Privacy Policy

Shimaru · Effective August 17, 2026

The short version: Shimaru has no accounts, and we collect nothing that identifies you. Your camera never leaves your phone.

Who we are

Shimaru is made by Kenji Emura, an independent developer in Japan, who is the data controller for the data described in this policy. For anything in this policy, email support@shimaru.io. Business address: 〒170-0013 東京都豊島区東池袋2丁目62番8号 BIGオフィスプラザ池袋1206 (BIG Office Plaza Ikebukuro 1206, 2-62-8 Higashi-Ikebukuro, Toshima-ku, Tokyo 170-0013, Japan)

Camera and body data

Shimaru uses your front camera to count exercises. All processing happens on your device, using Apple's on-device body-pose technology. No photo, video, frame, or any body measurement is ever saved, sent to us, or sent to anyone else. Only the final number — how many reps you did, or how long you held a plank — is kept.

Your workout data

Your onboarding answers (like your birthday, height, and weight), goals, alarms, workout history, and streak are stored on your device and, if you use iCloud, in your own private iCloud storage. That storage belongs to your Apple account; we cannot read it. There is no Shimaru server and no Shimaru account. One thing does leave your phone, and it is described under the statistics below: which option you picked on the setup questions that gave you a list to choose from.

Purchases

Payments are processed entirely by Apple. To manage subscriptions we use RevenueCat, a US company, which receives your purchase history under a random identifier — so this purchase record is stored in the United States. It is not linked to your name, email, or identity — we don't know who you are. We process it because it is needed to deliver what you bought, and we keep it only while it is needed to manage your purchases — or until you ask us to delete it.

Notifications

Reminders (such as the trial-end notice) are scheduled locally on your phone. Nothing is sent from a server.

No tracking, anonymous statistics

Shimaru contains no ads and no trackers. We never see your location, contacts, or anything else on your phone. To learn which features help and where people get stuck, the app and this website send anonymous usage statistics — moments like "onboarding finished" or a page visit — to PostHog, our analytics provider, hosted in the European Union. When a setup question gives you a list to choose from, the option you picked rides along with the moment — which goal you chose, where you heard about us, how often you already train, the gender you gave. The numbers you type in never do: your birthday, your height, and your weight stay on your phone, and so does everything the camera measures. In the app the statistics travel under a random identifier with no name, email, or account behind it, and can be turned off anytime in Settings. This website stores nothing on your device for this — no cookies, no identifier; it is served by Cloudflare, which briefly processes your IP address to deliver the page. If the app crashes, it also sends a report to Sentry, our crash-reporting provider, likewise hosted in the European Union: the technical trail of what went wrong and the model of phone it happened on — never your IP address, never a picture of your screen, never anything from the camera. The same Settings switch turns both off. These statistics and reports rest on our legitimate interest in improving the app; they are built so they identify no one, and they are kept only as statistics. Emails you send us are used only to answer you — they are handled by Google's mail servers (mostly in the US) and kept only as long as helping you needs.

Your rights

Outside your own device there are three kinds of records: the RevenueCat purchase record described above, the anonymous usage statistics, and crash reports — neither of the last two contains anything that identifies you. To see or delete the purchase record, email us the support ID shown on the purchase screen. If you are in the EU or UK, you additionally have the legal right to access, correct, or erase this data, and to complain to your local data-protection authority.

Children

Shimaru is for ages 13 and up, and since we collect nothing that identifies anyone, no personal data is collected from children either.

Changes

If this policy ever changes, the change will be posted here with a new effective date before it takes effect.

Contact

Questions? Email support@shimaru.io.