with the categories of recipients below, and only as needed to operate and grow the Service:

  • Supabase — database, accounts, and authentication that store your profile and training data
  • Vercel — website hosting and delivery
  • Workout content provider — a third-party workout API, [provider name], that supplies exercise and program content
  • Superwall — presents the app's paywall and manages subscription offers and pricing
  • Google Analytics & Google Search Console — aggregated website usage and search-performance measurement
  • PostHog — website and product analytics, heatmaps, session recordings, and A/B testing. Records anonymous page views, clicks, campaign parameters, and session recordings (see section 3). We do not build identified profiles for website visitors, and IP addresses are discarded once approximate country is derived. Hosted in the United States under a Data Processing Agreement incorporating the EU Standard Contractual Clauses.
  • Basin — receives and stores waitlist form submissions and sends the related notification emails
  • Loops — our email marketing platform; stores your email address and sends the waitlist, launch, and marketing emails you consented to
  • Apple App Store — subscription and in-app purchase handling
  • Professional advisors — accountants and legal counsel, where strictly necessary
  • Authorities — when legally required by a valid court order or regulator request

We require any third party with whom we share your personal data to provide the same or an equal level of protection of your data as set out in this policy, and to use it only for the purposes we specify.

8. Marketing, tracking, and revoking consent

Where you have consented, we use your contact and usage data to send you marketing about Build The Shelf and to measure how our marketing performs, including conversion from a website visit or advertisement to a signup. We do not use your form-check videos, progress photos, or sensitive body data (such as your weight) for advertising without your separate, explicit consent.

Some conversion or advertising measurement can constitute "tracking" under Apple's rules — for example, linking your data with data from other companies' apps or websites, or using the device Advertising Identifier (IDFA). Before we carry out any such tracking in the app, we will request your permission through Apple's App Tracking Transparency prompt, and you can decline.

You can withdraw any consent at any time: unsubscribe using the link in any email, opt out of marketing by contacting us, revoke app permissions (camera, photos) in your device Settings, or email us at hello@buildtheshelf.com.

Website behaviour data. We honour browser-level "Do Not Track" and Global Privacy Control signals across all four of the activities described in section 3. When either signal is detected, we collect nothing for that visit — no analytics events, no heatmap data, no session recording, and no A/B test data. You can turn either signal on in your browser settings or with a privacy extension. Note that Google Analytics does not support these signals; our Cookie Policy explains how to block it separately.

9. International transfers

Some of our service providers are based outside the UK / EU. Where personal data is transferred internationally, we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or another approved transfer mechanism.

10. How long we keep your data

  • Waitlist email and program-interest data: until you unsubscribe, or 24 months after launch, whichever comes first
  • App account, profile, and training data: while your account is active, then deleted within [retention window, e.g. 30 days] of account deletion (subject to the exceptions below)
  • Form-check videos and progress photos: while your account is active, or until you delete them
  • Payment and tax records: 7 years (statutory requirement)
  • Diagnostic and crash data: retained in aggregated form only

11. Deleting your account and data

You can delete your account and its associated personal data at any time, directly in the app: Settings → Account → Delete Account. Deleting your account permanently removes your profile and training data — it is not a temporary deactivation — except for the limited records we are legally required to keep (such as payment and tax records) and data held in routine backups, which are purged on our normal cycle.

If you signed in with Apple, deleting your account also revokes the associated Sign in with Apple token. You can also request deletion by emailing hello@buildtheshelf.com, and we will action it within one calendar month.

12. Your rights

You have the following rights in relation to your personal data:

  • Access — request a copy of the data we hold about you
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete data we no longer need (see section 11)
  • Restriction — limit how we use your data while a query is resolved
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests, including direct marketing
  • Withdraw consent — withdraw any consent you previously gave
  • Complain — UK residents can lodge a complaint with the Information Commissioner's Office at ico.org.uk

If you are a California resident, you also have rights under the CCPA/CPRA, including the right to know, delete, and correct your personal information, to opt out of any "sale" or "sharing" of it, and not to be discriminated against for exercising them. We do not sell your personal information for money. If any of our advertising or conversion measurement qualifies as "sharing" under California law, you can opt out by emailing hello@buildtheshelf.com.

To exercise any right, email hello@buildtheshelf.com. We respond within one calendar month.

13. Security

We use industry-standard technical and organisational measures to protect personal data, including TLS in transit, encryption at rest where supported by our providers, hashed passwords, role-based access controls, and regular review of our security posture. No system is perfectly secure; we cannot guarantee absolute security but we do our best.

14. Children's privacy

The Service is intended for users 18 and older, and the app is rated accordingly on the App Store. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Cookies

On our website we use cookies and similar technologies as described in our Cookie Policy. The app does not use advertising cookies.

16. Changes to this policy

We may update this policy as the Service evolves. If we make a material change we will notify waitlist members and app users by email and update the effective date at the top of this page. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

17. Contact

Questions about this policy or our handling of your data should go to hello@buildtheshelf.com.