Privacy Policy

Last updated 10 October 2026

Shine OS is operated by Shine Health (“we”, “us”). This policy explains what we collect when you use the Shine OS website and app, why, and what rights you have. We have written it to meet the Australian Privacy Act 1988 and Australian Privacy Principles, the EU and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, Canada's PIPEDA and comparable laws elsewhere.

Who is responsible

Shine Health is responsible for (the “controller” of) personal information processed through the service. Contact: [email protected].

What we collect

• Account details. When you sign in with Google we receive your name, email address, profile photo and a Google account identifier. When you sign in with a link we email you, we receive only your email address, plus the name you give us.
• Your health check-ins. Your answers to the Wheel of Health questions across 8 areas (sleep, exercise, nutrition, mental wellbeing, stress, hydration, medical check-ups and mobility) and the scores calculated from them.
• Habits and progress. The habits you add, how often you plan to do them, and the days and times you tick them off.
• Progress reports. The reports we generate from your scores and habit progress. If you ask for a score card (an image of your Shine Score and wheel to share), our server makes it from your report when you ask and doesn't keep it; it's only shared if you share it yourself.
• Coaching. If your plan includes it, your chat messages with your coach, and which group Q&A sessions you join and when.
• Phone notifications. If you turn them on in Settings, we keep a technical address for each device you use (provided by your browser and its push service, such as Apple's or Google's) so we can send you notifications when your coach replies, someone replies to your community posts, a check-in is due, or it's time for a habit you've asked to be reminded about. They say what happened, never your messages or health details; habit reminders show the name of the habit, and we keep the time and time zone you chose for each one. Turning them off, or removing the app, stops them, and the address is deleted with your account.
• Community posts. The topics and replies you post in the community, the reactions you give, and any posts you report (with your reason). Other members see your posts with your first name, the first letter of your last name, a coloured initial and your plan (for example “Sarah K. · Access”); they never see your email, full name, photo, scores or check-ins. Everything you post is visible to all paying members and the Shine Health team, so only share what you're happy for them to read. Moderators (the team, and members the team appoints) can hide or delete posts, and see reports. Tapping your name shows your member card: when you joined, how many topics and replies you've posted, the reactions you've received and your community badges. Progress badges, which come from your check-ins, streaks and Shine Score changes (never the scores themselves), appear on it only if you switch that on in Settings. Photos you add to posts are resized and re-saved before anyone sees them, which removes the hidden details phones store in pictures (such as where and when a photo was taken). They're kept privately in Google Firebase Storage and shown only to members, through links that expire after a couple of hours, and they're deleted with the post or your account. Only share photos you're happy for members to see. If you join a monthly challenge, it adds the challenge's habit to your Shine Plan, and the other members in that challenge see your first name, plan and how many days you've ticked it off that month (nothing else from your plan). If you vote in a poll, others see only the totals, never who voted for what. When someone replies to or reacts to your posts we tell you in the app (🔔), and by email for replies unless you turn that off in Settings. Your posts, reactions and notifications are deleted with your account, and you can delete a post yourself at any time.
• Payments. If you subscribe to a paid plan, Stripe collects your card and billing details; we never see or store your card number. Stripe tells us your email address, which plan you pay for, and whether your subscription is active, and we keep that with your account.
• Settings. How often you want to check in and whether you want report and reminder emails.
• Technical logs. Our server records errors and basic request details to keep the service running and secure. These logs are kept for no more than 30 days.
• Email you send us. If you write to [email protected], we keep your message and address for as long as needed to answer you and keep a record of the exchange.
• Coaching applications. If you apply on our coaching page, we receive your first name, email address, phone number and your answers to the questions, so the Shine Health Coaching team can reply about coaching. They are emailed to our team's inbox only (they are not added to a Shine OS account) and kept like other email, below.

We do not sell personal information and we never use your health information for advertising.

Your health information

Check-in answers, scores and habits are health information, which the law treats as sensitive. We only collect it because you choose to enter it, and we use it only to run the service for you: to show your Health Wheel, track your habits and write your progress reports. You can stop at any time and ask us to delete it.

How we use AI

To write your progress report we send your area scores and habit progress (such as habit names and how often you completed them) to Google's Gemini API. We do not send your name or email address. Google processes this information as our service provider under its API terms. If the AI service is unavailable, we write the report with fixed rules instead. Reports are general wellness information, not medical advice.

