Help us deliver Shiftwave Recovery Systems to L.A. fire stations. Learn More →

ShiftwaveMobile — Privacy Policy

Version 2026-10-13 · Effective 2026-11-16, or 30 days after we tell you in the app, whichever is later · Cofactor Systems, Inc., doing business as Shiftwave · shiftwave.co/pages/app-privacy-policy

This is the general privacy policy for ShiftwaveMobile, our app for your phone or tablet. It does not cover the earlier Shiftwave and Shiftwave Controller apps, which have their own policy. The Consumer Health Data Privacy Notice (shiftwave.co/pages/health-data-notice) is separate, and where the two differ about health data, the Notice controls.

The short version

You need an account for Shiftwave to keep your sessions, plan and scores. You create it once, before your first session or later if you started in guest mode, and from then on your sessions are sent to us. Most of what the app does still happens on your phone.

Outside guest mode, one thing is sent whether or not you have an account: what you type or say to the assistant. It is covered in full below, and it is first because it is the thing people least expect.

1 · The assistant — what is sent, always

When you type to the assistant, the whole message is sent to our servers and on to the AI service that answers you. This happens whether or not you are signed in — the assistant's route does not need your account.

In guest mode the assistant is off, so nothing you type or say is sent.

  • What is sent: your message, the hour of day, and up to eight short lines drawn from the sessions on your phone — one of which can include up to three words you used in a note, from a fixed list of twenty, and any of which can be a short line you typed yourself, to correct one of ours. This happens whether or not you are signed in, because the summary is built on your phone from what is already there.
  • We do not attach your name or your account id to what we send on to the AI service.
  • We do not say this cannot be traced to you. It is not linked in the message itself; that is not the same as being uncorrelatable, and we will not claim more than we can show.
  • Our server logs keep none of the words you send or receive — only counts, the kind of exchange, and, if a message reads as a crisis, a marker without the words.
  • Your conversation is kept on your phone, not on our servers — up to the last 200 messages, so you can read it back. Signing out or deleting the app removes it from the phone; a copy can remain in your phone's own backups (iCloud or your computer) until you delete them.
  • If you speak instead of typing, your speech is turned into text on your phone where your phone supports it, and by Apple where it does not. Apple's handling is governed by Apple.

2 · Before your account exists

Without an account, sessions run only in guest mode. In guest mode BioDrive still works, using the chair's sensor readings live on your phone. Nothing from the session is kept after it ends or sent to us. With or without an account, and in guest mode too, the app downloads its list of protocols, their sound files and their pictures from our servers. Like any internet request, those downloads reach us from your phone's network address, and each one names the file it is for; they carry nothing else about you, and nothing about your sessions. Section 1 still applies before you have an account, except in guest mode, where the assistant is off.

3 · Your sessions

Each session sends: when it started, how long it ran, whether you finished, which protocol you ran, and where it came from. With it goes the name you choose, your birth year, the preferences you set, the wearables you tell us you use, and the change you pick when we ask what you'd like to be different.

If you use the sensor, the beat-to-beat timing, the pulse signal and the blood-oxygen reading recorded during your session are uploaded in a file of their own, separate from the session record. If you do not use the sensor, nothing from it is collected — though the session itself is still sent, as above.

What the chair did. The same file records what happened during the session: the chair's vibration over time, when you moved the intensity dial or changed the sound, when the session started, paused and ended, and when the chair or the sensor connected or dropped out. Where BioDrive drove the chair, it also records the drive it set from your pulse. This file goes up even when you don't use the sensor.

In Labs, heart and pulse readings from sensors you connect, and chest movement if you turn on the chest accelerometer, can be uploaded with the session too. If you join Labs, your phone also sends us the date you agreed, the date you leave, and which version of the Labs wording you agreed to.

If you write a note after a session, it is stored with that session on our servers, like the session's other data, and we read it to understand what the protocols do for people. Up to three words from it, matched on your phone against a fixed list of twenty such as wired, foggy or settled, can also be given to the assistant. You can ask us to delete what you wrote at any time, and we will. If you say your note instead of typing it, it is turned into writing on this phone and the sound of your voice is not kept; from then on it is your written note.

Everything the app sends to us or downloads from us reaches us from your phone's network address, as any internet request does.

4 · Things you connect, and what each one sends

Nothing in this section happens unless you connect it, and each asks you at the moment you connect it.

  • Apple Health. We read what you allow in Apple's own sheet. Today that is sleep, step count, active energy, heart rate variability and resting heart rate. What you allow is what we read, and what we read stays on your phone — nothing from Apple Health is sent anywhere.
  • Calendar. Your calendar is read only on your phone and nothing from it is sent to us. If you turn on "Put my planned sessions in my calendar", the app adds an event for each session you place: "Shiftwave session" (or the session's name, if you choose that), its time and length, and a link back to the app. Your calendar app stores and syncs it like any other event; we do not receive it.

