PRIVACY POLICY

What we collect

Account: when you create a Shift Culture account, we collect your phone number to send a one-time sign-in code. You may add a display name, optional username, optional bio, and a profile photo — all visible to other Shift Culture users.

Profile details you volunteer: during onboarding (or later in your profile) you may optionally tell us your car make and model, your city and state, your interests (e.g. JDM, drift, track), and your build stage. These fields are optional, you can skip or change them anytime, and we use them to match you to relevant giveaways and local events.

Usage analytics: we record in-app activity — screens you view, giveaways and events you open, the giveaway 'enter' button, RSVPs, feed taps, posts you create, and similar interaction events, along with your app version, platform (iOS/Android), and an app-session identifier. This is first-party data stored in our own database. You can turn this off anytime in Profile → Privacy → Usage analytics.

Operational app and notification identifiers: Expo Updates creates a persistent EAS Client ID and sends it to Expo when the app checks for updates, including at launch. On Android, Google Firebase Cloud Messaging automatically generates a Firebase installation ID and native registration token so notification infrastructure can operate; this can happen before notification-display permission is granted. If you grant notification permission, Expo creates an additional notification-installation identifier and Expo Push token. We store the Expo Push token linked to your account, platform, and preferences. Expo Updates may also send limited update-launch failure information to recover a bad update and monitor delivery. The current app does not use Firebase Analytics. The optional Usage analytics setting controls the separate first-party analytics described above, not these required operational services.

Community: when you use the community feed or live group chat, your post or message body, optional post photo, author profile, and timestamp are stored and shown to signed-in members you have not blocked. Likes, comments, blocks, and reports you make are stored under your account. Reported content may be retained as a moderation snapshot after the original content is removed.

Sweepstakes: if you enter a Shift Culture sweepstakes at shiftculturegiveaway.com using the same phone number you use here, your entry count is linked back to your in-app account so it appears under My Entries. Only the phone number, ticket count, and giveaway ID are sent — no payment information ever touches the app.

What we do not collect

We do not collect: government IDs, Social Security numbers, financial account numbers, precise GPS location, your contacts, your calendar contents, microphone recordings, Android Advertising ID, your browsing history in other apps, or any biometric data. We do not embed third-party advertising SDKs in the app, and we do not read data from other apps on your device.

How we use your information

Sign you in. Show your profile to other Shift Culture users. Match you to relevant giveaways and nearby events using the profile details you volunteer. Send the push notifications you opted into. Send marketing by SMS or email only if you opt in. Measure and improve the app and our marketing using usage analytics. Display your sweepstakes entries. Respond to support requests. Prevent abuse. Comply with legal obligations.

We do not sell your personal information for money. We do share limited data for advertising measurement and optimization as described in the next section; you can opt out at any time.

Analytics and advertising

Usage analytics is first-party: events are stored in our own Supabase database, not handed to an ad-network SDK inside the app.

To measure and improve the performance of our own ads (for example, to know that an ad led to a sign-up), selected conversion events may be sent from our servers to Meta (Facebook/Instagram). Where an event includes your phone number or account identifier, it is cryptographically hashed before sending. Under California law (CCPA/CPRA), this may constitute 'sharing' for cross-context behavioral advertising. The current Android app does not send these conversion events and does not access Android Advertising ID.

You can opt out of optional first-party usage analytics and supported advertising data sharing at any time in Profile → Privacy → Usage analytics. This setting does not disable required app-update or notification infrastructure. On iOS, the server-side conversion flow also requires Apple's tracking permission; you can decline and the app still works.

Marketing communications

We only subscribe you to SMS or email marketing (giveaway alerts, event reminders, drops) if you explicitly opt in. We use Klaviyo to maintain provider profiles and manage marketing consent. The app may send your phone number, display name, username, voluntary city/state, car details, interests, and build stage to Klaviyo before you opt in to marketing. Creating or updating that profile does not subscribe you to marketing. If you opt out after subscribing through the app's marketing list, we submit an unsubscribe request. Every marketing message includes an unsubscribe option, and you can withdraw consent anytime by contacting marketing@shiftcultureofficial.com. Transactional sign-in codes are not marketing.

