Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains how SL Media Labs LLC ("ShiftClub," "we," "us," or "our") collects, uses, shares, and protects information when you use the ShiftClub mobile application and website (the "Service").

By creating an account or otherwise using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are

ShiftClub is operated by SL Media Labs LLC, a limited liability company registered in Florida, United States.

Contact for privacy questions or data requests: privacy@slmedialabs.com

2. Information We Collect

2.1 Information you provide directly

• Account information: username, email address, password (stored in hashed/encrypted form), profile photo. If you choose to sign in with Google, we also receive your email address, name, profile picture link and Google account identifier from Google. We store these in our sign-in system. We do not use the profile picture link for your ShiftClub profile.
• Profile and Garage content: cars you add to your Garage (make, model, year, photos, nicknames), posts, logbook entries, photos and videos (including the audio in videos you record), comments, and other content you choose to share
• Community activity: communities you create or join, meets you create or respond to, discussion topics and replies, community threads and replies (text and up to four photos each), Car of the Month entries, car tags, and the people you follow, block, or mute
• Marketplace content: listings you create (photos, title/description, category, condition, price and currency, mileage, title status, fitment, and the country/state you select for the listing)
• Business/Vendor information: if you enable a business profile, the business name, description, address, country and state you provide, which are shown on your profile
• Messages: direct messages and community chat messages you send, including marketplace-related messages
• Reports: information you submit when reporting content, listings, or other users
• Support communications: anything you send us when contacting support

2.2 Information collected automatically

• Precise location, only for "Meets near me": if you choose "Near me" and allow location access, the app reads your device's location at that moment, only while you are using the app. It is used to search for meets near you and to look up the name of the place so we can show it. The coordinates are sent as part of that search request. The app does not save them to your account or to our database. Like any internet request, our hosting and service providers may keep short-lived technical logs of requests. To show the name of a place, coordinates may be sent to Apple's (iOS) or Google's (Android) location lookup service, and place searches are sent to OpenStreetMap's Nominatim service. We do not control those providers' log retention. You can refuse or withdraw location permission in your phone's settings and still use the rest of ShiftClub.
• Approximate country: when you sign up or sign in, your country is worked out from the IP address of your connection by our hosting provider, Cloudflare. We store only the country (for example "JM") with your account, not your IP address. We use it to match sponsor ads by country and to produce aggregate statistics.
• Push notification token: if you allow notifications, we store a token that identifies your device for notification delivery. It is removed when you log out of the app or when you request deletion of your account.
• Usage events: we record simple counts of actions such as creating a post, comment, meet, or listing, each with your account number and the time, so we can understand how the Service is used. ShiftClub does not use third-party analytics or advertising SDKs.
• Ad activity: when a sponsor ad is shown or tapped, we record which ad, your account number, and the time, so we can limit how often you see the same ad and report results. Visitors to our website who are not signed in are counted by country only: we do not store any identifier for them in their browser, so there is no per-visitor limit on how often they see an ad.

2.3 Information from third parties

• Google sign-in: if you sign in with Google, Google tells us your verified email address, name, profile picture link and Google account identifier. We do not receive your Google password.
• Sign in with Apple: if you sign in with Apple, Apple gives us a stable Apple ID (an identifier for your Apple account) and an email address, which may be a private relay address that forwards to your real one. We never receive your Apple password. We store an Apple refresh token only so it can be revoked with Apple. We revoke it as soon as you request account deletion and then remove the stored token. If you restore your account by signing in again during the 14-day period, we store a new one.

2.4 Website: what your browser stores and loads

• Not signed in: the website does not store cookies or identifiers in your browser. If you change a display preference (such as light or dark mode), it is remembered in your browser's local storage on your device.
• Signed in: the website keeps your login session and your display preferences (such as light or dark mode) in your browser's local storage on your device. You can clear them in your browser settings or by logging out.
• Fonts and code: the website serves its own fonts and code from our domain. It does not load fonts, scripts, or analytics from third-party servers such as Google Fonts or a code CDN. Photos, videos and sponsor ad images are served from our own Cloudflare storage domains.

3. How We Use Information

We use the information we collect to:

• Operate, maintain, and improve the Service
• Enable core features: your feed, Garage, Marketplace, direct messages, communities, meets, and notifications
• Show your content to other users as intended by the feature you're using (e.g. a public post, a Marketplace listing, a direct message to its recipient)
• Send you push notifications you have allowed, and the emails needed to run your account (such as confirmation and password codes)
• Check content against our rules, including automated review of images and text by a third-party AI service (see Section 4) and review by our staff, and act on reports
• Show sponsor ads matched by country, and produce aggregate statistics
• Provide customer support and respond to your requests
• Detect, investigate, and prevent fraud, abuse, policy violations, and safety issues, including through our content reporting and moderation systems
• Comply with legal obligations

