Skip to main content

Legal

Privacy Policy

Effective

This Privacy Policy explains how Build The Shelf ("we", "us", "our") collects, uses, shares, and safeguards your personal data when you use our website, join our waitlist, and use the Build The Shelf mobile app for iOS (collectively, the "Service"). It applies to website visitors, waitlist subscribers, app users, and anyone who contacts us.

1. Who we are

The Service is operated by Build The Shelf, of 2413 Sloan Circle, Lorena, Texas 76655, which is the data controller for the personal data described in this policy. For any privacy question, or to exercise your rights, you can reach us at hello@buildtheshelf.com.

2. What this policy covers

  • Website & waitlist — browsing buildtheshelf.com and joining the launch waitlist.
  • The Build The Shelf app — creating an account and using the adaptive training features on iOS.
  • Support & communications — when you email us or contact in-app support.

3. The data we collect

We collect the categories of personal data below, depending on how you interact with us. We only collect data that is relevant to providing the Service.

  • Account & identity data: your name, email address, and a securely hashed password when you create an app account. If you sign in with Apple, we receive the identifier Apple provides and the email you choose to share.
  • Training profile (health and body data): your first name, birth year, height, weight, goal weight and pace, fitness and physique goals, the body-shape and focus-area answers you choose, activity level, training experience, equipment, schedule, and any exercises you want to avoid. You enter these so the app can build and adapt your program.
  • Measurements and daily logs (health and body data): the body measurements you record (such as waist, hip, thigh, and glute measurements and an optional body-fat percentage), the weigh-ins and daily step counts you log, and your step target. These measurements are saved with your account; the photos taken with them are not (see below).
  • Workout & progress data: the workouts you log (sets, reps, loads, and how hard they felt), exercise swaps, and how your program progresses over time.
  • Progress photos stay on your phone. Photos you take in the app are stored only on your device and never uploaded to our servers. Like the rest of the app's on-device data, they are included in your own iCloud or computer device backup if you have one turned on. We never see them.
  • Purchases & subscriptions: subscriptions and in-app purchases are processed by the Apple App Store. We do not see or store your full card number — we receive transaction references and subscription status so we can unlock the features you paid for.
  • Device, usage & diagnostics data: in the app, our subscription provider Superwall records app opens, sessions, and how you use the subscription screen, together with your device model, operating system, language, a device identifier, and your approximate location (city, region, and country) derived from your IP address. We use this to show the right offer and prices and to measure how the subscription screen performs. It never includes your health or body data. The app does not use crash-reporting or advertising tools. On the website we collect browser, pages visited, referral and campaign parameters (such as UTM tags), and a randomly generated analytics identifier stored on your device. We instruct our analytics provider to discard IP addresses once approximate country-level location has been derived, so we do not store your IP address.
  • Website behaviour data: we use PostHog to understand how our website is used, across four activities — analytics events (pages viewed, time on page, drop-off), heatmaps (where people click and scroll), session recordings (a replay of mouse movement, scrolling, and clicks on a page), and A/B testing (showing two versions of a page and measuring which performs better). Anything you type is masked and never captured, including the name, email, and message fields on our waitlist and contact forms. All of this is tied to an anonymous identifier, not to your name or email address. You can switch all four off using the Do Not Track or Global Privacy Control setting in your browser (see section 8).
  • Waitlist data: the first name and email address you submit when joining the waitlist, the page you signed up from, and the email topics you are subscribed to.
  • Support communications: messages you send to our support, press, or partnerships addresses, and our replies.

4. How we collect it

  • Directly from you — when you join the email list, take the quiz, or contact us.
  • Directly from you in the app — the answers, measurements, and workouts you enter.
  • Automatically — usage and device data generated as you use the website, and in the app by our subscription provider (see section 3).
  • From Apple — subscription status and, if you use Sign in with Apple, the identifier and email you approve.

