Privacy & Legal

Privacy Policy

Last updated: October 1, 2026

ShapeHaven Innovations LLC ("ShapeHaven," "we," "us," or "our") operates this website (shapehaveninnovations.com) and one or more mobile applications (each an "App"). We respect your privacy and are committed to protecting any data handled in connection with your use of our website or App(s). This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

Scope & Applicability

This Privacy Policy applies to data collected or processed directly by ShapeHaven Innovations LLC in connection with your use of our website and any of our App(s). By accessing our website or installing/using our App(s), you agree to the terms of this Privacy Policy.

Note: If you use ReturnIQ (our Shopify application), that product has its own dedicated Privacy Policy and Terms of Service. Please refer to those documents for information specific to ReturnIQ.

1. Information We Collect

1.1 Website Usage

When you visit our website, we may collect limited information:

• Privacy-Preserving Analytics: We use Cloudflare Web Analytics on our websites to count page views and measure page performance. It is cookieless, does not fingerprint visitors, and does not build profiles across sites or sessions. We cannot identify you from this data. We do not use Google Analytics, Facebook Pixel, advertising pixels, or any other behavioral tracking services.
• No Cookies: We do not use cookies, local storage, or similar device-storage technologies on our websites.
• Contact Information: If you email us or fill out a contact form, we collect the information you voluntarily provide (name, email, message).

1.2 Mobile App Usage

Our mobile applications are designed with privacy as a core principle:

• Local Storage Only: Any presets, configuration settings, or histories you create within our App(s) are stored locally on your device (e.g., using Apple's UserDefaults or local file storage). We do not transmit that content to the developer or to any server we operate.
• No Personal Data Collection: We do not collect personal information such as your name, email, location, or device identifiers. Some App features make the limited network requests described in Sections 1.3 and 1.4, and none of them send data to us.
• No Third-Party Analytics: We do not embed Firebase, Google Analytics, Mixpanel, or any other analytics frameworks in our App(s).
• Device Diagnostics: Apple's iOS system may record basic diagnostic data or crash logs if you have enabled diagnostics & usage sharing. ShapeHaven does not access or view those logs - Apple's infrastructure handles them.

1.3 VPN and Packet Capture (mDNSShark)

mDNSShark includes an optional packet-capture feature built on a local Network Extension packet tunnel. It is not a VPN service. There is no VPN server, account, or backend. The tunnel starts only when you tap Start Capture, after you have seen a disclosure screen, and you can stop it at any time.

What information is collected

While a capture is running, the tunnel can observe the network traffic of your device, including:

• DNS queries
• Destination IP addresses and ports
• Protocol, packet sizes, and timestamps
• Server hostnames (SNI)

If you turn on the optional, paid TLS Inspection feature and install your own CA certificate, the App can also see decrypted HTTPS requests and responses.

Why it is collected

Only to show you your own traffic inside the App and to let you export it for your own troubleshooting and security analysis. It is not used for advertising, tracking, profiling, analytics, or any other purpose.

Where it is stored

Captured data is written only to the App's private storage on your device (a packet log, a .pcap file, and a metadata file). Each new capture replaces the previous one, and deleting the App removes it. The data leaves your device only if you choose to export it with the system share sheet.

Sharing with third parties

Captured traffic is never sent to ShapeHaven or to any third party. We have no servers that receive it, and the App contains no analytics, advertising, or crash-reporting SDKs. VPN data is not sold, used, or disclosed to third parties, and it is not used for advertising, tracking, or analytics.

How your traffic is handled while capturing

• Your traffic is forwarded to its original destination so your connections keep working. TCP and UDP are forwarded. ICMP (ping) is not.
• When TLS Inspection is on, QUIC (UDP port 443) is blocked so apps fall back to HTTPS.
• DNS lookups: During capture, DNS lookups go to the resolver you set in the App's Settings. The default is Google Public DNS (8.8.8.8 and 8.8.4.4), so Google can see those lookups under Google's own privacy policy. This is the one third-party exposure during capture. You can change the resolver at any time in Settings (IPv4 addresses only).

1.4 Network Features Outside Packet Capture (mDNSShark)

These features are separate from captured VPN data.

