SUNSHIFT · LUDICROUS DESIGNS

Privacy Policy

Effective September 25, 2026 · Website section updated October 12, 2026

1. Who we are and what this policy covers

A & A Design Inc., doing business as Ludicrous Designs ("SunShift," "we," "us," or "our"), provides the SunShift iPhone and iPad app and trysunshift.com. We are responsible for information we control under this policy, including support messages and data processed by our service providers on our behalf. Apple and other providers may also process information independently under their own policies. You can reach us at alexander@ludicrousdesigns.com or +1 240-543-2074.

2. Information used on your device

You may enter airports, flight numbers, dates, local travel times, usual sleep times, chronotype, caffeine preferences, supplement choices, and other planning preferences. SunShift calculates estimated body-clock adjustments and sleep, light, meal, and related guidance locally. Plans, check-ins, progress, preferences, and locally stored technical state remain on your device. A limited next-action snapshot is shared with the SunShift widget through a private app group.

SunShift does not use HealthKit, upload your camera frames, or send your plan or calendar text to a remote AI service. Some independently entered app data may be included in backups managed by Apple or you. Provider-derived flight payloads are excluded from app-created backup storage and expire separately; we cannot erase historical device backups you control.

3. Optional device permissions

Calendar

If you choose calendar import, iOS may grant read access to your calendar so SunShift can find potential flights and trips. Event text is parsed on your device. You review proposed trip details before using them. A permitted background calendar check may look for changes locally. Unrelated events and raw calendar text are not sent to our flight service or analytics providers.

Location

After you choose “Use my location,” SunShift requests While Using access. Approximate location works; the app does not continuously monitor your location in the background. Apple geocoding may receive a location coordinate to resolve a locality and time zone. Coordinates are rounded to roughly kilometre precision before SunShift stores them or sends them to Apple WeatherKit for sunrise and sunset guidance. You can use your entered city instead.

Camera

If you start a light check, the app requests camera access and samples frames on your device to estimate light color. Frames are not displayed as a live preview, saved as photos, or uploaded. The app does not identify people or perform facial recognition. Camera permission is not required for a travel plan.

Notifications

If you enable reminders, SunShift schedules local notifications through iOS. Lock-screen previews may reveal an action or trip detail to people who can see your device; you can change preview and permission settings in iOS.

You can decline these permissions or revoke them in iOS Settings. Denial affects the associated optional feature, not your ability to use manual planning. Revoking a permission does not automatically delete information you previously saved into a trip.

4. Weather and optional online flight information

Apple WeatherKit receives airport coordinates or the rounded location and relevant date needed for forecasts and solar events, along with network information required to deliver the request. Results are cached locally. Apple handles these requests under its privacy policy.

When online flight lookup is available and you choose it, only a normalized flight number, departure date in the origin’s time zone, and optional airport codes are sent to SunShift’s service. Updating a selected flight may also send its provider flight identity and scheduled times. Our service can use Lovable’s hosting infrastructure and AeroDataBox through API.Market to resolve those requests. It does not receive your passenger name, booking reference, passport, full calendar, sleep profile, or wellness-action history. Manual entry remains available when lookup is unavailable.

When the flight service is enabled, provider responses may be held in a private Cloudflare R2 cache for reuse, for no more than seven days from the original provider fetch. Cleanup is designed to begin by day six. Device copies enforce the provider expiry. Aggregate operational counters may be retained for up to 90 days without flight numbers, airport codes, travel dates, or provider payloads. Network providers necessarily receive connection information such as an IP address; this is used to deliver and secure requests. A public flight schedule can be shared across requests and is not a passenger booking record.

5. App Store purchases and RevenueCat

Apple processes subscription payments, renewals, cancellations, and refunds. We do not receive your payment-card number or Apple Account password. SunShift displays its paywall in the app and uses RevenueCat to synchronize receipts and subscription status, restore access, prevent purchase fraud, and report subscription performance. RevenueCat receives a randomly generated app user identifier, product and transaction information, purchase and expiration dates, entitlement status, and technical information such as app and operating-system version, locale, and currency. Requests also involve ordinary connection information.

SunShift uses Apple StoreKit to verify access. We do not send your itinerary, calendar text, sleep profile, or wellness-action details to RevenueCat. Automatic device-identifier collection and optional RevenueCat diagnostics are disabled. Subscription processing continues when optional product analytics is off, because it supports purchases and restoration. See RevenueCat’s privacy policy and Apple’s privacy policy.

6. Optional product analytics

Product analytics is off until you enable it in Settings > Data sharing and save your choice. Enabling it allows Google Analytics for Firebase to receive app opens, sessions, generic product interactions and purchase outcomes, an app-instance identifier, app and operating-system versions, device characteristics, and approximate location inferred from the network connection. Firebase also produces automatic lifecycle and engagement events.

Custom events exclude flight numbers, airports, travel dates, calendar text, trip IDs, sleep preferences, supplement choices, body-clock estimates, and wellness-action details. Firebase's transport libraries may also send limited SDK performance metadata, such as event-queue size and dropped-event counts, to maintain the analytics service. SunShift does not enable advertising identifiers, IDFV collection, Google advertising signals, personalized advertising, or automatic screen reporting. Crash reporting and Advertising Measurement are unavailable and off in this release; we do not send Crashlytics reports.

You can withdraw your analytics choice in Settings > Data sharing. This stops further analytics collection and resets analytics data and the app-instance identifier on the device. It does not erase information already received by Google. Our Google Analytics user/event retention setting is two months with reset-on-new-activity off; that setting does not remove standard aggregate reports on the same schedule. Contact us about data we can identify and lawfully delete. See Firebase’s privacy information.

