Privacy Policy

Shift is a mobile application operated by Green Streets Initiative (“GSI,” “we,” “us,” or “our”), a nonprofit organization dedicated to helping people shift trips to healthier, cheaper, cleaner alternatives — and measuring the impact, trip by trip, community by community.

This Privacy Policy explains how we collect, use, disclose, store, retain, and protect personal information when you use the Shift app, the Green Streets Initiative website, and related services, features, programs, challenges, leaderboards, rewards, communications, and community campaigns.

By using Shift, the website, or any related service, you accept the practices described in this Privacy Policy.

If you do not agree with this Privacy Policy, please do not use Shift, the website, or our related services.

We collect information directly from you, automatically from your device when you use Shift or our website, from your participation in programs, campaigns, competitions, rewards, and challenges, and from service providers or program partners that help us operate Shift.

Some information Shift uses can be sensitive because of what it may reveal about you, including precise location data, saved locations, inferred route profile data, and information about minors or students where applicable.

We use that information only to provide and protect Shift, operate the features described in this Privacy Policy, comply with law, or for another purpose we disclose to you.

With your device permission, Shift may access precise GPS location in the background, including when the app is not open or in active use, because automatic trip detection depends on location access.

We use location data to detect when you complete a trip by foot, bike, transit, or vehicle so that trips can be logged automatically without manual input.

We collect:

• GPS coordinates during detected trips
• Trip start and end points during trip detection and processing
• Distance and duration of each trip
• Detected travel mode (walking, cycling, transit, or vehicle)

We also may collect or derive:

• Device permission status for location services
• General neighborhood, route, or area information used to support trip classification and impact calculations
• Technical metadata needed to process a trip, such as timestamps, device operating system, and app version

Shift is not designed to retain a continuous raw location history indefinitely. Location data is used to identify completed trips, after which we retain a trip record such as mode, distance, duration, general area or neighborhood, timestamp, and related impact metrics.

Raw GPS coordinates may be processed on-device, in transit, or temporarily in our systems as needed for trip detection, debugging, security, fraud prevention, or service operation, but they are not retained indefinitely unless otherwise disclosed or required by law.

We use your device's accelerometer and motion sensors, along with the device's activity recognition capabilities, to classify your travel mode. This data is used only for trip detection and is not stored independently of trip records.

When you create an account, we collect:

• Your name and email address
• Authentication credentials (stored securely; passwords are never stored in plaintext)
• Optional profile information such as your neighborhood or school/employer affiliation

We may also collect communications you send to us, support requests, privacy questions or requests, feedback, and similar information when you contact us for any reason.

You are responsible for keeping your account credentials secure and for contacting us promptly if you believe your account has been compromised.

For each detected or manually logged trip, we store:

• Date and time
• Trip mode (walk, bike, transit, car)
• Distance
• Neighborhood or general area (not precise endpoints)
• Calculated impact metrics (CO₂ avoided, estimated cost savings, calories burned)

If you join a challenge or leaderboard, we store your participation, scores, and rankings associated with that competition. Your display name and aggregate stats may be visible to other participants depending on the competition's visibility settings.

We collect standard app and website usage data, including crash reports, feature interactions, performance diagnostics, device and browser information, IP address, access times, pages or screens viewed, and similar technical information.

We use this information to operate, secure, troubleshoot, analyze, and improve Shift and the website.

Where practical, diagnostic and usage data is separated from precise location and trip history, but some technical data may be associated with your account when needed to provide support, maintain security, investigate errors, or comply with law.

To power transit trip classification and streak protection, Shift builds an inferred route profile from your trip history after you have completed at least 10 trips. This profile stores:

• Approximate home area (centroid of your morning trip start points — not a precise address)
• Approximate work area (centroid of your morning trip end points — not a precise address)
• Nearby MBTA stops and typical routes inferred from your trip patterns

This profile is never based on information you enter manually — it is derived entirely from your trip history. It is deleted when you delete your account, and you can view and delete it at any time in app settings.

Saved locations are visible only to you within your account.

We do not disclose saved locations to other Shift users, employers, schools, sponsors, or rewards partners without your explicit consent.

Saved locations may be processed by our service providers as necessary to provide, host, secure, and support Shift, and may be disclosed if required by law or valid legal process.

