Privacy Policy

Shiftera is a shift-planning app (web, Android and iOS) built by Reego Software. This policy explains what data we collect, why, and your rights. Questions: support@shiftera.io.

Demo mode

When you use "Try the demo", your data stays on your device and is never sent to us.

Data we collect

• Account: your name, email address, a one-way hash of your password (argon2id; we never store the password itself) and your language. With Google sign-in we receive your name, email address and Google account ID from Google.

• Workspace data: the teams, people (name, optional email, role), time off, plans, rules, schedules and shift swap requests a team admin enters.

• Technical data: session records (a hash of the session token, browser/device information, dates), IP addresses kept briefly to prevent abuse, and an audit log that holds IDs only.

• Payments: Premium is bought through Paddle on the web, or through Google Play or the App Store in the apps; RevenueCat manages the store subscriptions. We never see your card details, only the subscription's status (product, store, expiry date).

• Usage data (only if you allow it): the app asks the first time you open it. If you choose "Allow", the screens you open and actions such as generating or releasing a schedule or downloading a PDF are sent to PostHog (EU) with your account ID, role and subscription tier. Your name, email and team data are never sent. Turn it off any time in Settings → Preferences → Usage data.

• Visits to the web app and web dashboard (until you decline): app.shiftera.io and the web dashboard count visits with Google Analytics from your first visit, as shiftera.io does: the pages and screens you open and actions such as generating or releasing a schedule, with your role and subscription tier (never your account ID, name, email or team data). Choose "No thanks" or "Decline" in the notice shown on your first visit, or Not allowed under Preferences → Usage data, and nothing more is sent to Google and its cookies are deleted.

• Notifications: in-app notifications (swap requests, released plans, reminders) are stored with your account and deleted after 90 days. If you allow notifications on your phone, its push token is stored and the notification text, including names and shift details, goes through Expo to Google (Firebase Cloud Messaging) or Apple (APNs). Turn it off in Settings → Preferences; signing out removes the token.

• Feedback and help requests: what you write under your picture → General → About & feedback or Help and support is stored with your name, email, app version and the workspace you were in (its name, your role and its plan). Help requests are also emailed to our support inbox so we can answer you. Deleting your account deletes your help requests and removes your name and email from your feedback.

• Friend invitations: when you invite friends from Invite friends, we store the email addresses you enter and send each one email with your name and your invite link. When someone signs up with your link or an address you invited, you see their first name and initial (or the address you entered) and whether they have joined, which earns you free Premium. Deleting your account deletes your invitations; when an invited person deletes theirs, their name and address leave your list (we keep only a one-way hash of the address, so it can't be counted twice).

We use no advertising tools, and we don't sell your data.

How we use it

• To create your account, keep you signed in and sync your data across devices,
• To send verification, password reset, team and friend invitation emails,
• To manage your subscription,
• To protect the service against abuse,
• If you allowed it, to see how the app is used and improve it.

Team data

When a team admin adds people to a team, they are responsible for that data, and we process it on their behalf. If you are on a team as staff, ask the team admin, or write to us, to have your entry changed or removed.

Service providers

• Vercel (hosting, Frankfurt / EU),
• MongoDB Atlas (database),
• Resend (email delivery),
• Expo, Google Firebase Cloud Messaging and the Apple Push Notification service (phone notifications, only if you allow them),
• PostHog (usage data, EU; only if you allow it),
• Google Analytics (visits to the web app and web dashboard, until you decline),
• Paddle (payments on the web),
• Google Play, the App Store and RevenueCat (in-app subscriptions),
• Google (only if you choose Google sign-in).

Cookies

The web app uses a single, strictly necessary HttpOnly cookie to keep you signed in. The mobile app keeps this on the device. If you allow usage data, PostHog keeps a random ID on the device. In the web app and web dashboard, Google Analytics sets its cookies (_ga, _ga_ID) until you decline it.

This website

shiftera.io measures visits with Google Analytics 4 unless you decline it in the cookie notice shown on your first visit. If you decline, measurement stops: no visit data is sent to Google and no analytics cookies are set. IP addresses are anonymised. You can change your choice at any time with the Cookie settings link at the bottom of every page. Google Analytics is provided by Google Ireland Limited. Full details: Cookie Policy.

Retention and deletion

We keep your data while your account exists. You can delete your account at any time in the app under Settings → Danger zone → Delete account. Your account, your sessions and the workspaces only you own are deleted right away, and leave our backups as those expire. Details: Account deletion.

Your rights

Under the GDPR and Turkey's KVKK you can access, correct, delete and export your data, and object to its processing. Write to support@shiftera.io; we answer within 30 days.

Children

Shiftera is a work tool and isn't meant for anyone under 16.

Changes

If we change this policy we update the effective date and announce important changes in the app.