Privacy Policy
Effective Date: November 7, 2026 · Last Updated: November 7, 2026
Viral Studio LLC ("ShotShield", "we", "us", or "our") operates the ShotShield iOS application (Bundle ID: com.viralstudio.shotshield) and https://shotshield.app. This Privacy Policy explains what data we collect, how it stays on your device or is processed with your explicit consent, and your rights under Apple App Store Review Guidelines 5.1.1, 5.1.2, and 5.1.3, the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).
- Apple HealthKit Data Never Leaves Your Device (Guideline 5.1.3): Weight, dietary protein, and dietary water synced with Apple HealthKit are stored locally in your on-device SwiftData database and App Group container. HealthKit values are never transmitted to our AI proxy, analytics service, or any third party, and are never used for advertising or data mining.
- Explicit Consent Before Any AI Meal Photo Processing (Guideline 5.1.2): Before your first meal scan, ShotShield displays a clear
AIConsentSheetasking for your explicit permission. Only after you consent is your downscaled meal photo (long edge ≤ 1024px, JPEG quality 0.7, with all EXIF and GPS location metadata stripped on-device) and coarse dose-phase bucket sent to Google Gemini via ShotShield's Cloudflare Worker proxy solely to estimate meal macronutrients. Meal photos are never retained by ShotShield's proxy after the scan response is returned. - Zero Cross-App Tracking (
NSPrivacyTracking = false): ShotShield does not collect IDFA, does not use third-party advertising SDKs, and never sells or shares your personal data with data brokers.
1. Data We Collect and How It Is Stored
| Data Category | Specific Elements | Storage Location & Purpose |
|---|---|---|
| On-Device Health & Dose Logs | Medication type (semaglutide/tirzepatide), logged dose (mg), injection timestamp & rotation site, weight entries, daily water intake, side-effect notes, and meal macro totals. | Stored locally on your iPhone inside ShotShield's encrypted SwiftData store and App Group container (group.com.viralstudio.shotshield) so your Lock Screen widget can render your timeline offline. |
| Apple HealthKit Data (Optional) | Read: HKQuantityTypeIdentifierBodyMass (weight).Write: dietaryProtein, dietaryWater, bodyMass. |
Accessed only if you explicitly enable HealthKit in Onboarding or Settings. Never transmitted off-device and never sent to Google Gemini or any third party (Apple Guideline 5.1.3). |
| Meal Scan Photos (With Explicit Consent) | Still meal photograph captured via camera or chosen via iOS PhotosPicker, plus a non-identifiable dose-phase bucket string. |
Downscaled on-device to ≤1024px long edge and re-encoded to strip all EXIF/GPS metadata before transmission to our Cloudflare Worker proxy and Google Gemini API solely for real-time macronutrient estimation. Requires prior one-time opt-in via AIConsentSheet. |
| Subscription & Entitlement State | Anonymous RevenueCat App User ID (X-RC-App-User-Id), App Store transaction history, and active pro entitlement status. |
Processed via Apple StoreKit 2 and RevenueCat, Inc. to verify subscription access, check introductory trial eligibility, and enforce the 40 scans/day/user proxy quota in Cloudflare KV. |
| Product Interaction Telemetry | Pseudonymous product lifecycle events (e.g., onboarding_completed, paywall_viewed, trial_started, scan_completed) and self-reported onboarding attribution source. |
Sent to PostHog for aggregate product reliability and funnel diagnostics. Contains no HealthKit values, no meal photos, and no advertising identifiers. |
2. Third-Party Service Providers (Sub-Processors)
We share the minimum necessary technical data with the following sub-processors solely to provide app functionality (Apple Guideline 5.1.2):
- Google LLC (Google Gemini API via ShotShield Cloudflare Worker Proxy): Processes downscaled, metadata-stripped meal photos and a coarse dose-phase bucket only after you accept the in-app
AIConsentSheet. Used exclusively to return structured JSON macronutrient estimates. Paid API tier; data is not used by Google to train models. - Cloudflare, Inc. (Cloudflare Workers & Workers KV): Routes scan requests, caches anonymous RevenueCat entitlement verification for up to 1 hour, and enforces the 40 scans/day/user fair-use counter keyed by anonymous App User ID.
- RevenueCat, Inc.: Validates Apple StoreKit 2 receipts and manages subscription entitlements across devices.
- PostHog, Inc.: Receives pseudonymous product interaction events (app version, event name, scan latency).
3. Apple HealthKit Compliance Disclosure (Guideline 5.1.3)
ShotShield's use of information received from Apple HealthKit adheres strictly to the Apple Developer Program License Agreement and App Store Review Guideline 5.1.3:
- We never use or disclose HealthKit data for advertising, marketing, or other use-based data mining purposes.
- We never sell HealthKit data to advertising platforms, data brokers, or information resellers.
- We never transmit HealthKit data to third-party AI providers (including Google Gemini).
- We do not write false or unverified data into the HealthKit store; only complete or user-confirmed meal protein logs, water logs, and manual weight logs are written when HealthKit sync is enabled.
4. Data Retention & Instant Deletion (Guideline 5.1.1(v))
Because your profile, dose history, meal logs, and weight history are stored on-device in SwiftData, you have complete control over your records at all times:
- In-App Instant Data Deletion: Open ShotShield → Settings → Delete All Data and confirm. This immediately and permanently erases all local SwiftData records (
UserProfile,DoseLog,MealScan,DailyLog,WeightEntry) and wipes the App Group widget snapshot. - Server-Side Quota / Entitlement Deletion: If you wish to purge your anonymous RevenueCat subscriber record or Cloudflare KV quota key, email privacy@shotshield.app or visit our Support & Data Deletion page. Requests are completed within 7 days.
5. Your GDPR & CCPA/CPRA Privacy Rights
Depending on your jurisdiction (including the European Economic Area, United Kingdom, Switzerland, and California), you have the right to access, correct, export, delete, or restrict processing of your personal data, and to withdraw consent for AI meal photo processing at any time via Settings or by deleting app data. We do not "sell" or "share" personal information as defined by the CCPA/CPRA.
6. Children's Privacy
ShotShield is intended for adults (18+) prescribed or researching GLP-1 therapy. We do not knowingly collect personal information from anyone under the age of 18.
7. Contact Us
For privacy questions, GDPR Data Subject Access Requests (DSAR), or CCPA inquiries, contact our Data Protection Officer at:
Email: privacy@shotshield.app
Support Portal: https://shotshield.app/support