4. How We Share Information

• With other users: information you choose to make visible through your profile, posts, Garage, Marketplace listings, and direct messages is shared with other users as intended by that feature.
• Service providers: these third parties handle information to run the Service:
  • Supabase (database, accounts and sign-in, server functions): holds your account details, content, messages, push tokens, and activity records.
  • Cloudflare (website hosting, photo and video storage via Cloudflare R2, and country detection): stores your uploaded photos and videos, and works out your country from your connection's IP address.
  • Expo, Apple's push notification service (iOS) and Google Firebase Cloud Messaging (Android) (push notifications): receive your push token and the notification text, which can include the first 140 characters of a direct message.
  • OpenAI (content moderation): images and text you submit, such as post photos and captions, comments, community thread and reply text and photos, listing and profile text, and community names, descriptions, rules, icons and banner images, are sent to OpenAI's moderation service to check them against our content rules. OpenAI handles that content under its own terms and privacy policy. Videos are not sent to OpenAI: they are reviewed manually by our staff. Community threads and replies, including their photos, are checked this way and by our staff before other members can see them; until then only their author sees them.
  • Resend (email): sends emails on our behalf, such as account confirmation, password codes, and account-deletion requests.
  • Apple's (iOS) or Google's (Android) geocoder and OpenStreetMap Nominatim (place lookups for meets): receive the coordinates or the text of a place you search for, to return a place name or map position. In the app, a place you type is sent directly from your phone to Nominatim (so Nominatim sees your phone's IP address), and when you use your current location the app asks Apple's (iOS) or Google's (Android) geocoder for the place name. On the website, place searches are sent from our server, not from your browser.
  • LocationIQ (address lookup for meets): the rounded pin of public, pinned, approved meets is sent from our server to LocationIQ to look up the address (district, city, state and country), so meets can be found by place. Nothing that identifies the meet or you is sent.
  • Google (sign-in, if you choose it): receives your sign-in request and tells us your verified email address, name, profile picture link and Google account identifier.
  • Apple (sign-in, if you choose it): receives your sign-in request and gives us a stable Apple ID and an email address, which may be a private relay address. We never receive your Apple password.
  Each provider handles information under its own terms and privacy policy.
• Legal requirements: we may disclose information if required by law, legal process, or to protect the rights, property, or safety of ShiftClub, our users, or others.
• Business transfers: if ShiftClub is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal information. ShiftClub's advertising is fully self-run — we do not use third-party advertising networks or share your data with ad tech providers. We also do not use third-party analytics or crash-reporting services in the app or on the website. We measure how the app is used (for example, app activity and ad views and clicks) with our own systems, and this data is deleted when you delete your account.

5. Marketplace-Specific Data Practices

ShiftClub's Marketplace is a peer-to-peer classifieds feature. ShiftClub does not process payments for Marketplace transactions and is not a party to any transaction between buyers and sellers. Any information you exchange with another user to complete a transaction off-platform (e.g. meeting location, payment details) is shared at your own discretion and risk, and is not collected or stored by ShiftClub beyond what's visible in your in-app messages.

6. Data Retention

We keep your information for as long as your account exists. Your push token is removed when you log out of the app or request deletion.

You can delete your account in the app (Settings › Delete account), on the website while signed in (shiftclub.app/settings), or, if you can't sign in, with our web account-deletion form (we may contact you at the account's email address to confirm the request). Requesting deletion logs you out of all your devices and hides your profile straight away. You have 14 days to change your mind: sign back in, in the app or on the website, and the request is cancelled. If you don't, deletion runs automatically:

• Deleted: the photos in your community threads and replies, your posts, Garage cars, Marketplace and vendor listings, likes, follows, blocks, mutes, community memberships, join requests and invitations to you, event RSVPs, mentions, notifications (those sent to you and those that name you), push notification tokens, usage records, ad records, and AI-moderation records. Your sign-in sessions and tokens are deleted. Your uploaded photos, videos, and meet flyers are removed from our storage.
• Apple sign-in: if you signed in with Apple, we store an Apple refresh token only so it can be revoked with Apple. We revoke it as soon as you request account deletion and then remove the stored token. If you restore your account by signing in again during the 14-day period, we store a new one.
• Removed or scrambled: your username, bio, profile photo, and business details are removed from your profile. In our sign-in system, your email address and phone value are replaced with scrambled values, your password is removed, account metadata is emptied, and any linked login (Google or Apple) is kept only as an empty entry with a scrambled identifier and no email, name, or picture.
• Kept without your name: direct messages, comments, discussion posts, community threads and replies, and community chat messages you wrote stay visible to the people they were shared with, shown under a generic "deleted_user" account. Communities and meets you created stay under that account (meet flyers are removed). The conversation entry in the other person's inbox stays, showing your stripped account with a random "del_" name. Car of the Month winner records stay, without photos or captions, so the public list of past winners stays complete.
• Kept for safety and record-keeping: reports, bans, and appeals involving your account are kept, including any text written in them, for as long as needed to act on abuse and repeat violations and to keep a record of moderation decisions.
• What still identifies the account: a random account number stays on the kept records above, together with the country on your profile, the time the account was created, and the time of your last sign-in. We do not keep your name or email address with these records, but text written inside reports and appeals may contain details that identify someone.

Our database is hosted in the United States (Ohio). Copies in daily backups made by our database provider may remain for about 7 days after deletion before they expire. Our hosting and database providers may keep short-lived technical logs, which can include IP addresses, under their own retention settings.

7. Your Rights and Choices

You can access, update, or delete much of your information directly within the app: edit your profile, delete your own posts, comments, Garage cars, and listings, block and mute other users, turn off notifications in your phone's settings, and delete your account (see Section 6). You can also manage your account and request deletion on the website while signed in, or use the web account-deletion form if you can't sign in.

For anything else, such as asking to see or correct the information we hold about you, contact us at privacy@slmedialabs.com. Depending on where you live, local law may give you additional rights. Tell us what you need and we will respond to your request.

8. International Data Transfers

Because our service providers operate infrastructure in the United States and other countries, your information may be processed outside of the country where you live.

9. Data Security

Information is sent between the app and our servers over encrypted (HTTPS) connections. We take reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

ShiftClub is not directed at, and is not intended for use by, anyone under 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by other reasonable means. Your continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

12. Contact Us

Questions about this Privacy Policy or your data can be sent to privacy@slmedialabs.com.