1. Who we are
Shan (the "Shan: Chinese medicine meals" app and getshan.com) is made by Jack Shi Dan Sun, an independent developer based in Canada ("Jack", "we", "us"). Jack decides how your data is used and is the person responsible for privacy. You can reach him at [email protected].
2. What stays on your iPhone
Shan has no accounts and no server of its own. These stay on your phone:
- What's bothering you, your diet, the foods you avoid and your allergies, and how often you cook.
- Your reading: the signs Shan saw on your tongue and your body type.
- Your dishes, cups, check-ins and notes.
- Photos of dishes you cook, and small copies of menus you snapped.
Profile → Erase everything on this phone removes your reading, dishes and photos. Deleting the app removes everything Shan stored on your phone. Copies in your own iPhone or iCloud backups stay until those backups are replaced. Neither removes analytics we've already received; see Your choices and rights.
3. What leaves your iPhone
Some data goes straight from your phone to the services below, which work for us.
| Who | What | Why |
|---|---|---|
| Google (Gemini AI), USA | Tongue photos, with any notes on what you just ate or drank. Menu photos, with your body type, what you're working on and the foods you avoid. Your IP address. | To read your tongue or a menu and send back a result. |
| PostHog (analytics), USA | A random app ID. The screens and steps you use. Your answers: what's bothering you, your body type, your tongue-reading results, your diet and the foods you avoid, check-ins, and the dishes you open or cook. Notes you type into feedback boxes. Screen recordings. Purchases and errors. Device model, iOS version, language, time zone, and IP address (used to estimate your city). | To see how Shan is used, fix problems and make it better. |
| RevenueCat (subscriptions), USA | An anonymous purchase ID, your App Store purchases, your device's vendor ID, device model, iOS version, language and App Store country. It's linked to your PostHog app ID. | To check your subscription and restore it on a new phone. |
| Apple | Your payment and subscription. | Apple takes payment. We never see your card. |
| Google Fonts and YouTube | Your IP address and browser details, when the app or getshan.com loads a font, or the app loads a recipe video's picture. | To show fonts and video pictures. Videos open in Safari. |
| Cloudflare (website and email) | Your IP address, browser and the pages you visit on getshan.com. No cookies. Emails you send us pass through Cloudflare on the way to Jack's mailbox. | To run the website, count visits and deliver email. |
| Our email provider | Your email address and what you write. Refund emails Shan prepares include your start date, your plan and your Shan ID; call requests include your Shan ID. | To answer you. |
About screen recordings
PostHog records how screens look as you use Shan, so we can see where people get stuck. Recording pauses on the cameras, the pages that show what Shan saw on your tongue, the diet page and anywhere you type. Apple's payment sheet is always hidden. Recordings can still show what's bothering you, your body type and reading in Profile, your allergies, your dishes and dish photos, and menus you kept.
About your notes
Words you type into feedback boxes reach PostHog as you wrote them. We read them to improve Shan and to learn the words people use, which can shape how we describe Shan. We quote you word for word only if you tick "You may quote me."
If something you type sounds like a crisis, Shan shows helplines instead, sends none of your words, and records only that this happened.
4. Your photos
When you photograph your tongue or a menu, Shan sends the photo straight from your phone to Google's Gemini AI and keeps the result. Shan never saves your tongue photo and never shows it back to you. For menus, Shan keeps a small copy on your phone so you can look back.
We use Google's paid Gemini service, so Google handles the photo for us as a service provider. Google doesn't use it to train or improve its products. Google keeps requests, photos included, for up to 55 days only to detect misuse and meet legal duties, and its staff may review requests its systems flag. We can't delete Google's copy early; it expires on Google's schedule.
Photos are optional: if you don't allow the camera, Shan reads you from your answers alone.
5. What we never do
- We don't show ads, and we don't sell or rent your data.
- We don't track you across other apps or websites, and we don't use Apple's advertising ID.
- We don't use your photos or health information to target ads, and we never give them to ad companies.
- We don't use your data to train AI models, and Google doesn't train on your photos.
- We don't access your location, contacts, microphone, photo library or the Health app. Shan only asks for the camera.
- We don't send notifications.
Shan doesn't track you across other sites or apps, and no ad network does so through Shan or getshan.com. So browser Do Not Track signals have nothing to switch off.
6. Why we use your data
- To give you Shan: your reading, your food picks, menu reads and your subscription. This is needed to provide the service you asked for.
- Health information (what's bothering you, your tongue reading, the foods you avoid): we use it to pick your food and, through analytics, to improve Shan. Your tongue photos go to Google only after you tap "OK, open the camera".
- To improve Shan with analytics and screen recordings: this is in our legitimate interest in making Shan work well. There's no switch for analytics in the app yet. To stop all collection, delete the app, and email us to delete what we hold.
- To answer you when you write to us, and to handle refunds.
- To follow the law, for example tax records for purchases.
Shan doesn't make decisions about you with legal or similar effects. Your body type is a food suggestion, not a diagnosis.
7. How long we keep it
| Data | Kept |
|---|---|
| On your iPhone | Until you erase it or delete the app. |
| Photos at Google | Up to 55 days, then deleted by Google. |
| Analytics events (PostHog) | Up to 12 months. |
| Screen recordings (PostHog) | Up to 30 days. |
| Purchase records (RevenueCat) | While you're subscribed, then up to 6 years for tax law. Apple keeps its own records. |
| Emails | As long as we need them to help you, and refund emails as long as tax law requires. |
8. Your choices and rights
Wherever you live, you can ask us to:
- tell you what data we have about you, and who we've shared it with;
- correct it, delete it, or send you a copy;
- stop using it, or withdraw your consent.
Email [email protected] with "Privacy" in the subject. Because there are no accounts, include your Shan ID if you have it: it's in any refund or call email Shan prepared for you. Without it, we can delete data that looks like yours, but we can't send you a copy. Write before you erase or delete the app; it helps us find your data.
We answer within 30 days (45 days for Washington, Nevada and Connecticut residents). If we say no, you can appeal by replying "Appeal", and we'll answer within 45 days. You can also complain to your privacy regulator, such as the Office of the Privacy Commissioner of Canada, your provincial commissioner, the UK Information Commissioner's Office, your EU data protection authority, or your state attorney general.
9. Health information
Shan isn't medical care, but what you tell it about your body counts as health information under many laws. We treat it with extra care: we never sell it and never use it to target ads. If you live in Washington, Nevada or Connecticut, also read our Consumer Health Data Privacy Policy.
10. Where your data goes
Jack is in Canada. Google, PostHog, RevenueCat, Cloudflare and our email provider process data in the United States and other countries. When data leaves your country, these providers' data processing terms protect it, including the European Commission's standard contractual clauses where they apply. Each provider must protect your data at least as well as this policy does. Data in the United States can be accessed by US courts, law enforcement and national security authorities under US law.
11. Age
Shan is for adults 18 and older. It's not meant for children. If we learn that someone under 18 has used Shan, we'll delete what we hold about them.
12. Keeping it safe
Data on your iPhone is protected by iOS. Everything Shan sends travels encrypted (HTTPS). At Shan, only Jack reads the analytics and emails; the providers above can access data only to run their services for us. If a breach puts your data at real risk, we'll tell you and the authorities as the law requires.
13. Changes
When this policy changes, the date at the top changes. If we start using your data in a new way, we'll ask you first in the app.
14. Contact
Jack Shi Dan Sun, developer of Shan and its privacy contact
[email protected]
