Privacy Policy

Last updated: September 21, 2026

Shoey ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our iOS app and related services.

1. Information We Collect

Account Data

• User ID (via Supabase authentication)
• Email address (optional, only if you sign in with email)
• Units preference (miles or kilometers)
• Timezone

Shoe Data

• Brand and model
• Color
• State (Up Next, In Rotation, Resting, Retired)
• Activity type (run, trail run, hike, walk, other)
• Mileage threshold
• Purchase price (optional)

Activity Data

• Source (Strava or HealthKit)
• Distance
• Date
• Shoe assignment

2. Third-Party Services

We use the following third-party services:

Supabase (Authentication)

Supabase handles sign-in (Apple, Google, or email) and stores your authentication credentials securely. See Supabase's Privacy Policy.

Clerk (Authentication, older app versions)

Versions of the app before 1.11 sign in through Clerk. Accounts are being moved from Clerk to Supabase. See Clerk's Privacy Policy.

Strava (Optional)

If you connect Strava, we sync your activities to automatically log miles. Your Strava data is cached for a maximum of 7 days and your access tokens are stored encrypted. See Strava's Privacy Policy.

Apple Health (Optional)

If you connect Apple Health, we sync your workout activities to automatically log miles. We only access workout data (activity type, distance, duration, date) — not sensitive health metrics like heart rate or medical data. See Apple's Privacy Policy.

PostHog (Analytics)

We use PostHog for product analytics to understand how users interact with the app and improve the experience. PostHog may record session replays, which capture user interactions (taps, scrolls, navigation) and screen content. Session replays do not capture passwords, payment information, or other sensitive data. You can learn more at PostHog's Privacy Policy.

Cloudflare (Infrastructure)

Cloudflare hosts our API and website. See Cloudflare's Privacy Policy.

3. Strava Data Handling

In compliance with the Strava API Agreement:

• Activity data is cached for a maximum of 7 days
• Your Strava data is never shared with other users
• Strava data is not used for analytics or advertising
• Access tokens are stored encrypted (AES-256-GCM)
• Strava may monitor and collect usage data related to your API access
• Disconnecting Strava deletes ALL your Strava data: activity pointers, cached activity details, and encrypted tokens
• You can disconnect Strava at any time in app settings

4. Apple Health Data Handling

In compliance with Apple's HealthKit guidelines:

• We only access workout/activity data (type, distance, duration, date)
• We do not access sensitive health data (heart rate, blood pressure, medical conditions)
• Activity data is cached for a maximum of 7 days
• Your health data is never stored in iCloud
• Health data is not shared with other users or third parties
• Health data is not used for analytics or advertising
• You can disconnect Apple Health at any time in app settings

5. Background Processing & Push Notifications

Background Activity Sync

Shoey uses background processing to sync your workout activities:

• When Apple Health records new workouts, Shoey updates in the background
• Background sync ensures your shoe mileage stays accurate without manual refresh
• You can disable background sync in iOS Settings > Shoey > Background App Refresh

Push Notifications

If you enable notifications, Shoey may send alerts when:

• A new activity is automatically assigned to a shoe
• An activity needs manual shoe assignment

We store a device token to deliver notifications. This token:

• Is not linked to your personal identity
• Is deleted when you sign out or delete your account
• Is not shared with third parties
• Can be revoked in iOS Settings > Shoey > Notifications

6. Data Retention

• Account data: Retained until you delete your account
• Activity cache: Maximum 7 days
• Strava tokens: Until you disconnect Strava

7. Your Rights

Export Your Data

You can export your shoe data as a JSON file in the app: tap the account icon to open Account, then Privacy & Data > Export or Delete Data > Export.

Delete Your Account

You can permanently delete your account in the app: tap the account icon to open Account, then Privacy & Data > Export or Delete Data > Delete Account. This deletes all of your account data stored by Shoey (including your shoes and activities), your shoe photos, and your sign-in login, so you can no longer sign in to that account. For 30 days afterwards we keep only your account's random internal ID, with no other information attached, so that a device that is still signed in cannot recreate the deleted account.

Disconnect Strava

You can revoke Strava access at any time in the app: open Account, then Connections > Strava > Disconnect from Strava.

8. Security

• All data is transmitted over HTTPS
• Authentication uses industry-standard JWT tokens
• Strava tokens are encrypted at rest
• We follow security best practices for data storage

9. Analytics

• We use PostHog for product analytics to improve the app experience
• We may record session replays that capture user interactions and screen content
• Session replays are used solely to understand app usage and fix issues
• We do not display advertising
• We do not track you across apps or websites for advertising purposes
• We do not sell your data to third parties

10. Contact Us

If you have questions about this Privacy Policy, please contact us at support@shoey.app.