ShiftwaveMobile — Privacy Policy

Version 2026-09-23 · Effective 2026-09-23 · Cofactor Systems, Inc., doing business as Shiftwave · shiftwave.co/pages/app-privacy-policy

This is the general privacy policy for ShiftwaveMobile, our app for your phone or tablet. It does not cover the earlier Shiftwave and Shiftwave Controller apps, which have their own policy. The Consumer Health Data Privacy Notice (shiftwave.co/pages/health-data-notice) is separate, and where the two differ about health data, the Notice controls.

The short version

Shiftwave needs an account. You create it once, at one screen after the introduction, and from then on your sessions are sent to us. Most of what the app does still happens on your phone.

One thing is sent whether or not you have an account: what you type or say to the assistant. It is covered in full below, and it is first because it is the thing people least expect.

1 · The assistant — what is sent, always

When you type to the assistant, the whole message is sent to our servers and on to the AI service that answers you. This happens whether or not you are signed in — the assistant's route does not need your account.

What is sent: your message, the hour of day, and up to eight short lines drawn from the sessions on your phone — one of which can include up to three words you used in a note, from a fixed list of twenty. This happens whether or not you are signed in, because the summary is built on your phone from what is already there.
We do not attach your name or your account id to what we send on to the AI service.
We do not say this cannot be traced to you. It is not linked in the message itself; that is not the same as being uncorrelatable, and we will not claim more than we can show.
Our server logs keep none of the words you send or receive — only counts, the kind of exchange, and, if a message reads as a crisis, a marker without the words.
Your conversation is kept on your phone, not on our servers — up to the last 200 messages, so you can read it back. It is deleted when you sign out or delete the app.
If you speak instead of typing, your speech is turned into text on your phone where your phone supports it, and by Apple where it does not. Apple's handling is governed by Apple.

2 · Before your account exists

Sessions do not run until you have an account, so nothing about a session is sent before then. Section 1 still applies — the assistant is not part of your account.

3 · Your sessions

Each session sends: when it started, how long it ran, whether you finished, which protocol you ran, and where it came from. With it goes the name you choose, your birth year, and the preferences you set.

If you use the sensor, the beat-to-beat timing, the pulse signal and the blood-oxygen reading recorded during your session are uploaded as separate files. If you do not use the sensor, nothing from it is collected — though the session itself is still sent, as above.

If you write a note after a session, it is stored with that session on our servers, like the session's other data, and we read it to understand what the protocols do for people. Up to three words from it, matched on your phone against a fixed list of twenty such as wired, foggy or settled, can also be given to the assistant. You can ask us to delete what you wrote at any time, and we will. A spoken note stays on your phone as a recording.

4 · Things you connect, and what each one sends

Nothing in this section happens unless you connect it, and each asks you at the moment you connect it.

Apple Health. We read what you allow in Apple's own sheet. Today that is sleep, step count, active energy, heart rate variability and resting heart rate. What you allow is what we read, and what we read stays on your phone — nothing from Apple Health is sent anywhere.
Calendar. Today your calendar is read only on your phone and nothing from it is sent. If that changes, we will ask you first, and we will tell you exactly what would be sent.

4b · Email from us

We do not send newsletters or marketing email yet. If you said yes to email when you signed up, we will send only to that address, only once we have a way to send, and every email will carry an unsubscribe link.

5 · Who else receives your data

Amazon Web Services — hosting, storage and the AI model that answers you. AWS processes data on our instructions under a data processing agreement, and does not use it for its own purposes.
Amazon Cognito — our sign-in service, on AWS — and Apple or Google if you sign in with them: your sign-in only, never your sessions.
Apple — only for speech-to-text, and only on devices that cannot do it on the phone.

We do not sell your personal information, and we do not share it for advertising.

We have no parent, subsidiary or affiliate that receives your data. Any provider we use is bound to protect it to at least the standard in this policy. No other company collects your data across other websites or apps when you use Shiftwave, and the app carries no advertising or analytics trackers.

How we process it. What your account collects is stored under your account on our servers and used to run your plan, your scores and the assistant; the notes you write are read by us to understand what the protocols do for people; nothing is used to advertise to you, and nothing is sold.

6 · How long we keep it

We keep what your account collects while your account is open. Delete your account in the app — Settings → "Delete my account" — and what it holds goes from our servers, with copies in backups removed within six months; the copies on your phone go when you delete the app. Assistant server logs — which hold no message text (section 1) — are kept for one month.

7 · If Shiftwave is sold

If Shiftwave is ever sold or merged, your data moves only to a buyer bound by these same promises.

8 · Your choices and your rights

Your account is yours to delete, in the app — Settings → "Delete my account" — and everything it holds goes from our servers.
Don't wear the sensor. Don't leave a note. Both are optional.
Turn off anything you connected, at any time, in Settings or by disconnecting it. That stops anything further being sent. It does not remove what has already gone.
Ask us what we hold about you, ask for a copy in a portable form, or ask us to correct it. We answer within 45 days — within one month if you are in the EEA or the UK.
If we refuse a request, you can appeal by replying to our refusal. We answer an appeal within 45 days and tell you why. If we still refuse, you may contact your state's Attorney General.

Where you live may give you more rights than this list — including in the EEA, the UK, and US states with health-privacy or consumer-privacy laws. We honour them.

8b · Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. Widening what leaves under a consent you already gave is a new ask, never a notice.

9 · Where your data is processed

Your data is processed on AWS. Where that happens outside your country, the transfer is covered by the European Commission's Standard Contractual Clauses, which apply automatically under our agreement with AWS.

10 · Children

Shiftwave is for adults. You must be 18 or older to create an account, and you confirm this when you sign up.

11 · Contact

Cofactor Systems, Inc., doing business as Shiftwave · 513 Garden St, STE G, Santa Barbara, CA 93101, United States · info@shiftwave.co. For anything about your data, write to that address and say so; it reaches our data-protection contact. If you are in the EEA or the UK, you also have the rights in the GDPR and UK GDPR — access, correction, erasure, restriction, portability, objection, and the right to complain to your data-protection authority — and we answer within one month. We are appointing a representative in the EU and in the UK; their details will be added here when the appointment is confirmed.

12 · This version

Version 2026-09-23. It describes the app as built on 23 September 2026. If we change this policy in a way that matters, section 8b applies.