You can view, edit, or delete your saved locations at any time in app settings.

Saved locations are deleted when you delete your account, subject to ordinary backup cycles, legal obligations, security needs, or other limited retention permitted by applicable law.

If you choose to participate in a What Moves Us community storytelling campaign, we collect the following additional data:

• Short video or audio recordings of your responses to campaign prompts
• Your consent acknowledgment and the date it was given
• Which campaign prompts you responded to and whether you skipped any

How this data is used: Your recordings may be shared publicly on a Green Streets Initiative webpage and may be provided to the organization that commissioned the campaign, such as a municipality, transportation planning agency, or similar planning organization, as described in the campaign-specific consent terms shown to you before you record anything.

Because video or audio recordings may include your image, voice, statements, or other identifying characteristics, recordings may be identifiable even when related reports use aggregated or anonymized themes.

You will be shown the specific sharing, publication, and deletion terms for each campaign before you submit any recording.

Retention:Campaign recordings are retained for the duration of the project for which they were collected, typically 12–24 months, unless a shorter or longer period is disclosed in the campaign-specific consent terms or required by law. You may withdraw consent and request deletion of your recordings at any time in app settings or by contacting info@gogreenstreets.org, subject to legal, archival, operational, or already-published materials that cannot reasonably be withdrawn.

What is never shared: Your individual trip data, Shift Rate, or location history is never included in What Moves Us deliverables. Campaign participation data is kept entirely separate from your trip and competition records.

We use your information primarily to operate, provide, maintain, secure, personalize, analyze, and improve Shift, the website, and related services, and to fulfill the purposes for which you provided the information.

• Trip detection and logging: Location and motion data is used to detect when you complete a trip and classify the mode of travel.
• Impact calculation: Trip records are used to calculate your personal environmental and financial impact metrics.
• Community features: Aggregate trip data is used to power neighborhood leaderboards, school and employer challenges, and community impact dashboards.
• Notifications: We use your trip patterns to send relevant nudges, milestone alerts, streak notifications, and weekly summaries.
• App improvement: Usage and diagnostic data is used to fix bugs, improve accuracy, and develop new features.
• Transit trip classification: For trips where your movement pattern matches a vehicle speed, we compare your route against real-time MBTA vehicle position data to automatically classify the trip as bus, subway, or commuter rail.
• Streak protection: If a significant MBTA service disruption is active on your typical transit route, we may use your inferred route profile to automatically protect your active streak.
• Account administration: We use account information to create and manage accounts, authenticate users, provide support, respond to requests, and maintain account security.
• Fraud prevention and integrity: We use information to detect false or fabricated trips, leaderboard manipulation, misuse of XP, tiers, rewards, offers, discount codes, unauthorized account access, and other potential fraud, illegal activity, or violations of our terms.
• Legal compliance: We may use information to comply with applicable law, regulation, court order, subpoena, legal process, tax obligation, or law enforcement request.
• Service providers: We may use and disclose information to service providers that help us host, operate, secure, analyze, maintain, and improve Shift and related services.
• Aggregated and anonymized reporting: We may anonymize or aggregate information so that it no longer identifies you, and we may use and disclose that anonymized or aggregated information for reporting, research, community impact measurement, partner reporting, grant reporting, planning, and other lawful purposes.
• Program administration: We may use information to administer challenges, competitions, rewards, partner offer access or use, school and employer programs, What Moves Us campaigns, and related program terms.

We do not sell your personal information, use your personal information for targeted advertising, or use your personal information for third-party advertising.

We do not share individual trip records, precise location history, saved locations, inferred route profile data, or personal Shift Rate with employers, schools, sponsors, rewards partners, or other third parties without your explicit consent, except as described in this Privacy Policy or required by law.

If we materially change how we collect, use, share, or retain personal information, we will update this Privacy Policy and provide notice when appropriate.

We share personal information as described in this Privacy Policy, as directed or consented to by you, as needed to provide Shift and related services, or as otherwise permitted or required by law.

With Other Shift Users

Your display name and aggregate impact stats may be visible to other users within shared competitions or community leaderboards, based on the visibility settings of those competitions. Private competitions (e.g., school or employer challenges) are only visible to verified participants.