5. How we use your data

We process personal data to:

  • Create and secure your account and deliver the app's adaptive training features
  • Build, personalize, and adjust your training program week to week
  • Process subscriptions and unlock the features you purchase
  • Add you to the email list and send the launch news, product updates, and training tips you signed up for
  • Send account emails you need, such as a password reset link or a notice that your password was changed
  • Send you marketing about Build The Shelf, and measure how our marketing and paid campaigns perform — including conversion from website or ad to signup — where you have consented
  • Respond to support, press, and partnership inquiries
  • Keep the Service stable and secure
  • With your permission, test and improve our training and progression engines using a de-identified copy of your training data (see below)
  • Run A/B tests of website content — for example, comparing two versions of a page headline — and measure which version performs better
  • Comply with legal obligations and enforce our Terms of Use

Your consent for health and body data. The answers you give while setting up the app stay on your phone. When you create an account, you tick a box to agree to us using your body measurements and training data to build your plan, and nothing is stored with us until you do. You can withdraw that consent at any time by deleting your account (section 11).

Improving the app, only if you say yes. This is off unless you turn on Settings → Your data → Help improve the app. If you do, we may use a de-identified copy of your training data to test and tune our training and progression engines. Before we use it, your name, email, notes, and photos are removed, your account ID is replaced with a code, your birth year is reduced to a five-year age band, and real dates are replaced with relative day counts. This copy stays with us: it is never sold, shared, or used for advertising. You can turn it off again at any time in the same place, and your data is left out of any later analysis.

We never sell your health or body data, never use it for advertising or marketing, and do not use data collected for one purpose for a materially different purpose without first obtaining your consent.

6. Our legal bases (UK / EU residents)

If you are in the UK or EU, we rely on the following lawful bases under UK GDPR / GDPR:

  • Explicit consent: your health and body data (Article 9(2)(a) GDPR), and the de-identified use of your training data to improve the app, if you choose it.
  • Consent: joining the waitlist, receiving waitlist or marketing emails, and any use of your data to market to you. You can withdraw consent at any time (see section 8).
  • Contract: processing necessary to provide the app and subscription you signed up for.
  • Legitimate interests: running our business, securing the Service, measuring the effectiveness of our marketing, and improving our product.
  • Legal obligation: tax, accounting, and dispute records.

7. Third-party services and sharing

We do not sell your personal data for money. We share data only with the categories of recipients below, and only as needed to operate and grow the Service:

  • Supabase — database, accounts, and authentication that store your profile and training data
  • Vercel — website hosting and delivery
  • WorkoutX — supplies the exercise demonstrations shown in the app. It receives no personal data: the demonstrations are served from our own storage.
  • Superwall — presents the app's paywall and manages subscription offers and pricing. It receives a random account identifier (so your subscription follows you to a new phone), your subscription status, and the device and usage data described in section 3, never your health or body data.
  • Google Analytics & Google Search Console — aggregated website usage and search-performance measurement
  • PostHog — website analytics, heatmaps, session recordings, and A/B testing (on our website only; the app does not use it). Records anonymous page views, clicks, campaign parameters, and session recordings (see section 3). We do not build identified profiles for website visitors, and IP addresses are discarded once approximate country is derived. Hosted in the United States under a Data Processing Agreement incorporating the EU Standard Contractual Clauses.
  • Basin — receives our website forms (waitlist and contact), filters spam, and passes waitlist sign-ups to Resend
  • Resend — sends our email: account emails (such as password resets) and, if you joined the waitlist, the emails you subscribed to. Stores your email address, first name, and email preferences
  • Apple App Store — subscription and in-app purchase handling
  • Professional advisors — accountants and legal counsel, where strictly necessary
  • Authorities — when legally required by a valid court order or regulator request

We require any third party with whom we share your personal data to provide the same or an equal level of protection of your data as set out in this policy, and to use it only for the purposes we specify.

8. Marketing, tracking, and revoking consent

Where you have consented, we use your contact and usage data to send you marketing about Build The Shelf and to measure how our marketing performs, including conversion from a website visit or advertisement to a signup. We do not use your progress photos or your health and body data (such as your weight or measurements) for advertising or marketing.

