Data & compliance.

This page summarizes where your Shape data lives, who processes it, how we secure it, and how we approach privacy and compliance. It complements our Privacy Policy and Terms of Service.

Where your data lives

Shape runs on Supabase (managed Postgres database, authentication, and file storage) hosted in the United States. Files such as progress photos and voice notes are kept in private storage buckets and served only through short-lived signed URLs.

Subprocessors

We rely on a vetted set of subprocessors to operate Shape. Each is engaged to use your data only to provide its service to Shape. Where that restriction rests on a contract we have signed, the Subprocessors page says so; where it currently rests on the provider's own published terms, it says that instead — and for a few services, including the public video-calling service, that is the position today. We would rather point you at the per-service basis than make one blanket promise here. The complete, versioned list — with the data category each receives, the region it is processed in, and the basis we hold — is on our Subprocessors page.

• Infrastructure — hosting, database, authentication, and file storage (holds the bulk of your data, including health data).
• Payments — checkout, subscriptions, and coach payouts.
• AI features — the in-app "Nora" assistant, voice transcription, and text-to-speech.
• Messaging & email — push notifications and transactional email.
• Security & delivery — DNS, bot protection, error reporting, and the files your browser fetches to render a page.
• Features you switch on — wearables, music, food databases, video calling, and grocery hand-off.

The canonical list lives on one page: Subprocessors — every service, the data it receives, whether health data is involved, its region, and the transfer safeguard. Maintained there so no two pages can drift apart.

The independent coaches you link with are not subprocessors — they are third-party recipients of the data you choose to share with them, for the purpose of coaching you.

Security measures

We protect your data with layered, industry-standard safeguards:

• TLS 1.2+ in transit.
• Encryption at rest.
• Per-user row-level security so each person (and only their linked coach) can reach their data.
• Private, signed-URL storage for sensitive files.
• API rate limiting and request size/shape validation.
• Integration tokens for the services we connect on your behalf are stored server-side and are never shipped in the app bundle. One exception worth naming: when you connect Apple Music, Apple's own MusicKit library places a music-user token in your browser's local storage on your device — that is Apple's mechanism, it stays on your device, and disconnecting Apple Music or clearing your browser storage removes it.
• Least-privilege service keys.
• Automated dependency monitoring (Dependabot) that flags known vulnerabilities in the libraries we use and opens grouped update requests, automated secret scanning on every change, and code review before anything ships.

Health & sensitive data

Health information you enter on Shape is consumer health data, not HIPAA "Protected Health Information," and we treat it as sensitive. It is share-gated to the coach(es) you choose, and your safety screening is shared with a linked coach so they can work with you safely. For full detail, see our Privacy Policy's Health & medical data section.

Your rights & requests

You can access, export, correct, or delete your data from Settings or by email; we verify identity and respond within 30 days, wherever you live. California requests are acknowledged within 10 business days. We honor GDPR (EEA/UK) and CCPA/CPRA (California) rights, including sensitive-data protections. We do not sell personal data, and we do not use your health or fitness data for advertising or to train machine-learning models. Email info@theshapecommunity.com.

Coaches & data responsibility

Trainers and nutritionists are independent professionals. When coaching you they receive only the data needed and agree to keep it confidential, use it solely to coach you, and meet their own legal and professional obligations. Shape provides the security tooling; coaches are responsible for their own conduct and compliance.

Breach response

If a breach affects your personal data, we notify you and any regulator required by law, typically within 72 hours of discovery.

Contact

For any data or compliance question, reach us at privacy@theshapecommunity.com. For security reports, please use the same address.