ShiftGuard Privacy Policy

1. Scope

This addendum applies to the ShiftGuard iPhone app and to ShiftGuard support or privacy requests you choose to send to Synap1e.

2. Trip and plan data stored locally

ShiftGuard stores the itinerary details you enter or approve, onboarding answers, generated day plans, action completion, active-trip selection, app preferences, and local purchase-access records on your iPhone. This data is used to show and manage your trips and is not uploaded to a Synap1e account or app database.

3. Optional live flight lookup

When you choose live lookup, ShiftGuard sends a flight designator and departure date to a Synap1e-operated endpoint hosted by Vercel. That endpoint requests matching schedule and status information from Aviationstack, an APILayer service, and returns it to the app for your review. It does not receive your onboarding answers, generated plan, Apple Health data, or purchase information. Responses are marked no-store, and Synap1e does not maintain a database of flight lookup request contents or intentionally log request bodies. Hosting and network providers may process standard operational metadata such as IP address, timestamps, and error or security records under their own practices.

4. App security and abuse prevention

On supported devices, ShiftGuard uses Apple App Attest at app launch and on protected live-flight requests. A per-installation key identifier and cryptographic proof are sent to the Vercel endpoint. Upstash Redis temporarily stores one-time challenge records containing a SHA-256 digest of the identifier and a random challenge for up to five minutes, deleting them when used. Longer-lived records are addressed by the same digest and retain the public verification key, replay-prevention counter, and limited app-integrity signals for up to 400 days after the latest verified assertion. A separate aggregate Aviationstack-usage counter expires at the next UTC month boundary. Synap1e does not store App Attest private keys, Apple attestation receipts, raw key identifiers, or flight lookup request bodies in Redis. This data is used only for app functionality, security, abuse prevention, and quota protection, not advertising or cross-app tracking. Upstash's privacy policy is available at https://upstash.com/trust/privacy.pdf.

5. Optional Apple Health context

If you explicitly grant read permission, ShiftGuard can calculate recent average sleep duration and heart-rate variability from Apple Health as personal context. These values stay in memory on the iPhone, are not written to Apple Health, are not sent to Synap1e or the flight provider, and do not change your generated plan. You can use every trip-planning feature without granting Health access.

6. Notifications

If you grant permission and enable reminders, ShiftGuard schedules eligible light, low-light, caffeine, sleep, and wind-down notifications locally through iOS. Notification permission can be changed at any time in iOS Settings.

7. Purchases

Apple processes ShiftGuard Plus subscriptions and one-trip purchases. ShiftGuard reads verified StoreKit transaction and entitlement information needed to unlock access and records limited access state locally. Synap1e does not receive your payment-card details.

8. Analytics, advertising, and website visits

The ShiftGuard app includes no advertising or third-party app analytics SDKs and does not track you across other companies' apps or websites. If you visit this website, standard hosting, security, and performance records may be generated. The app does not send its trip, plan, or Health data to this website; its limited App Attest security data is processed only as described above.

9. Retention and deletion

Local trip and plan records remain until you delete them, reset app data, or remove ShiftGuard, subject to iOS and Apple-managed backup behavior. Flight lookup request contents are processed to answer the request and are not stored in a Synap1e application database. App Attest challenges expire within five minutes, installation security records expire after up to 400 days without a verified assertion, and the aggregate provider counter expires at the next UTC month boundary. Removing the app invalidates its App Attest private key but does not immediately delete those server-side security records. Support messages are kept only as needed to respond, maintain security, and meet legal obligations.

10. Your controls and contact

You can enter trips manually instead of sending flight search content, although App Attest security preparation may still occur at launch on supported devices. You can decline or revoke Health and notification permissions, delete saved trips, reset local app data, remove the app, or contact privacy@synap1e.com about information you deliberately submitted in a support or privacy request.

11. Wellness limitation

ShiftGuard provides general, rule-based guidance about light, caffeine, meals, movement, and sleep timing. It is for informational purposes only and is not medical advice, diagnosis, or treatment.

12. App-specific addendum

13. Contact and policy links

For help with app issues, visit ShiftGuard Support. You can also review Terms of Service.