Privacy Policy

Last updated: October 23, 2026

Shlivio Inc., a Delaware corporation ("SHLIVIO," "we," "us," or "our"), provides a mobile application that helps users step away from their phones for a set period and log what they did instead, then optionally share a summary with friends or on connected social media accounts (the "App" or "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the App, including beta versions of the App.

1. Information We Collect

We collect only the information needed to operate, secure, and understand the use of the Service:

• Account information: your email address and authentication identifier, provided when you sign in with Apple or Google, and your plan (Free or Plus). We do not receive or store your Apple or Google password. If you use Apple's private email relay, we only ever see the relay address Apple generates, not your real email address.
• Display name: the name your Apple or Google sign-in shares with us or, if none is shared, the part of your email address before the "@" sign. Your display name may be visible to other SHLIVIO users. It is shown to the other members of any SHLIVIO Day you share and in the notifications a host receives when you join their SHLIVIO Day, decline their invitation, or leave their SHLIVIO Day.
• Activity log entries: the activity tags (e.g., "reading," "hiking") you choose for a SHLIVIO Day, and the Day's start time, planned and actual length, and whether it was completed. This is the core content you create using the App.
• Shared SHLIVIO Days: if you host or join a shared SHLIVIO Day, we record who hosts it, who has joined and when, its invite code, its start time, and any change to that start time. The other members of a shared Day can see your display name and that you have joined it.
• Broadcast content: the post text and card image created at the end of a session, if you choose to share it. The going-offline card shows only SHLIVIO branding. The reconnection card shows the activities you logged and how long you were away.
• Connected social media accounts: if you choose to connect a professional (Business or Creator) Instagram account, a Threads, X, or LinkedIn account, or a Facebook Page you manage, we store the account's handle and the platform's identifier for that account. We facilitate the connection through our social-posting service provider (see Section 3). We do not receive or store your social media passwords.
• Beta invitation and admission records: if you join the App during its beta, we keep a record of the invite code you used, any invite codes issued to you and how often they were used, your place on the beta waiting list, and when and how you were admitted, including whether our admission email was delivered.
• Account-connection security logs: when you connect, disconnect, or use a connected social media account, we keep a record of that activity (the account involved, the action taken, and whether it succeeded) for security purposes, to detect and investigate unauthorized or abusive use of connected accounts. We do not use this log for any purpose other than security and integrity.
• Push notification token and delivery records: if you grant notification permission, we store a device push token used solely to deliver in-app notifications (e.g., letting you know someone joined your SHLIVIO Day). For each notification we send, we keep a delivery record: your user ID, the time it was sent, the type of notification, the delivery status reported by our push notification provider, and a one-way hashed form of your push token, never the token itself. Delivery records do not contain the text of the notification. We use them only to confirm delivery and to stop sending to devices that are no longer registered. Your push token and delivery records are not used for analytics, advertising, or tracking.
• App update identifier: when the App is installed, it creates a random identifier for that installation. Each time the App starts, it sends this identifier to Expo, our app update provider (see Section 3), when it checks for App updates. SHLIVIO itself does not receive or store this identifier.
• Share-open records: when you open a sharing option at the end of a session (for example an Instagram Story or a WhatsApp Status), we record which option you opened, for which step of the session, and when. These records are linked to your account.

We do not request access to your contacts. Invitations to friends are sent through your device's own share sheet (e.g., Messages, WhatsApp, Mail). SHLIVIO never reads your contact list.

During the beta, SHLIVIO Plus is provided at no charge. We do not collect payment or purchase information.

2. How We Use Information

• To operate the core features of the App (recording sessions, activity logs, shared SHLIVIO Days, and summaries).
• To post your broadcast content to social media accounts you have explicitly connected, at your explicit request.
• To run the beta, including admitting testers and managing invite codes.
• To understand how the App is used and to improve it, for example which activities people log, how many SHLIVIO Days are started and completed, which platforms are connected and posted to, and which sharing options are opened.
• To prepare aggregated, de-identified statistics about how the App is used. We may share these statistics with investors, prospective investors, and business partners. They describe groups of users, never individual users, and do not identify you. We keep them in de-identified form and do not attempt to re-identify anyone from them.
• To maintain the security and integrity of the Service, including detecting and preventing unauthorized access.
• To communicate with you about your account, the beta, or the Service.

We do not sell your personal information. We do not use your information for targeted advertising.

3. Third-Party Service Providers

We work with the following categories of service providers, who process data on our behalf under their own confidentiality and data-protection obligations:

• Backend and authentication provider (Supabase): stores your account information and the other information described in Section 1 in an encrypted database.
• Social media posting provider (Outstand.so): when you connect a professional Instagram, Threads, X, or LinkedIn account, or a Facebook Page you manage, this provider brokers the connection (via each platform's own OAuth screen), stores the authorization needed to post on your behalf, and relays your broadcast content to the platform(s) you've connected. For automatic posts, the reconnection card image is uploaded to this provider, which hosts it so the platform can publish it. SHLIVIO posts only to a Facebook Page, never to your personal Facebook profile.
• Push notification provider (Expo): delivers in-app notifications through Apple's and Google's push notification services, reports whether each notification was delivered, and delivers App updates.
• Email delivery provider (Resend): sends our beta admission emails to the email address on your account.
• Apple and Google: provide Sign in with Apple and Google sign-in, deliver push notifications to your device, and distribute the App and its beta versions.
• Beta testing (Apple TestFlight and Google Play): if you test a beta version, Apple or Google may share with us your tester email address, the feedback and screenshots you choose to send, your device model and operating system version, and crash reports, under their own terms.
• Social media platforms (Instagram, Threads, Facebook, X, LinkedIn): once posted, your content is subject to that platform's own privacy policy and visibility settings (e.g., public, followers-only). SHLIVIO does not control post visibility on these platforms.