With Service Providers

We use a limited number of third-party service providers to operate the app:

• Supabase (database and authentication infrastructure): Your account and trip data is stored in Supabase's secure cloud infrastructure.
• Expo / EAS (app delivery and updates): Used to deliver the app and push over-the-air updates.
• Push notification services (Apple APNs / Google FCM): Used to deliver notifications to your device. These services receive your device token but not your location or trip data.
• MBTA API or transit-data providers: Used to compare trip patterns against transit data for transit trip classification and service disruption features.
• Analytics, diagnostics, and infrastructure providers: Used to understand app performance, diagnose crashes, maintain security, and improve functionality.

Our service providers are authorized to use personal information only as needed to provide services to us and must handle personal information in accordance with applicable law and our instructions.

Where appropriate, we enter into contracts requiring service providers to keep personal information confidential and not use it for purposes other than performing services for us.

With Sponsors and Partners

For most access-based partner offers, we do not provide the partner with individual location history, saved locations, inferred route profile data, trip records, or personal Shift Rate.

If a reward, offer, or benefit requires verification, fulfillment, fraud prevention, customer support, or user-requested assistance, we may share only the limited information reasonably necessary for that purpose, such as an access confirmation, discount code status, offer activity, first name, or redemption details where applicable.

We may share more information with a sponsor or partner only with your explicit consent or as required by law.

With Schools and Employers

If you join a school or employer challenge using an invite code, your participation is voluntary, and your aggregate trip counts and impact statistics may be included in reports provided to that organization.

These reports contain only anonymized or aggregated data unless you have explicitly opted in to individual attribution.

Schools and employers do not receive individual trip data, location information, saved locations, inferred route profile data, or your personal Shift Rate without your explicit consent.

Legal Requirements

We may disclose your information if required to do so by law, regulation, or valid legal process, or to protect the rights and safety of GSI, our users, or the public.

Business / Organizational Transfer

We may disclose or transfer personal information in connection with a merger, divestiture, restructuring, reorganization, dissolution, asset transfer, program transition, or similar transaction involving some or all of GSI's assets or operations, subject to applicable law.

Aggregated and Anonymized Data

We may use and disclose information that has been aggregated or anonymized so that it no longer identifies you for any lawful purpose, including community impact reporting, research, planning, partner reporting, grant reporting, and public communications.

We keep personal information for as long as reasonably necessary for the purposes for which it was collected, including to provide Shift, maintain your account, administer XP, tier status, rewards, offer activity, competitions, challenges, campaigns, and programs, comply with legal obligations, resolve disputes, enforce agreements, protect security, and maintain accurate business records.

• Active account: Trip records and account data are retained for as long as your account is active.
• Account deletion: When you delete your account, your personal data, including name, email, saved locations, inferred route profile, and location-derived trip records, is deleted or de-identified from active systems within 30 days, unless a longer period is required or permitted by law, security needs, backup cycles, dispute resolution, fraud prevention, or limited operational needs described in this Privacy Policy. Anonymized or aggregated data may be retained for reporting, research, planning, partner reporting, grant reporting, and community impact measurement because it no longer identifies you.
• Inactive accounts: Accounts with no activity for 24 consecutive months may be deactivated and data deleted, with prior notice sent to your registered email.
• XP, rewards, and offer activity: Your XP or tier status, reward history, offer access history, and related records are deleted or de-identified when you delete your account, subject to ordinary backup cycles, legal obligations, fraud prevention, tax or accounting requirements, dispute resolution, and program, sponsor, or partner reporting needs. Aggregate or anonymized counts may be retained for program reporting, sponsor reporting, partner reporting, grant reporting, research, planning, and community impact measurement because they no longer identify you.
• Route profile: Your inferred route profile is deleted within 30 days of account deletion.

Our website and app may use cookies, pixels, SDKs, device identifiers, analytics tools, and similar tracking technologies to operate our services, maintain security, remember preferences, analyze functionality and performance, understand usage, and improve user experience.

Strictly necessary technologies help us provide core functionality, such as account login, security, app functionality, and service operation.

Analytics and performance technologies help us understand how users interact with the website or app and improve the way our services work.

Functionality technologies may help us remember preferences or personalize app or website features.

We do not use cookies or tracking technologies to sell personal information or serve targeted advertising.

