Skip to content
Shade
Get Shade
FeaturesCompareGuidesCalculator

Privacy Policy

Effective August 6, 2026 · Updated

The short version

Shade has no user accounts, no advertising, and no server of its own. Your skin type, your sun sessions, your saved locations and your settings stay on your phone — we never receive them. A location leaves your device to get the UV forecast from Apple’s weather service, and anonymous, non-personal usage events (like which screen you opened, or that a subscription paywall was shown) go to our analytics provider, PostHog, so we can see whether the app is actually useful. Neither ever includes your skin type, sessions, location, or anything that identifies you.

1. Who we are

Shade is made by Vibrantvibes OÜ, a company registered in Estonia. For the purposes of the EU General Data Protection Regulation (GDPR), Vibrantvibes OÜ is the data controller for the processing described here.

You can reach us about anything in this policy at [email protected].

2. What stays on your device

Shade stores the following in the app’s own storage on your device — in iOS user preferences and in files inside the app’s container. We never receive any of it, and we have no way to read it:

  • Your skin type (Fitzpatrick I–VI) and any skin concerns you select
  • Your current protection setting (bare skin / sunscreen / covered) and your SPF preference
  • Your sun-session history — the date, duration, start and end UV index, and the calculated UV dose for each session
  • Locations you save, and the last coordinates the app resolved for you
  • A cached copy of the most recent weather and UV forecast
  • Your settings: notification preferences and alert times, which side you start a session on, temperature unit, and appearance
  • Whether you have an active subscription

The widget. If you add a Shade widget to your Home or Lock Screen, the app puts a small summary — the current UV, your estimated burn time, today’s UV curve and the location name — in storage it shares with the widget on your device. That is how the widget draws itself without going online. It stays on your device like everything else here.

Deleting it. You can remove saved locations in the app. To remove everything else — sessions, settings, cached forecasts — delete the app from your device; that erases the app’s storage entirely. If you use iCloud or iTunes device backups, Apple’s backup may contain a copy of the app’s files; that backup belongs to you and Apple and is governed by Apple’s terms, not ours.

3. What leaves your device, and who receives it

What leaves your device goes to Apple, for the weather forecast and your purchases, and to PostHog, for anonymous usage analytics. We run no server of our own, and no company other than these two receives anything from the app.

Apple WeatherKit (UV and weather forecasts)

To show a UV index, Shade sends the coordinates in question to Apple WeatherKit, Apple’s weather service. The request contains the coordinates and the names of the weather fields requested — no account, no device identifier, no name, no advertising ID. As with any internet request, your IP address is necessarily visible to the service receiving it.

Apple’s handling of these requests is governed by Apple’s Privacy Policy. Apple requires apps using this data to show an Apple Weather attribution mark, which is why you see one in the app; it links to Apple’s list of data sources.

Coordinates are sent in these situations, and no others:

  • When you open the app or refresh, for your current or selected location.
  • When you open the location list, so each of your saved locations can show its current UV.
  • While the app is closed, if you have the daily UV alert switched on. iOS periodically wakes the app in the background, and it sends your last known coordinates to Apple WeatherKit to decide whether to warn you about high UV that day. This is the one time data leaves your device without you being present. Turn the daily alert off in the app, or turn off Background App Refresh for Shade in iOS Settings, and it stops.

Other Apple services

Some other features use Apple’s services too, which means Apple receives data:

  • Place names. Shade asks Apple’s geocoding service to turn your coordinates into a city name for display.
  • Location search. When you search for a place, what you type — plus an approximate region, so the results are relevant — goes to Apple Maps.
  • Purchases. Subscriptions are bought and managed through the App Store. Apple takes the payment; we receive only the fact that a subscription is active — never your name, email, or payment details.
  • Live Activities. With Shade Plus, an active sun session appears on your Lock Screen and in the Dynamic Island. It is drawn on your device from local data — no push token is used and nothing is sent to Apple’s servers — but be aware the session is visible to anyone who can see your Lock Screen.

Apple’s handling of that data is governed by Apple’s Privacy Policy.

PostHog (anonymous usage analytics)

Shade sends a small number of anonymous product-usage events to PostHog, hosted in the EU, so we can tell whether people actually use the app’s features and whether the subscription paywall is working — for example, that a session was started, that a screen was opened, or that the paywall was shown or led to a purchase.

Each event carries only:

  • A randomly generated identifier created on your device. It is not your Apple ID, not an advertising identifier (IDFA), and cannot be used to identify you or linked back to you by us or by PostHog.
  • The event name and a small amount of context relevant to it — for example, which screen was opened, or which product was purchased.

Events never include your skin type, sun-session history, location, or any other data described in section 2. Shade does not use PostHog’s optional autocapture, screen recording, or automatic tracking features — only the specific events listed above are ever sent, and no session replay of any kind is used.

PostHog’s handling of this data is governed by PostHog’s Privacy Policy.

4. Location

Shade requests “While Using the App” location access only. It never follows your movements, and it holds no location history beyond the last coordinates it resolved. Those last coordinates are what the background daily-alert check uses, as described above.

You can refuse or revoke location access at any time in iOS Settings. Shade still works — search for a location by name instead.

5. Legal bases for processing (GDPR Article 6)

  • Performance of a contract (Art. 6(1)(b)): sending coordinates to Apple’s weather service is how we deliver the forecast you asked for.
  • Consent (Art. 6(1)(a)): device location access, notification permission, and the daily background UV check. You grant these through iOS and in the app, and you can withdraw them at any time without affecting the rest of the app.
  • Legitimate interest (Art. 6(1)(f)): the anonymous PostHog usage events described in section 3, which let us understand whether the app and its subscription are working. Because these events are anonymous, contain no personal data, and are never used to track you across other apps or websites, we rely on our legitimate interest in understanding and improving the app rather than asking for separate consent.

6. What we do not do

  • We do not sell or rent your data. There is nothing to sell — we hold none of it.
  • We do not use crash reporting, attribution, or advertising SDKs, and we do not use PostHog’s autocapture, screen recording, or session-replay features — see section 3 for exactly what our anonymous analytics does send.
  • We do not track you across apps or websites, and we do not use advertising IDs.
  • We do not profile you or make automated decisions with legal effects.
  • We do not access your camera, photos, contacts, or Apple Health data.
  • This website, shadetimer.app, sets no cookies and runs no analytics. If you use the light/dark switch, your choice is stored in your browser’s local storage on your device. Our hosting provider, Cloudflare, may keep standard server logs for security and reliability.

7. Retention

We hold no personal data about you, so there is nothing on our side to retain or delete. Data on your device stays there until you delete the app. Apple’s and PostHog’s handling of the requests Shade sends them is described in section 3; PostHog’s retention period for anonymous analytics events is set out in its own privacy policy.

8. Your rights

Under the GDPR you have the right to access, correct, erase, restrict, and port your personal data, and to object to processing. Because your data lives on your device and not on our servers, you exercise most of these rights directly: view and change it in the app, and erase it by deleting the app.

If you believe we hold personal data about you, or you want to exercise a right, write to [email protected] and we will respond within 30 days. You also have the right to complain to a supervisory authority — in Estonia, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — or to the authority where you live.

9. Children

Shade is not directed at children and we do not knowingly collect any data from children. The app never asks for your age or date of birth.

10. Changes to this policy

We may update this policy — for example if a new feature changes what data is processed. The updated version will be posted on this page with a new effective date. Please check back from time to time.

11. Contact

Vibrantvibes OÜ, Estonia — [email protected]