Some conversion or advertising measurement can constitute "tracking" under Apple's rules — for example, linking your data with data from other companies' apps or websites, or using the device Advertising Identifier (IDFA). Before we carry out any such tracking in the app, we will request your permission through Apple's App Tracking Transparency prompt, and you can decline.

You can withdraw any consent at any time: unsubscribe using the link in any email, opt out of marketing by contacting us, revoke app permissions (camera, photos) in your device Settings, or email us at hello@buildtheshelf.com.

Website behaviour data. We honour browser-level "Do Not Track" and Global Privacy Control signals across all four of the activities described in section 3. When either signal is detected, we collect nothing for that visit — no analytics events, no heatmap data, no session recording, and no A/B test data. You can turn either signal on in your browser settings or with a privacy extension. Note that Google Analytics does not support these signals; our Cookie Policy explains how to block it separately.

9. International transfers

The app's database (Supabase) is hosted in the United States. Some of our other service providers are also based outside the UK / EU. Where personal data is transferred internationally, we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or another approved transfer mechanism.

10. How long we keep your data

  • Waitlist email and program-interest data: until you unsubscribe, or 24 months after launch, whichever comes first
  • App account, profile, and training data: while your account is active; deleted immediately when you delete your account, and gone from our routine database backups within 7 days
  • Progress photos: on your device only, until you delete them or the app
  • De-identified research copies (only if you opted in): only as long as needed for the analysis, and no longer than 24 months
  • Payment and tax records: 7 years (statutory requirement)

11. Deleting your account and data

You can delete your account and its associated personal data at any time, directly in the app: Settings → Account → Delete account, or, before subscribing, from the Account link at the bottom of the subscription screen. Deleting your account permanently removes your profile and training data — it is not a temporary deactivation — except for the limited records we are legally required to keep (such as payment and tax records). Copies in our routine database backups are gone within 7 days. Deleting your account does not cancel an App Store subscription: cancel it in your Apple account's subscription settings.

If you signed in with Apple, deleting your account also revokes the associated Sign in with Apple token. You can also request deletion by emailing hello@buildtheshelf.com, and we will action it within one calendar month.

12. Your rights

You have the following rights in relation to your personal data:

  • Access — request a copy of the data we hold about you
  • Rectification — ask us to correct inaccurate data
  • Erasure — ask us to delete data we no longer need (see section 11)
  • Restriction — limit how we use your data while a query is resolved
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests, including direct marketing
  • Withdraw consent — withdraw any consent you previously gave
  • Complain — UK residents can lodge a complaint with the Information Commissioner's Office at ico.org.uk

If you are a California resident, you also have rights under the CCPA/CPRA, including the right to know, delete, and correct your personal information, to opt out of any "sale" or "sharing" of it, and not to be discriminated against for exercising them. We do not sell your personal information for money. If any of our advertising or conversion measurement qualifies as "sharing" under California law, you can opt out by emailing hello@buildtheshelf.com.

Consumer health data. Some US state laws (such as Washington's My Health My Data Act) treat the body and fitness data described in section 3 as consumer health data. We collect it only with your consent, use it only to provide the app and, if you choose, to improve it in de-identified form, share it only with the service providers listed in section 7 that process it for us, and never sell it. You can access, delete, or withdraw consent for it as described above.

To exercise any right, email hello@buildtheshelf.com. We respond within one calendar month.

13. Security

We use industry-standard technical and organisational measures to protect personal data, including TLS in transit, encryption at rest where supported by our providers, hashed passwords, role-based access controls, and regular review of our security posture. No system is perfectly secure; we cannot guarantee absolute security but we do our best.

14. Children's privacy

The Service is intended for users 16 and older, and the app is rated accordingly on the App Store. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, contact us and we will delete it.

15. Cookies

On our website we use cookies and similar technologies as described in our Cookie Policy. The app does not use advertising cookies.

16. Changes to this policy

We may update this policy as the Service evolves. If we make a material change we will notify waitlist members and app users by email and update the effective date at the top of this page. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

17. Contact

Questions about this policy or our handling of your data should go to hello@buildtheshelf.com.