If our practices change, we will update this Privacy Policy before using cookies or similar technologies for targeted advertising.

You can usually set your browser to block or restrict cookies, but some cookies or similar technologies may be necessary for the website or app to function properly.

You can manage many privacy choices directly in Shift:

• Account information: You may view and update certain account information in the app.
• Location permissions: You may revoke background location permission at any time in your device settings. Revoking background location permission will disable automatic trip detection, but you may still be able to use Shift to log trips manually.
• Saved locations: You may view, edit, or delete saved locations in app settings.
• Inferred route profile: You may view and delete your inferred route profile in app settings.
• Notifications: You may adjust or disable notifications in the app's notification settings or in your device settings.
• Account deletion: You may delete your account in the app or by contacting info@gogreenstreets.org. When you delete your account, we delete or de-identify personal information associated with your account as described in the Data Retention section.
• What Moves Us recordings: If you participate in a What Moves Us campaign, you may withdraw consent and request deletion of your recordings as described in the campaign-specific consent terms and in this Privacy Policy.
• Marketing communications: You may opt out of marketing-related emails or text messages as described in the Marketing Emails and SMS/Text Messages section.

You may also contact us at info@gogreenstreets.org to ask questions about your information, request help accessing or deleting your account, or raise a privacy concern.

We may need to verify your identity before helping with account access, deletion, or other account-specific requests. We will review and respond to privacy questions and requests within a reasonable time. We will follow privacy laws applicable to us. If we cannot complete a request, we will explain why when appropriate.

You may opt out of marketing-related emails by following the unsubscribe instructions in any marketing or promotional email you receive or by contacting info@gogreenstreets.org.

If we send marketing SMS/text messages and you no longer want to receive them, you may opt out by replying “STOP” or by following any other opt-out instructions provided in the message.

Operational, transactional, safety, account, and service-related messages may still be sent where permitted by law.

You must be at least 13 years old to create a Shift account.

If you are between 13 and 18, you confirm that you have permission from a parent or guardian to use the app.

The Shift school program is designed for children under 13, but it operates through teacher, school administrator, or institutional accounts, not direct student accounts.

Students under 13 should not create personal Shift accounts or interact with the app directly unless GSI has implemented and disclosed an appropriate consent and school authorization process.

We do not knowingly collect personal information directly from children under 13 without verifiable parental consent, school authorization, or another legally permitted basis.

If you believe we have inadvertently collected personal information from a child under 13 without appropriate consent or authorization, please contact us immediately at info@gogreenstreets.org and we will take reasonable steps to delete the information or otherwise comply with applicable law.

We use commercially reasonable physical, electronic, technical, and managerial safeguards designed to protect the information we collect.

We use commercially reasonable security measures designed to protect your data, including:

• Encrypted data storage, including encryption at rest provided by our infrastructure providers where applicable
• Row-level security on our database, designed to help ensure users can access only their own data
• Authentication tokens that expire and are rotated regularly

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your information using reasonable and appropriate measures.

The transmission of information via the internet or through mobile applications is not completely secure, and any transmission of information is at your own risk. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly if you believe your account has been compromised.

Shift and the website may include links to, integrations with, or data from third-party websites, platforms, APIs, services, app stores, notification services, and transit-data providers.

Your use of third-party websites or services may be subject to those third parties' own terms and privacy policies.

We are not responsible for the privacy practices, content, accuracy, availability, or policies of third-party websites or services that we do not control.

We are committed to making this Privacy Policy accessible to everyone.

To request this Privacy Policy in an alternative format, please contact us at info@gogreenstreets.org.

We may update this Privacy Policy from time to time and we encourage you to review it regularly. If we make material changes, including material changes to how we collect, use, share, or retain location data, we will notify you through the app, by email, by posting a notice on our website, or by another reasonable method before the changes take effect when appropriate.

Your continued use of Shift, the website, or related services after the effective date of an updated Privacy Policy means that you accept the updated Privacy Policy.

If you do not agree with the updated Privacy Policy, you should stop using Shift, the website, and related services.

Green Streets Initiative
Cambridge, MA
info@gogreenstreets.org

If you have questions about this policy or how your data is handled, please reach out. We're a small team and we'll get back to you personally.