Data & compliance.

This page summarizes where your Shape data lives, who processes it, how we secure it, and how we approach privacy and compliance. It complements our Privacy Policy and Terms of Service.

Where your data lives

Shape runs on Supabase (managed Postgres database, authentication, and file storage) hosted in the United States. Files such as progress photos and voice notes are kept in private storage buckets and served only through short-lived signed URLs.

Subprocessors

We rely on a vetted set of subprocessors to operate Shape. Each is bound by contract to use your data only to provide its service to Shape. The complete, versioned list — with the data category each receives, the region it is processed in, and the transfer mechanism — is on our Subprocessors page.

• Supabase — database, authentication, and file storage (holds the bulk of your data, including health data).
• Stripe — payments, subscriptions, and coach payouts.
• Vercel — web hosting, edge delivery, and product analytics.
• Cloudflare — DNS, network security, and the Turnstile bot check.
• OpenAI — powers the in-app "Nora" assistant, voice transcription, and text-to-speech. Depending on the feature you use, the text sent can include health and fitness context — for example a summary of your recovery, sleep, weight, or training, or a voice meal-note you record. It is processed only to generate your response; Shape does not use your data to train AI models, sell it, or use it for advertising.
• Google Firebase Cloud Messaging — delivers push notifications (device token + notification content).
• Resend — transactional (and, where you opt in, marketing) email.
• Instacart — only when you choose to send a grocery list to it.
• Wearable & audio services you choose to connect — Apple Health, Strava, Garmin, Whoop, Oura, and Spotify. Each connection asks for your consent and pulls only the metrics you authorize.

The independent coaches you link with are not subprocessors — they are third-party recipients of the data you choose to share with them, for the purpose of coaching you.

Security measures

We protect your data with layered, industry-standard safeguards:

• TLS 1.2+ in transit.
• Encryption at rest.
• Per-user row-level security so each person (and only their linked coach) can reach their data.
• Private, signed-URL storage for sensitive files.
• API rate limiting and request size/shape validation.
• Integration tokens stored server-side, never in the app bundle.
• Least-privilege service keys.
• Automated dependency audits and code review on every change.

Health & sensitive data

Health information you enter on Shape is consumer health data, not HIPAA "Protected Health Information," and we treat it as sensitive. It is share-gated to the coach(es) you choose, and your safety screening is shared with a linked coach so they can work with you safely. For full detail, see our Privacy Policy's Health & medical data section.

Your rights & requests

You can access, export, correct, or delete your data from Settings or by email; we verify identity and respond within 30 days. We honor GDPR (EEA/UK) and CCPA/CPRA (California) rights, including sensitive-data protections. We do not sell personal data, and we do not use your health or fitness data for advertising or to train machine-learning models. Email info@theshapecommunity.com.

Coaches & data responsibility

Trainers and nutritionists are independent professionals. When coaching you they receive only the data needed and agree to keep it confidential, use it solely to coach you, and meet their own legal and professional obligations. Shape provides the security tooling; coaches are responsible for their own conduct and compliance.

Breach response

If a breach affects your personal data, we notify you and any regulator required by law, typically within 72 hours of discovery.

Contact

Reach us at info@theshapecommunity.com for any data, security, or compliance question. For security reports, please use the same address.