• Refresh CISA Data: This button in the Security tab runs only when you tap it. It downloads CISA's public Known Exploited Vulnerabilities catalog and queries NIST's National Vulnerability Database (services.nvd.nist.gov) using the names of device manufacturers seen on your local network. Your device lists and scan results are not uploaded. Those services may log the request under their own policies. The button is disabled while the capture tunnel is running.
• Local network discovery: mDNS, SSDP, subnet scans, and OUI lookups run entirely on your device, use the iOS Local Network permission, and send no data to ShapeHaven.

1.5 In-App Purchases & Payment Processing

Our App(s) may offer in-app purchases or auto-renewable subscriptions. In mDNSShark, TLS Inspection is an auto-renewable subscription with a 3-day free trial, managed through Apple's StoreKit. All billing and payment processing is handled exclusively by Apple through the App Store. We never see, store, or manage your credit card or billing information.

• When you make a purchase or renew a subscription, Apple's systems collect information necessary to complete the transaction (e.g., your Apple ID, purchase receipt, billing country).
• ShapeHaven only receives confirmation from Apple that a valid purchase or subscription exists; we do not receive any of your payment details.
• For details on how Apple handles your purchase data, refer to Apple's Privacy Policy: https://www.apple.com/legal/privacy/resources/

2. Data Retention & Server Information

2.1 ShapeHaven's Servers

• Data Location: We do not operate backend servers for our App(s), and we never receive your data. Network requests the App makes on your behalf (see Sections 1.3 and 1.4) go directly from your device to the services involved, not to us.
• Data Retention: Since all user-generated data remains on your device, ShapeHaven has no server-side retention obligations.

2.2 Apple's Servers (for Purchases)

• Apple retains purchase receipts and basic purchase metadata on secure servers.
• You can review or request deletion of that purchase data via your Apple ID account settings.
• For details on Apple's data retention policies, see Apple's Privacy Policy.

3. Third-Party Services & Links

3.1 App Store (Apple) Services

The App Store handles our App(s) distribution, updates, purchase validation, and (if you've opted in) crash-reporting diagnostics. Any analytics or crash logs generated by Apple's operating system are governed by Apple's Privacy Policy. ShapeHaven does not access those logs directly.

3.2 External URLs

If our website or App includes links to external websites (e.g., for support, documentation, or GitHub), those sites may collect information according to their own policies. Always review the privacy statements of any third-party website before providing personal data.

3.3 No Third-Party Advertising or Analytics

We do not use Google AdMob, Facebook Audience Network, or any other advertising or analytics SDKs in our App(s). We do not collect device identifiers (IDFA), app usage events, or location data for advertising purposes.

3.4 Services Contacted Directly by the App (mDNSShark)

mDNSShark may contact the following services directly from your device. ShapeHaven does not receive this data.

• Google Public DNS (default DNS resolver during capture): Governed by Google's privacy policy. You can change the resolver in Settings.
• CISA and NIST NVD: Contacted only when you tap Refresh CISA Data. Governed by their own policies.

4. Your Rights & Choices

4.1 Access & Deletion

• Your Data: Since we do not collect or store personal data on our servers, there is no personal information for us to access or delete.
• App Data: You can delete all data stored by our App(s) by uninstalling the application. This removes all locally stored settings, histories, and captures. You can also stop a capture at any time, and each new capture replaces the previous one.

4.2 Contact & Requests

If you have questions about your privacy, wish to request information, or have concerns about how we handle data, please contact us at: info@shapehaveninnovations.com

5. Children's Privacy

Our website and App(s) are not intended for children under 13 years of age. We do not knowingly collect any personal data from children under 13. If you believe a child under 13 has inadvertently provided any information, please contact us immediately.

6. Security

We take security seriously. Since we do not collect or store personal data on our servers, the primary security concern is the protection of any data you voluntarily share with us (e.g., via email). We use industry-standard practices to protect such communications.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will provide notice via our website or email if we have collected your contact information.

8. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

ShapeHaven Innovations LLC
Email: info@shapehaveninnovations.com
Website: shapehaveninnovations.com