Legal bases (GDPR)

• Contract — to create your account and provide the service you signed up for.
• Explicit consent — for your health information (GDPR Article 9(2)(a)). You give it by entering your check-ins and habits, and can withdraw it by asking us to delete your data.
• Legitimate interests — technical logs, for security and reliability. You may object at any time.
• Consent — analytics on our public pages and optional embedded content (see Cookies below), withdrawable through Cookie Preferences.

Cookies and similar technologies

We use browser storage that the service needs to work: your sign-in session (kept by Google Firebase) and your cookie choice. These are strictly necessary and do not require consent.

These things are optional and only happen if you click “Accept All”:

• Google Analytics on our public pages (the home page, coaching, tour, membership, contact, privacy, terms and sign-in pages), to see how visitors find and use them. It sets Google Analytics cookies and sends Google the page visited, the page you came from, and your browser, device and approximate location. It is never used inside the app, so your check-ins, scores, habits, reports and messages are never sent to it, and we do not send it your name or email.
• The Meta Pixel on the same public pages, to measure how well our ads on Facebook and Instagram work and to show our ads to people likely to be interested. It sets Meta cookies and sends Meta the page visited and your browser and device details, which Meta may link to your Facebook or Instagram account under its own privacy policy. Like Google Analytics, it is never used inside the app: your check-ins, scores, habits, reports, messages, plan and community posts are never sent to Meta, and we do not send it your name or email.
• The embedded YouTube video on the home page. YouTube (Google) may set cookies when it loads, so we only load it if you accept or press play.

Your choice is stored in your browser for 12 months, after which we ask again. Change it any time via Cookie Preferences in the footer, or clear site data in your browser settings.

Who processes your information

We use a small number of service providers, each only for the purpose listed:

• Google Firebase (Google Cloud) — sign-in, storing your account data, and storing photos you add to community posts.
• Google Gemini API — writing your progress reports, as described above.
• Google Analytics — counting visits to our public pages, only if you accept it (see Cookies above).
• Meta (Facebook and Instagram) — measuring our ads with the Meta Pixel on our public pages, only if you accept it (see Cookies above).
• Zoom — hosting group Q&A sessions, if you join one. Zoom's own privacy policy covers what happens in the meeting.
• Our hosting provider — running the web server.
• Stripe — taking payments for paid plans. Stripe's own privacy policy covers the payment details it collects.
• Resend — sending sign-in links you ask for, and report and reminder emails if you turn them on.
• Cloudflare — protecting and speeding up the website, forwarding email you send us, and counting visits (Cloudflare Web Analytics, which uses no cookies and doesn't identify you).

Authorised Shine Health admins can see your account details, check-in scores, Shine Plan progress and progress reports, so they can coach and support you and run the service. If you join a plan that includes live chat or group Q&A sessions, this includes the coach or expert working with you. In a group session, the other members taking part can see your Zoom name and anything you choose to say or show, so share only what you're comfortable with.

Your information may be stored and processed outside your country, including in the United States. Where the law requires it, these transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep your account, check-ins, habits and reports for as long as you have an account. If you sign up but never start a plan, we delete your account and its details after 7 days without use. If you ask us to delete your account, we remove this information within 30 days. Technical logs are kept for up to 30 days and correspondence for up to 24 months. Payment records are kept by Stripe for as long as tax and accounting laws require.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your information; to receive it in a portable format; to withdraw consent; to opt out of sale or sharing (we do neither); and not to be treated differently for exercising any of these.

Write to [email protected] from the email address you sign in with and tell us which right you're exercising. We will respond within 30 days. You can also turn report and reminder emails off at any time in Settings. If you're unhappy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority; we would appreciate the chance to resolve it first.

Deleting your account and data

To delete your Shine OS account and everything in it, write to [email protected] from the email address you sign in with and ask us to delete it. If you're on a paid plan, cancel it first in Settings, or ask us to. Within 30 days we delete your account, check-ins, Shine Plan, reports, chat messages and session attendance, and confirm by email.

Adults only (18+)

Shine OS is for adults only. You must be 18 or over to create an account, and we do not knowingly collect information from anyone under 18. If you believe someone under 18 has signed up, contact us and we will close their account and delete their information.

Security

Your account data is stored with Google Firebase, which encrypts it at rest, and our database rules only let you read your own records. Scores and reports can only be written by our server. Access to our server is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

Changes

We will update this page when our practices change and revise the date above. We will let you know in the app or by email about changes that materially affect your rights.