Our posting provider stores the authorization for each social media account you connect, including X, and uses it only to post content you direct us to publish. SHLIVIO itself does not store these authorizations. For X, the connection uses SHLIVIO's own X developer app, and our posting provider stores the resulting authorization on our behalf. When you disconnect an account, or delete your SHLIVIO account, our posting provider deletes the authorization and the other records it holds for that account.

For every connected platform, our backend independently verifies that only you can direct a post through your own connected accounts before any request is forwarded.

The App also offers one-tap sharing to destinations such as an Instagram Story, a WhatsApp Status, or Facebook. For these, SHLIVIO hands your content, including the card image, from your device to your device's share sheet or directly to the app you choose. SHLIVIO does not post the content and does not receive or store any credentials for those destinations. What happens next is governed by that app and its own privacy policy.

We do not share your activity log content with any third party except as necessary to provide the Service (e.g., posting a broadcast you initiated), in the aggregated, de-identified form described in Section 2, or as required by law.

3A. Use of X (Twitter) Data

SHLIVIO's connection to X is used solely to publish content you explicitly create and authorize within the App (a "going offline" or "reconnection" broadcast). SHLIVIO does not use the X API to read your timeline, followers, direct messages, or any other X content. We use information made available through the X connection only as necessary to establish and maintain your authorized connection and publish the posts you direct us to publish. As described in Section 3 above, our posting provider stores the authorization for your X connection and deletes it when you disconnect X or delete your SHLIVIO account. If you revoke SHLIVIO's access to your X account, either within the App or directly through X's own account settings, SHLIVIO will no longer be able to post on your behalf. Posts already published are not retroactively affected. Our use of the X API is subject to X's Developer Agreement and Developer Policy.

4. Data Retention & Deletion

We retain your information for as long as your account remains active, except as described below. You may delete your account at any time directly within the App. Deleting your account is permanent and cannot be undone.

When you delete your account, we disconnect your connected social media accounts, and our posting provider deletes the authorizations and other records it holds for them. We also delete from our active systems your account information, display name, activity log entries, shared Day memberships, connected-account records, account-connection security logs, beta invitation and admission records, invite codes issued to you, push token and delivery records, and share-open records. We do so promptly, except where retention is required to comply with a legal obligation, resolve disputes, or enforce our agreements. Residual copies may persist briefly in routine backups for up to 7 days, until those backups are cycled out.

Push notification delivery records are deleted automatically 30 days after the notification is sent at the latest, and earlier if you delete your account. Your push token is deleted automatically when our push notification provider reports that your device is no longer registered.

After you delete your account, we keep the following, which no longer contain your name, email address, or account identifier:

• A record of each broadcast attempt (the platform, the time, the outcome, and its cost to us), stored under a coded identifier in place of your account identifier, for cost and operations reporting.
• Records our posting provider sent us about the status of posts, with the link to your account removed, for security, accounting, and dispute resolution.
• The aggregated, de-identified statistics described in Section 2.

Broadcast content already posted to a connected social media platform is subject to that platform's own retention and deletion controls, since it becomes content on that platform once posted. A reconnection card image uploaded for an automatic post is hosted by our posting provider for up to 60 days after upload and is then deleted. Deleting your SHLIVIO account does not shorten this period.

If you are the host of a SHLIVIO community and you delete your account, the community you host does not delete along with your account. Instead, the community closes: it stops accepting new activity or membership changes, but the activity data and history other members contributed remains intact and accessible to them. Your own account information and activity log entries are still removed from our systems per the process described above.

5. Your Choices

• You may disconnect a social media account at any time within the App.
• You may delete your account at any time directly within the App. This action is permanent and cannot be undone, as described in Section 4 above.
• You may request a copy of your data by contacting us.
• You may decline to share a broadcast at the end of any session. Posts go out only when you confirm a Day start or end.
• You may decline or turn off notification permission in your device settings.

5A. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you additional rights over your personal information, including the right to: know what personal information we have collected about you; request deletion of your personal information; correct inaccurate personal information; and opt out of the "sale" or "sharing" of your personal information (SHLIVIO does not sell or share personal information as those terms are defined under the CCPA). We will not discriminate against you for exercising any of these rights. To exercise these rights, contact us using the information in Section 10 below.

5B. Other U.S. State Privacy Rights

Depending on your state of residence, you may have rights similar to those described above, including the right to access, delete, or correct your personal information, and to opt out of the sale or sharing of personal information or its use for targeted advertising. SHLIVIO does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. To exercise any applicable rights, contact us using the information in Section 10 below.

6. Children's Privacy

The Service is not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children under that age.

7. International Users

The Service is currently operated from and directed to users in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data protection laws different from those in your country.

8. Data Breach Notification

If a breach of security affecting your personal information occurs, we will notify you by email to the address associated with your account, as required by applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes here and update the "Last updated" date above.

10. Contact Us

Questions about this Privacy Policy can be directed to: privacy@shlivio.com.