Privacy Policy

01The short version

We collect the least we can get away with, we do not sell it, and we do not run advertising. The specifics differ by product, so the sections below are split by product rather than blended into one vague list.

• The Speedshift website has no accounts and no login. It records privacy-preserving, aggregate visit statistics and nothing else.
• Track Evolution stores the logbook you build — events, sessions, lap times, notes, cars. Telemetry files you import are parsed inside your browser and the source video or data file is never uploaded to us.
• Orbit Rings stores the people you deliberately place into a circle and the interactions you log by hand. It never reads your call or message history, and it does not upload your whole address book.
• Shepherdr has no account and collects nothing. It talks only to a hub you run on your own machine, over your own Tailscale network, so your agents’ screens, prompts and files never reach us.
• We never sell personal information, share it for cross-context behavioural advertising, or use your content to train machine-learning models.
• You can delete your account, and everything in it, at any time.

02Who we are and what this covers

Speedshift LLC is a North Carolina limited liability company. In this policy, "we", "us" and "our" mean Speedshift LLC, and "you" means the person using one of our products.

This policy applies to the Speedshift website, Track Evolution, Orbit Rings and Shepherdr — described together as the "Services". It does not apply to anything else we link out to, including GitHub, LinkedIn, the App Store, Google Play, or a self-hosted copy of our open-source code run by someone else.

We are the controller of the personal information described here. You can reach us about anything in this policy at eric@speedshift.io.

03The Speedshift website

speedshift.com is a set of static pages. There is no account, no login and no tracking cookie.

We use Vercel Analytics to count page views. It records the page visited, the referring site, and coarse device and country information derived from your request. It does not set cookies, does not use a persistent visitor identifier, and does not follow you across other websites. We see aggregate counts, not individual browsing histories.

Our hosting provider also keeps standard server logs — IP address, timestamp, requested URL, user agent — for a short period to operate the site and defend against abuse. If you email an address published on the site, we receive whatever you put in that email and keep the correspondence so we can reply.

If you use the contact form, we receive the name, email address, company and message you enter. They are delivered to a private channel in the team messaging service we use, Slack or Discord, and used only to reply to you. They are not added to a mailing list.

04Track Evolution

Track Evolution is a logbook, so nearly everything it holds is something you typed in or imported on purpose.

The hosted service runs on Cloudflare Workers and Cloudflare D1, in the United States. Your logbook is private to your account unless you publish a share link, described below.

05Orbit Rings

Orbit Rings is about the people in your life, which makes it the most sensitive thing we build. It is designed so that the app only ever knows what you deliberately tell it.

Orbit Rings stores this in Firebase Authentication and Cloud Firestore, operated by Google, so your circles sync across your devices and keep working offline. The app also keeps a local copy on your device for offline use.

A note about other people: the people in your circles have not agreed to this policy, and they are in the app because you put them there. Only add and store what you would be comfortable holding on their behalf, and remove them when they ask.

Orbit Rings is in development and has no store listing yet. If its data practices change materially before release, this policy will be updated before the app ships.

06Shepherdr

Shepherdr is an iPhone app for watching and steering the AI coding agents you run in Herdr. It works differently from our other products: we run no server for it, so there is nothing for us to collect.

Shepherdr contains no analytics, advertising or tracking code. Its network traffic goes over Tailscale, under Tailscale’s own privacy policy, to your machines, and its notifications go through Apple’s push service.

07How we use information

We use the information described above to:

• Provide the Services — store your logbook or your circles, sync them across your devices, compute lap statistics, warmth and cadence, and render the charts and views you asked for.
• Send the notifications and reminders the product exists to send, and any service messages about your account.
• Keep the Services running and secure — diagnose faults, investigate abuse, prevent fraud, and maintain backups.
• Answer you when you write to us.
• Understand, in aggregate, which pages and features are used, so we know what to build next.
• Comply with the law, and enforce our Terms of Service.