Service providers we use

Supabase (authentication, database, storage, and server functions), Twilio (SMS verification codes), Expo (app updates, update diagnostics, and push notification delivery), Apple or Google (app distribution and notification infrastructure), Klaviyo (profile, consent, and opted-in marketing management), and Meta (server-side measurement on supported consented flows). Each provider receives information needed for its function.

YouTube content is loaded directly from YouTube when you tap a video; Instagram links open Instagram. Those platforms' privacy policies apply to that traffic.

Sweepstakes data

Shift Culture sweepstakes are operated on the separate website shiftculturegiveaway.com under that site's own Privacy Policy and Official Rules. The Shift Culture app is informational only — no entries, payments, or fulfillment happen inside this app. The current giveaway's Official Rules identify Shift Culture LLC as its sponsor. Apple and Google are not sponsors of, nor responsible for, any sweepstakes shown in the app.

Children

Shift Culture is intended only for users 18 or older in the United States. We do not knowingly collect information from children. If we learn that we have, we will delete it promptly. Parents or guardians who believe we may have such data should email marketing@shiftcultureofficial.com.

Account deletion

You can permanently delete your account from inside the app at any time: Profile → gear icon → Account → Delete account. We first submit a Klaviyo data-privacy deletion request using the account phone number; Klaviyo processes that request asynchronously. Only after Klaviyo accepts the request do we remove your uploaded profile and post images and hard-delete your authentication account. Database relationships then remove your profile, user-owned Community content, likes, blocks, Shift Culture-stored Expo Push tokens, notification records, and RSVPs. Linked usage-analytics rows are also removed where present. If Klaviyo does not accept the request or another required step fails, the app reports the failure and keeps the account signed in so you can retry.

If you cannot access the app, use our account-deletion request page. Giveaway entry and winner audit records may be retained where required for sweepstakes, fraud-prevention, tax, or other legal obligations. Their app-account link is removed. Limited moderation, security, provider-log, or backup records may also follow disclosed safety, legal, and processor-retention requirements.

Your rights

California (CCPA/CPRA): you can request the categories and specific pieces of personal information we have collected, deletion, or correction. We do not sell personal information for money. We do 'share' limited data for cross-context behavioral advertising as described in 'Analytics and advertising'; you can exercise your right to opt out of that sharing directly in the app at Profile → Privacy → Usage analytics, or by emailing us.

EU/UK (GDPR): you have rights to access, correct, delete, restrict, port, and object to processing of your personal information. Our legal bases are contract performance (creating your account and providing app/update infrastructure), consent (push notifications, marketing, analytics and advertising sharing), and legitimate interest (security, fraud prevention).

Email marketing@shiftcultureofficial.com to exercise any of these rights.

Data retention

Account profile, uploaded profile and post images, user-owned Community content, Shift Culture-stored Expo Push tokens, notification records, and RSVPs are removed when an in-app hard deletion succeeds. The Klaviyo deletion job is submitted before local deletion and completes asynchronously. Operational installation identifiers maintained on the device or by Expo, Apple, or Google follow those providers' device lifecycles and retention practices rather than the Supabase account cascade. Usage analytics events are otherwise retained up to 24 months for product and marketing analysis; linked rows are removed during account deletion where present. Giveaway entry and winner audit records are retained as required by sweepstakes, fraud-prevention, tax, or other law. Their account link is removed at deletion, but legally required phone, entry, and winner information can remain. Moderation records may be retained long enough to investigate abuse, apply sanctions, handle appeals, or comply with law. Provider logs and backups follow their documented retention schedules.

Security

All network traffic uses TLS. The app uses one-time SMS codes rather than passwords. Database access is gated by row-level security that separates private account data from Community content intentionally shown to signed-in members. No system is perfectly secure; if you believe your account has been compromised, contact marketing@shiftcultureofficial.com immediately.

Changes to this policy

If we make material changes, we'll show an in-app notice on next launch and update the Effective date above. Continued use after the effective date constitutes acceptance.

Contact

Shift Culture LLC
Ft. Pierce, FL
marketing@shiftcultureofficial.com