4b · Email from us

We do not send newsletters or marketing email yet. If you said yes to email when you signed up, we will send only to that address, only once we have a way to send, and every email will carry an unsubscribe link.

5 · Who else receives your data

  • Amazon Web Services — hosting, storage, the AI model that answers you and writes the summary on your session report, and the analysis of sessions inside our cloud that you allow. AWS processes data on our instructions under a data processing agreement, and does not use it for its own purposes.
  • Anthropic — only if you allow the optional 'Deeper analysis with AI tools' item in Labs: your sessions, with your name and email taken off (still linked to your account). The Consumer Health Data Privacy Notice (§6) says exactly what goes and on what terms.
  • Amazon Cognito — our sign-in service, on AWS — and Apple or Google if you sign in with them: your sign-in only, never your sessions.
  • Apple — only for speech-to-text, and only on devices that cannot do it on the phone.

We do not sell your personal information, and we do not share it for advertising.

We have no parent, subsidiary or affiliate that receives your data. Any provider we use is bound to protect it to at least the standard in this policy. No other company collects your data across other websites or apps when you use Shiftwave, and the app carries no advertising or analytics trackers.

How we process it. What your account collects is stored under your account on our servers and used to run your plan, your scores and the assistant; the notes you write are read by us to understand what the protocols do for people; nothing is used to advertise to you, and nothing is sold.

6 · How long we keep it

We keep what your account collects while your account is open. Delete your account in the app — Settings → "Delete my account" — and what it holds goes from our servers, with copies in our backups removed within six months; the copies on your phone go when you delete the app, and any in your phone's own backups when you delete those. Assistant server logs — which hold no message text (section 1) — are kept for one month.

7 · If Shiftwave is sold

If Shiftwave is ever sold or merged, your data moves only to a buyer bound by these same promises.

8 · Your choices and your rights

  • Your account is yours to delete, in the app — Settings → "Delete my account" — and everything it holds goes from our servers.
  • Don't wear the sensor. Don't leave a note. Both are optional.
  • Turn off anything you connected, at any time. Calendar: your phone's Settings › Privacy & Security › Calendars › Shiftwave. Apple Health: the Health app → your profile → Apps → Shiftwave. Labs: Settings in the app. That stops anything further being sent. It does not remove what has already gone.
  • Ask us what we hold about you, ask for a copy in a portable form, or ask us to correct it. We answer within 45 days — within one month if you are in the EEA or the UK.
  • If we refuse a request, you can appeal by replying to our refusal. We answer an appeal within 45 days and tell you why. If we still refuse, you may contact your state's Attorney General.

Where you live may give you more rights than this list — including in the EEA, the UK, and US states with health-privacy or consumer-privacy laws. We honour them.

8b · Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. Widening what leaves under a consent you already gave is a new ask, never a notice.

9 · Where your data is processed

Your data is processed on AWS. Where that happens outside your country, the transfer is covered by the European Commission's Standard Contractual Clauses, which apply automatically under our agreement with AWS. If you allow the optional 'Deeper analysis with AI tools' item in Labs, Anthropic also processes what it receives, on its own systems, outside AWS and outside that agreement (section 5). We do not offer that item in the EEA, the UK or Switzerland.

10 · Children

Shiftwave is for adults. You must be 18 or older to create an account or to use guest mode. You confirm this at the gate, before you can start a session and before the choices you make while setting up leave your phone. Anything you type there goes to the assistant straight away (section 1).

11 · Contact

Cofactor Systems, Inc., doing business as Shiftwave · 513 Garden St, STE G, Santa Barbara, CA 93101, United States · info@shiftwave.co. For anything about your data, write to that address and say so; it reaches our data-protection contact. If you are in the EEA or the UK, you also have the rights in the GDPR and UK GDPR — access, correction, erasure, restriction, portability, objection, and the right to complain to your data-protection authority — and we answer within one month. If you are in the EEA or the UK, you can write to our representative there, as well as or instead of to us, about anything in this policy, and your data-protection authority can too. In the EU our representative under Article 27 of the GDPR is Prighter EU Rep GmbH, c/o Prighter Germany GmbH, Heidestraße 40, 10557 Berlin, Germany. In the UK, under Article 27 of the UK GDPR, it is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom. Reach either of them at https://app.prighter.com/portal/14154397064. They are a point of contact; Shiftwave stays responsible for your data.

12 · This version

Version 2026-10-13. It describes the app as built on 23 September 2026, with later additions: our EU and UK representatives' details (section 11, version 2026-09-27), what Labs sends (section 3, version 2026-09-28), the changes in version 2026-09-29, a fuller description of what each session sends (section 3, version 2026-10-05), and in version 2026-10-13: adding planned sessions to your calendar (section 4), the optional analysis items (section 5), spoken notes (section 3), where your data is processed (section 9), and guest mode (the short version, sections 1 and 2). If we change this policy in a way that matters, section 8b applies.