We do not use your content to train machine-learning models, and we do not profile you or make automated decisions that produce legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of a contract with you, for everything needed to run the Services; our legitimate interests in operating, securing and improving them; your consent, for device permissions such as contacts, location, camera and notifications, which you may withdraw at any time in your device settings; and compliance with legal obligations where they apply.

08Who we share information with

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we run no advertising in any of our products. We disclose information only in these situations:

09Sharing you control

Track Evolution lets you publish a read-only page of your stats and times under a slug you choose. This is off by default and only exists if you turn it on.

A share link deliberately strips your notes, your email address, per-lap detail and your garage — it shows the pace, not the diary. Even so, a share link is a public web page: anyone with the URL can open it, and search engines or others may copy or cache what it shows. Treat it as public. You can revoke a share link at any time, which takes the page down, though we cannot force third parties to forget a copy they already made.

10Keeping and deleting your data

We keep your account and its contents for as long as your account exists, because that content is the product — a logbook you cannot look back on is not worth much.

You can delete your account from within Track Evolution and Orbit Rings, or by writing to eric@speedshift.io. Deleting your account removes your logbook or your circles, takes down any share links, and closes the account. Deletion completes in our live systems within 30 days and works its way out of encrypted backups within 90 days. We may keep a minimal record of the deletion itself, and anything we are legally required to retain.

You can also delete individual items — an event, a session, a person, an interaction — without deleting your account. Aggregate analytics and server logs, which are not tied to your identity, are kept on their own short schedules.

Shepherdr has no account and we hold nothing from it, so there is nothing for us to delete. Disconnecting the app removes your push token from your hub, and deleting the app removes your hub’s address from your phone.

11Security

Traffic to our Services is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure providers. Authentication is delegated to Google, Apple and Firebase, so we never hold your password. Access to production systems is limited to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. Protect your sign-in account with your provider, since anyone with access to it has access to your data here. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

12Children

Our Services are not directed to children. You must be at least 13 to use them, or 16 if you are in a country where 16 is the minimum age for consent to processing. We do not knowingly collect personal information from children below that age. If you believe a child has provided us information, write to eric@speedshift.io and we will delete it.

13Where your information is processed

We operate from the United States, and our service providers process and store information in the United States and other countries where they run infrastructure. Privacy laws in those countries may differ from the ones where you live.

Where personal information moves out of the European Economic Area or the United Kingdom, it is transferred under the European Commission’s Standard Contractual Clauses, and the UK Addendum where applicable, as incorporated into our providers’ terms.

14Your rights

Whoever and wherever you are, you can ask us to show you what we hold, correct it, export it, or delete it. Most of it you can do yourself inside the app; for the rest, write to us.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, along with the right to withdraw consent at any time. You also have the right to complain to your local supervisory authority, though we would appreciate the chance to sort it out first.

If you are in California, you have the rights to know, delete, correct and, where applicable, to opt out of sale or sharing and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We will not discriminate against you for exercising any of these rights. Residents of other US states with comparable laws — including Colorado, Connecticut, Virginia, Texas and Oregon — have equivalent rights, and we honour them on the same terms.

To make a request, email eric@speedshift.io from the address on your account, or tell us which account it concerns. We will respond within the time the applicable law allows — 45 days under US state laws and one month under the GDPR, each extendable where the law permits. An authorised agent may make a request on your behalf with written proof of authorisation.

15Open source and self-hosted instances

Track Evolution is open source under the Apache 2.0 licence, and anyone may deploy their own instance or point the mobile app at it. This policy covers only the instances we run. If you use an instance operated by someone else, that operator is the one handling your data, and you should ask them for their policy — we have no access to and no responsibility for it.

Shepherdr and herdr-bridge are open source under the MIT licence, and the bridge is always one you run yourself. You are the operator of your hub and of the data on it.

16Changes to this policy

We will update this policy when our products change. The effective date at the top always reflects the current version. If a change materially reduces your privacy — new categories of data, a new purpose you would not expect — we will give you notice in the app or by email before it takes effect, and where the law requires consent, we will ask for it.

17Contact us

Questions, requests and complaints about privacy all go to the same place: eric@speedshift.io. Please say which product you are writing about — it makes the answer faster.