Privacy policy
Effective [YYYY-MM-DD]
SHIFTY is run by [Company legal name], [Registered address] ("we"). This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. Questions: [privacy@yourdomain.com].
Who is responsible
SHIFTY is a personal work-time tracker. We are the controller of your account and of the tracking data you sync. Your sessions are private to you: nobody else on SHIFTY — not a workspace admin, not another member — can see your shifts, locations, notes, pay or ratings.
What we collect
- Account (only if you create one): name, email address, password (stored only as a secure hash).
- Work time: when each session started and ended, breaks, the timezone used for your reports, goals, titles, notes, tags, projects, corrections you make (with the reason) and the device events behind them.
- Location — only if you allow it, and only at the moment you clock in, clock out or tap "Try again": coordinates, their accuracy and the time they were captured, plus the name of a place you saved yourself. SHIFTY never tracks you in the background and never sends coordinates to a mapping or geocoding service.
- Optional: hourly pay rate (for estimates), mood and energy ratings, remembered places, companion and reward progress.
- Usage and device: sign-in times, IP address, browser and device type, and error logs needed to run the service securely.
- Cookies: only the ones needed to keep you signed in and remember settings (see the cookie notice).
Without an account, everything stays in your browser on this device and nothing is sent to us. Signing out or erasing the device deletes that local copy.
Why we use it, and on what basis
- To provide the service you or your organization signed up for (performance of a contract).
- To keep the service secure, prevent abuse and fix problems (legitimate interests).
- To send account emails such as confirmations, password resets and invitations (contract).
- To meet legal obligations such as tax records or lawful requests from authorities (legal obligation).
- Anything else, such as product news, only with your consent, which you can withdraw at any time.
We do not sell personal data, use it for advertising or make automated decisions that have legal effects on you.
Who we share it with
Service providers that process data for us under contract, only for the purposes above:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and content delivery | United States / European Union |
| Supabase Inc. | Database, sign-in and file storage | [Supabase project region] |
Also: authorities when the law requires it. Workspace admins see only your name, email and role — never your tracking data. If we sell or merge the business, the new owner must honour this policy.
International transfers
Some providers store data outside [Country, e.g. the United Republic of Tanzania]. Where they do, we rely on safeguards required by law, such as standard contractual clauses and the provider's security commitments.
How long we keep it
- Account and tracking data: until you delete it. Sessions you delete go to the trash until you empty it.
- Location points: 90 days by default; choose 30 days, a year or "keep" in Settings → Privacy, or delete any or all of them there at any time.
- After you delete your account: everything is removed within 30 days.
- Server logs: 30 days. Backups: overwritten within 7 days.
Security
Data is encrypted in transit (HTTPS) and at rest. Database rules let only you read your tracking data, and every correction you make is kept in your own history. No system is perfectly secure: if a breach affects you, we will tell you and the regulator as the law requires.
Your rights
- Access and portability: download everything about you from Settings → Your data, at any time.
- Correction: edit any session (with a reason, kept in its history) or your name in the app.
- Deletion: delete your account from Settings → Your data (see how deletion works).
- Objection and restriction: ask us to stop or limit a use of your data.
- Withdrawing consent: for anything based on consent, at any time, without affecting what came before.
- Complaint: to [Data protection authority, e.g. the Personal Data Protection Commission (PDPC)]. We would like the chance to help first.
Email [privacy@yourdomain.com] from your account's address. We reply within 7 days and may ask you to confirm your identity.
Children
SHIFTY is not for people under 18. We do not knowingly collect their data; if we learn we have, we delete it.
Changes
We will post changes here with a new effective date, and email you before material changes take effect.