7. Support and website visits

If you contact us, we receive the email address or other contact details and message content you choose to provide. We use these to answer your request, investigate faults, protect the service, and maintain necessary business records. Please do not send medical records, passwords, payment-card details, or identity documents unless a specific, secure and necessary process has been agreed.

Our website is hosted through HostGator. The hosting infrastructure may process IP addresses, browser details, requested pages, timestamps, and security logs to deliver and protect the site. Our public pages do not add advertising trackers or marketing cookies. We use aggregate hosting statistics to understand which pages are visited. Following an external link takes you to a provider with its own practices. Email links open your chosen mail service.

Interactive website preview. Trip drafts and preview preferences are stored only in your browser’s local storage. They are not sent to SunShift or synced to the app. Use Settings > Clear preview data to remove them, or clear site data in your browser. Example schedules use synthetic trips generated by our app engine; creating a draft does not generate personalized guidance.

Optional website measurement. Measurement is off by default. If you choose Allow measurement under Website privacy choices, our own hosting receives the page category and generic interaction or error code. We do not send draft contents, names, destinations, query strings, error messages, stack traces, or a persistent visitor identifier. We keep aggregate daily counts for up to 90 days and use them to understand usage and errors. To limit abuse, the collector temporarily keeps keyed IP-derived rate-limit values for at most two minutes during activity; the periodic maintenance task also clears expired values. Hosting access logs still follow the hosting practices above. You can turn measurement off through Website privacy choices; your preference stays in this browser until you clear site data. Counts already aggregated cannot be associated with you for deletion.

Operational monitoring checks public pages and generic error counts and sends service alerts to our support address. It does not include visitor trip data.

8. Purposes, legal bases, and sharing

Where a legal basis is required, we rely on consent for optional analytics and device access where applicable; performance of a contract or steps you request for app functionality, purchases, and support; our legitimate interests in operating, securing, preventing misuse of, and understanding subscription performance for the service, subject to your rights; and legal obligations where retention or disclosure is required. Optional permissions are not a condition of buying Pro. We do not use planning estimates to make decisions with legal or similarly significant effects about you.

We disclose information only as described here, to providers performing services for us, at your request, where legally required, or where reasonably needed to protect rights and safety. A merger, sale, or reorganization may involve transfer of relevant business records subject to this policy and applicable law. Providers processing information on our behalf must protect it consistently with this policy and applicable law. We do not sell personal information, share it for cross-context behavioral advertising, create remarketing audiences, or use it to track you across other companies’ apps or websites.

9. Retention and deletion

Local trip and profile information remains until you remove it or remove the app, subject to backups under your control. Remove local trips within SunShift and manage device or cloud backups with Apple’s controls. Clearing a local trip does not cancel a subscription, erase Apple’s purchase records, or delete a shared public flight schedule used by other travelers.

Provider caches and analytics use the periods described above. Purchase records are retained as needed to deliver and restore subscriptions, prevent fraud, resolve disputes, and meet accounting or legal obligations. Support and security records are retained for as long as reasonably needed to resolve the issue, operate and secure the service, and comply with law. In deciding retention, we consider the kind and sensitivity of information, the purpose, whether the relationship is ongoing, and legal requirements. Where deletion is required, we delete or de-identify information we control, except for lawful retention and backup restrictions. Backups may expire under the relevant provider’s cycle and are not used to reactivate deleted records for ordinary operations.

10. Your choices, deletion, and privacy rights

• Use manual entry, decline optional permissions, turn product analytics off, remove local trips, or remove the app.
• Manage or cancel a subscription in Apple Account subscription settings. Removing SunShift does not cancel billing.
• Contact alexander@ludicrousdesigns.com to request access, correction, deletion, a copy, restriction, or objection, or to withdraw consent, where applicable. Withdrawing consent does not affect earlier lawful processing.
• We may reasonably verify that a request concerns your information. We do not require you to create an account to make a request. If we cannot identify records associated with you, we will explain the limitation. We cannot retrieve or erase on-device plans remotely.
• You may use an authorized agent where law permits, appeal a denied request where applicable by replying with “privacy appeal,” and complain to your local data-protection authority. We respond within the applicable legal time limits and do not discriminate for exercising privacy rights.

For California and other U.S. residents whose laws apply: the categories handled may include identifiers and contact details, purchase information, internet/app activity and technical information, approximate location, support correspondence, and information you enter on your device. Sources, purposes, recipients, and retention are described in the corresponding sections. We do not sell or share personal information for targeted advertising, so no sale or sharing opt-out is needed to stop a practice we do not conduct. We do not use sensitive personal information to infer characteristics for advertising.

11. International processing and security

We are based in the United States. Our providers may process information in the United States and other countries whose privacy laws differ from yours. Where required for transfers, we use applicable contractual safeguards or another lawful transfer mechanism. You may contact us for information about safeguards relevant to your data. We use reasonable administrative and technical protections appropriate to information we control, but no system is completely secure. We will provide breach notices where required by law.

12. Children and changes

SunShift is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has supplied information, contact us so we can investigate and delete it as appropriate. Where a higher age or parental permission is required, those requirements apply.

We will update this page and its effective date when practices change, and provide additional notice or seek a new choice where required. A policy update alone does not authorize materially different optional collection. For questions, contact A & A Design Inc. d/b/a Ludicrous Designs, Attn: SunShift Privacy, at the email or telephone above.