Privacy Policy

Last updated: August 25, 2026

Shlivio Inc., a Delaware corporation ("SHLIVIO," "we," "us," or "our"), provides a mobile application that helps users step away from their phones for a set period and log what they did instead, then optionally share a summary with friends or on connected social media accounts (the "App" or "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information We Collect

We collect only the information needed to operate the Service:

• Account information: your email address and authentication identifier, provided when you sign in with Apple or Google. We do not receive or store your Apple or Google password. If you use Apple's private email relay, we only ever see the relay address Apple generates, not your real email address.
• Activity log entries: the activity tags (e.g., "reading," "hiking") and timestamps you record during a session. This is the core content you create using the App.
• Broadcast content: the summary text you choose to generate and share at the end of a session, if you choose to share it.
• Connected social media accounts: if you choose to connect an Instagram, Facebook, X, or LinkedIn account, we facilitate that connection through our social-posting service provider (see Section 3). We do not receive or store your social media passwords.
• Account-connection security logs: when you connect, disconnect, or use a connected social media account, we keep a record of that activity (the account involved, the action taken, and whether it succeeded) for security purposes — to detect and investigate unauthorized or abusive use of connected accounts. We do not use this log for any purpose other than security and integrity.
• Push notification token: if you grant notification permission, we store a device push token used solely to deliver in-app notifications (e.g., letting you know someone joined your SHLIVIO Day). This token is not used for analytics or tracking.

We do not request access to your contacts. Invitations to friends are sent through your device's own share sheet (e.g., Messages, WhatsApp, Mail). SHLIVIO never reads your contact list.

2. How We Use Information

• To operate the core features of the App (recording sessions, activity logs, and summaries).
• To post your broadcast content to social media accounts you have explicitly connected, at your explicit request.
• To maintain the security and integrity of the Service, including detecting and preventing unauthorized access.
• To communicate with you about your account or the Service.

We do not sell your personal information. We do not use your activity log content for targeted advertising.

3. Third-Party Service Providers

We work with the following categories of service providers, who process data on our behalf under their own confidentiality and data-protection obligations:

• Backend and authentication provider (Supabase): stores your account information and activity log entries in an encrypted database.
• Social media posting provider (Outstand.so): when you connect an Instagram, Facebook, or LinkedIn account, this provider brokers the connection (via each platform's own OAuth screen), holds your platform access tokens on our behalf, and relays your broadcast content to the platform(s) you've connected.
• X (Twitter) credentials — held directly by SHLIVIO: for X specifically, SHLIVIO holds its own API credentials directly rather than through Outstand.so. When you connect your X account, the connection is authorized through X's own OAuth screen, and SHLIVIO — not Outstand.so — holds the resulting access token and uses it to publish the broadcast content you direct us to post. Outstand.so still relays and coordinates your broadcast request as part of its unified posting service, but does not hold or have access to your X access token.
• Social media platforms (Instagram, Facebook, X, LinkedIn): once posted, your content is subject to that platform's own privacy policy and visibility settings (e.g., public, followers-only). SHLIVIO does not control post visibility on these platforms.

Regardless of which party (SHLIVIO or Outstand.so) holds the access token for a given platform, our backend independently verifies that only you can direct a post through your own connected accounts before any request is forwarded.

We do not share your activity log content with any third party except as necessary to provide the Service (e.g., posting a broadcast you initiated) or as required by law.

3A. Use of X (Twitter) Data

SHLIVIO's connection to X is used solely to publish content you explicitly create and authorize within the App (a "going offline" or "reconnection" broadcast). SHLIVIO does not use the X API to read your timeline, followers, direct messages, or any other X content. We use information made available through the X connection only as necessary to establish and maintain your authorized connection and publish the posts you direct us to publish. As described in Section 3 above, SHLIVIO holds the X access token directly (rather than through Outstand.so) for this purpose. If you revoke SHLIVIO's access to your X account — either within the App or directly through X's own account settings — SHLIVIO will no longer be able to post on your behalf; posts already published are not retroactively affected. Our use of the X API is subject to X's Developer Agreement and Developer Policy.

4. Data Retention & Deletion

We retain your account and activity log information for as long as your account remains active. You may delete your account at any time directly within the App. Deleting your account is permanent and cannot be undone. We will delete your account information and activity log entries from our active systems promptly, except where retention is required to comply with a legal obligation, resolve disputes, or enforce our agreements. Residual copies may persist briefly in routine backups for up to 7 days, until those backups are cycled out. Broadcast content already posted to a connected social media platform is subject to that platform's own retention and deletion controls, since it becomes content on that platform once posted. We retain account-connection security logs for as long as reasonably necessary to detect, investigate, and prevent unauthorized or abusive use of connected accounts, which may extend beyond the life of your account.

If you are the host of a SHLIVIO community and you delete your account, the community you host does not delete along with your account. Instead, the community closes: it stops accepting new activity or membership changes, but the activity data and history other members contributed remains intact and accessible to them. Your own account information and activity log entries are still removed from our systems per the process described above.

5. Your Choices

• You may disconnect a social media account at any time within the App.
• You may delete your account at any time directly within the App. This action is permanent and cannot be undone, as described in Section 4 above.
• You may request a copy of your data by contacting us.
• You may decline to share a broadcast at the end of any session — sharing is always optional, never automatic.

5A. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you additional rights over your personal information, including the right to: know what personal information we have collected about you; request deletion of your personal information; correct inaccurate personal information; and opt out of the "sale" or "sharing" of your personal information (SHLIVIO does not sell or share personal information as those terms are defined under the CCPA). We will not discriminate against you for exercising any of these rights. To exercise these rights, contact us using the information in Section 10 below.

5B. Other U.S. State Privacy Rights

Depending on your state of residence, you may have rights similar to those described above — including the right to access, delete, or correct your personal information, and to opt out of the sale or sharing of personal information or its use for targeted advertising. SHLIVIO does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. To exercise any applicable rights, contact us using the information in Section 10 below.

6. Children's Privacy

The Service is not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children under that age.

7. International Users

The Service is currently operated from and directed to users in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data protection laws different from those in your country.

8. Data Breach Notification

If a breach of security affecting your personal information occurs, we will notify you by email to the address associated with your account, as required by applicable law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes here and update the "Last updated" date above.

10. Contact Us

Questions about this Privacy Policy can be directed to: privacy@shlivio.com.