Privacy Policy · Shift App

Shift App (shift-app.net and the Shift App iPhone app) is made by aDude LLC, a Florida company. This policy explains what information we collect, why, who we share it with, and the choices you have. We don't sell your information, and we don't use it for advertising.

Who is responsible for your information

Shift App is used by organizations (employers, agencies and teams) to schedule and pay their people. The organization that adds you decides what it records about you and why. For that information, the organization is responsible for it and aDude LLC handles it on the organization's behalf. If you have a question about information your organization keeps about you, ask your organization's admin first. We'll help them answer it. Organizations: our Data Processing Addendum explains how we handle information on your behalf.

What we collect

Account details: your name, email address and password (stored only as a one-way hash), and, if you add them, your phone number and alert settings.
Work details your organization adds: your role, schedule and shifts, crews, pay type and rate, employee ID, hire date, profile photo, certifications (with an optional copy of the card) and an emergency contact.
Time card: when you clock in and out, lunch and breaks, and any changes a supervisor makes, with the reason.
Location: only if your organization turns on GPS clock-in, and only at the moment you clock in or out. We record that one position and how accurate it was. We never track your location at any other time, and the app doesn't run in the background to watch where you are.
Device and sign-in: if you allow notifications, a push token for your device; if you use Face ID, your face data never leaves your iPhone and we never see it. We keep basic sign-in records (time, IP address) to protect accounts.
Billing: for paid plans, the organization's billing email and the card brand, last four digits and expiry. Card numbers go straight to Square and never touch our servers.
Messages: anything you send us by email or the contact form.

How we use it

To run the service: show schedules, let people sign up for and trade shifts, keep time cards, estimate pay and send the alerts and reminders you've turned on.
To keep accounts secure, prevent abuse and fix problems.
To bill organizations on paid plans.
To answer your questions and tell you about changes to the service.

Who we share it with

Only the companies we need to run Shift App, only what they need, and only for that purpose:

Hosting and backups: our web host (HostMedia / StackCP) and our backup storage (Backblaze B2).
Email: our mail provider, to send sign-in, invite and alert emails.
Payments: Square, for organizations on paid plans.
Apple: to deliver push notifications to the iPhone app.
Google Maps: when an admin opens the map for a clock-in, the location of that punch is sent to Google to draw the map. When an admin looks up the address of a work location, that address is sent to Google to find it on the map.
QuickBooks (Intuit): only if your organization connects its own QuickBooks Online company. Then Shift App reads that company's employee list and sends your organization's time card hours to it as timesheet entries for payroll. Your organization can disconnect at any time.

The full list, with what each company does and where, is on our Sub-processors page.

We may also share information if the law requires it, to protect someone's safety, or as part of a sale or merger of aDude LLC (and the new owner would be held to this policy). Inside your organization, admins and supervisors see what their role allows. Other organizations never see your information.

Where your information is stored

Shift App's servers are in the United Kingdom. Nightly backups are kept in the United States, and aDude LLC and some of the companies above are in the United States. When information about people in the EU or UK goes to another country, it's protected by the European Commission's Standard Contractual Clauses and the UK's transfer addendum, as our Data Processing Addendum sets out.

QuickBooks data

When an organization connects QuickBooks, we store the sign-in Intuit gives us, encrypted, and use it only to read that company's employee list and to add, update or remove the timesheet entries Shift App sent. We don't read or change invoices, bank accounts, customers or anything else in QuickBooks, and we don't use QuickBooks data for anything except that organization's own payroll hours.

How we protect it

Everything travels over encrypted connections (HTTPS).
Emergency contacts, certification numbers and copies, and QuickBooks sign-ins are encrypted again before they're stored, with a key kept apart from the database and the backups.
Passwords are stored only as hashes. System admins use two-step sign-in.
Each organization's information is kept separate, and people only see what their role allows.

No system is perfectly secure, but we work to protect your information and will tell affected organizations promptly if something goes wrong.

How long we keep it

We keep information while the organization's account is open, because time cards and pay records are often needed for years. When someone is removed from an organization, their past time cards stay with that organization's records. When an organization closes its account, or asks us to delete it, we delete its information within 30 days. Backups roll off on their own within about 30 days after that. Invoices are kept for tax and accounting records. When you delete your own account, your email, phone number and password are removed right away.

Your choices

You can see and change your own name, email, phone, password, alerts and notification settings in your profile.
You can download a copy of everything Shift App keeps about you from My profile → Download my data, and delete your account from My profile → Delete my account.
You can turn off notifications and location access for Shift App in your iPhone's Settings at any time. If your organization requires GPS to clock in, you won't be able to clock in from the app without it. Ask your admin about other options.
To get a copy of your information, correct it, or have it deleted, ask your organization's admin, or email us at admin@shift-app.net. Some records, like hours you were paid for, may need to be kept by your employer.

Your rights

Depending on where you live (for example the EU, the UK or some US states), you may have the right to see, correct, delete or take a copy of your information, to object to or limit how it's used, and to complain to your data protection authority. Because your organization decides what it records about you, we'll usually pass your request to them and help them answer it. Email admin@shift-app.net and we'll reply within one month.

Children

Shift App is a workplace tool and isn't meant for children under 13. We don't knowingly collect information from them. If you think a child's information is in Shift App, email us and we'll remove it.

Cookies

We use one cookie to keep you signed in, and your browser may remember the emails you've signed in with. We don't use advertising or tracking cookies.

Changes

If we change this policy, we'll update the date at the top. For big changes, we'll let organizations know by email or in the app first.

Contact us

aDude LLC · Tampa, Florida
admin@shift-app.net