Shut Up & Work logo
Shut Up & Work

Privacy Policy

Shut Up & Work (shutup.work and the Shut Up & Work apps). Last updated: 24 October 2026.

1. Who we are

Shut Up & Work is run by First Basketball, SIA, registration number 40203717722, Lielirbes iela 15-132, Riga, LV-1046, Latvia. First Basketball, SIA is the controller of the personal data described here. In this policy "we" and "us" mean First Basketball, SIA.

Contact for anything about your data: now@shutup.work. We have not appointed a data protection officer.

2. What this policy covers

This policy covers the website shutup.work, including the early-access waitlist, and the Shut Up & Work app on the web, iPhone, iPad, Mac and Android once it launches. Sections 3 to 5 apply to the website today. Section 6 applies to the app.

3. The early-access waitlist

What we collect. When you join the waitlist we receive:

  • your email address;
  • the plan you picked, if you picked one (Monthly, Yearly or Not sure yet; the short sign-up form at the top of the page does not ask);
  • a record of your consent: the consent text you agreed to and the time you submitted the form (UTC);
  • the page address you signed up from;
  • the spam-check score returned by reCAPTCHA (see below).

Why. To email you when early access opens and with launch updates, and to see which plan people prefer so we can set pricing.

Legal basis. Your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in any of our emails or by writing to now@shutup.work. Withdrawing does not affect anything we did before.

How it is handled. The form sends your details to our website server, hosted by DreamHost, which emails the sign-up to our mailbox now@shutup.work. That mailbox is hosted by DreamHost, with incoming and outgoing mail handled by its email partner MailChannels, and we read it in Gmail (Google). If we start using a separate service to send launch emails, we will name it in this policy before we use it.

How long we keep it. Until you unsubscribe or ask us to delete it, and in any case no longer than 24 months after our last email to you.

Spam protection. To keep bots off the list we use:

  • a hidden field that people never see;
  • a minimum time between opening the page and submitting;
  • a limit on sign-ups per connection. For this we keep a one-way hash of your IP address for one hour, then it is deleted automatically;
  • Google reCAPTCHA v3. It loads when you start using the form. Google receives information such as your IP address, browser and device details and how you interact with the page, and may set or read cookies. We receive a score that tells us how likely the sign-up is to come from a bot, and we send your IP address to Google when we check the result. Google's Privacy Policy and Terms apply.

The legal basis for spam protection is our legitimate interest in keeping the waitlist free of abuse (Article 6(1)(f) GDPR).

4. Website analytics

We use Google Analytics 4 on shutup.work (through Google's Site Kit plugin) and in the web version of the app to understand how many people visit, which pages they use and where they come from, so we can improve the site and the app. Google Analytics sets cookies in your browser (named _ga and _ga_ followed by an ID) that can last up to two years, and receives information such as the pages you view, your browser and device type, your approximate location and how you arrived. Google says Google Analytics 4 does not log or store IP addresses. Google keeps this event data for no longer than 14 months. We do not use it for advertising.

The legal basis is our legitimate interest in measuring and improving our website and app (Article 6(1)(f) GDPR). You can object at any time: block cookies in your browser settings, or install Google's Google Analytics opt-out browser add-on. You can also write to us. Google's explanation of how it uses data from sites that use its services has more detail.

5. Server logs

Like any website, our host records technical data when you visit, such as your IP address, the time, the page requested and your browser type. This is used to run the site securely and to investigate abuse, based on our legitimate interest (Article 6(1)(f) GDPR). DreamHost keeps these logs for 7 days.

6. The Shut Up & Work app

Account. We use Firebase Authentication (by Google) to create and secure your account. We process your email address and sign-in identifiers, for example from an email sign-in link or from your Google account if you sign in with Google.

What you put in. The things you type into the app (what is on your mind, the one thing you pick, its first step), your timer sessions and your answers when you come back are stored in Google Cloud Firestore (part of Firebase) so the app works across your devices. This data, and the server functions that process it, are in Google Cloud's us-central1 region (Iowa, United States).

AI processing. To pick one thing and write a first step, our server sends the text you entered to Google's Gemini API and returns the answer to you. We send only the text needed for that answer, not your email address or payment details. We use Google's paid Gemini API service. Under Google's terms for it, Google does not use these prompts or answers to improve its products, and keeps them for a limited time only to detect abuse and meet legal obligations. Please do not enter sensitive information, such as health details, in the app.

Free first-step tool. On the website you can try one guided start before subscribing. The text you enter is sent to the Gemini API in the same way to write your first step, and we do not store it. To enforce fair-use limits we keep a counter linked to a one-way hash of your IP address for 24 hours.

Subscriptions and payments.

  • RevenueCat manages subscription status across the web, the App Store and Google Play. It receives an app user ID, your purchase and subscription history, and the country and currency of the purchase.
  • Stripe processes payments made on the web. Your card details go directly to Stripe; we do not receive your full card number.
  • Apple App Store and Google Play process purchases made in the iPhone, iPad, Mac or Android apps under their own privacy policies. We receive transaction details from them, not your card details.

App diagnostics. The web version of the app uses Google Analytics as described in section 4. The iPhone, iPad, Mac and Android apps have no third-party analytics, crash reporting or advertising SDKs.

Legal bases. We process app data to provide the service you signed up for (Article 6(1)(b) GDPR); to keep billing and tax records we are required to keep (Article 6(1)(c)); and to secure the service and prevent fraud and abuse (Article 6(1)(f)).

How long we keep it.

  • Account and content: until you delete your account. We then delete it from our live systems within 30 days and from backups within 90 days.
  • Billing records: for the period Latvian accounting and tax law requires.

To delete your account, write to now@shutup.work from the email address on the account. Deleting your account does not cancel a subscription bought through the App Store or Google Play; cancel that in your Apple or Google account settings.

7. Who receives your data

We do not sell your personal data and we do not use it for advertising. We share it only with the service providers named above, who process it for us under contract: DreamHost and MailChannels (website hosting and email), Google (reCAPTCHA, Google Analytics, Gmail, Firebase Authentication, Firebase Hosting, Cloud Firestore, Cloud Functions and the Gemini API), RevenueCat, Stripe, and Apple and Google for store purchases. We may also disclose data where the law requires it.

8. Transfers outside the EU/EEA

Some of these providers are based in, or process data in, countries outside the EU/EEA, such as the United States. Where that happens, the transfer relies on a European Commission adequacy decision (for example the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can ask us for details at now@shutup.work.

9. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. Write to now@shutup.work; we reply within one month. You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or the data protection authority where you live.

10. Age

Shut Up & Work is for adults. You must be at least 18 years old to join the waitlist or use the app.

11. Changes

If we change this policy we will update the date at the top. If a change is significant we will tell you by email or in the app before it applies.