Security & trust

Where production runs

• Marketing site: shrunkshank.com
• Application: app.shrunkshank.com
• API: api.shrunkshank.com
• Primary datastore: PostgreSQL (managed provider such as Neon, or self-hosted). Job and session support via Redis.

Region and exact provider can vary by deployment. If you would like to know the current production region and subprocessors, contact us.

Encryption & transport

• In transit: production web and API traffic use HTTPS/TLS.
• At rest: database storage uses the encryption practices of the chosen Postgres host (managed providers typically encrypt volumes at rest).
• Secrets (JWT signing keys, SMTP, Stripe) are supplied via environment configuration — not hardcoded in the application.

Access control

• Private workspaces: your data is scoped to your own workspace. Nobody else can see it unless you share it.
• Sharing you control: a coach only sees what you share with them — workouts, plans, food, movement, journal and photos each have their own setting, files are shared one by one, and you can change any of them at any time.
• Sessions: authenticated sessions can be listed and revoked from account settings.
• Email verification: required before login for standard registration.
• MFA: optional TOTP authenticator app with backup codes (enable in Settings). Platform operators can disable MFA platform-wide.

Audit, retention & deletion

• Key account actions are written to an audit log, without copying the content of your diary or notes.
• You can export your account data from Settings, and close your account whenever you like.
• Background jobs expire tokens/sessions, purge aged operational logs per retention rules, and process scheduled workspace deletions when requested.

GDPR

You can access, export and delete your data. See our privacy policy and termsfor how we handle your data.

ShrunkShank is a training and coaching app. It is not a medical device and does not give medical advice.

Typical subprocessors

Depending on configuration, production may involve:

• Cloud host / container platform for the app and API
• Managed PostgreSQL and Redis providers
• Transactional email (SMTP provider)
• Stripe, when payment features are enabled
• An AI provider, when AI features are enabled. If you add your own AI key, AI requests go to the provider you choose instead, under its terms — for coaches, that includes data clients share with you.
• Whoop, if you connect a Whoop device

Ask via support for a current subprocessor list for your deployment.