Privacy Policy

When a business signs up, that business decides what employee information goes into ShiftAnchor and how it is used. The business is the data controller; ShiftAnchor is the data processor acting on its instructions.

If you are an employee and want your information corrected or removed, contact your employer first — they administer the account. We will help them action it.

Account details. Name, email address, and a hashed password. Passwords are stored using bcrypt and cannot be read by us or recovered — only reset.

Employment details entered by your employer. Job role, permission level, pay rate, payroll ID, phone number, hire date, and whether the account is active.

Scheduling and time records. Shifts, clock-in and clock-out times, timesheets and sign-offs, availability, time-off requests and any reason you type into them, shift-swap requests, and pay adjustments.

Time zone. Your device's time zone, read from your browser settings, so punches record the correct local time. This is a setting, not a location — it identifies a zone such as "America/Vancouver", not where you are.

Location when you clock in, if your employer turns it on. A business can choose to check that staff are at work when they clock in. If yours has, your phone shares its location once, at the moment you clock in. We compare it with your workplace and keep only the result: that you were at work, how far away you were, or that no location was shared, along with how precise your phone said it was. The location itself is not stored. If you decline, you can still clock in, and your employer sees that no location was shared.

Billing. For paying account owners, subscription status and plan. Card details are entered directly with Stripe and are never sent to or stored on our servers.

Notifications. If you turn on notifications, the address or token your browser or phone gives us for delivering them, with a short description of the device. Turning them off deletes it. Which kinds of notification you have switched off is saved with your account.

Calendar link. If you add your shifts to your phone's calendar, we create a private web link to your own shifts. Your calendar app reads it without signing in, so anyone you give the link to can read those shifts too. You can turn it off or replace it at any time, and resetting a forgotten password turns it off.

Schedule background. An owner can choose to upload one picture to show behind the schedule. It is stored with the organisation's settings and shown only to its staff.

Deletion requests. If you ask us to delete your account, we keep a record of the request (your name, email address, organisation and role, what you asked us to delete, and when you asked and when it was done) so we can show it was carried out.

• No location tracking. Location is read only at the moment you clock in, and only if your employer has turned on the check described above. It is never read in the background or at any other time, and where you were is never stored.
• No advertising or tracking. There are no analytics scripts, no advertising SDKs, no third-party cookies, and no cross-site tracking.
• No contacts or microphone. The app does not read your photos or use the camera on its own. The only picture it stores is a schedule background an owner chooses to upload.
• No selling of data. We do not sell or rent personal information to anyone, for any purpose.

Only to run the service: showing schedules, recording hours, producing timesheets and pay statements, sending account emails such as invitations and password resets, and billing account owners. We do not use employee data to train models or build profiles.

ShiftAnchor uses no AI. The in-app help assistant ("Marina") looks like a chatbot but is not one: it is a fixed list of questions and answers with a keyword matcher, running entirely in your browser. It sends nothing to any AI service, makes no network calls, and cannot see your schedule, hours or pay.

Nothing you type into it leaves your device, and no part of the product sends your data to a language model or uses it for training.

Inside your organisation, visibility depends on the role your employer assigns. Managers and owners can see schedules, hours and pay information for their staff; employees see their own.

Outside your organisation, we use a small number of providers:

• Vercel — hosting and content delivery.
• Neon — encrypted database hosting.
• Stripe — subscription billing and card processing.
• Google — email delivery. Invitations, verification, password-reset and billing-renewal messages are sent through a Google-hosted mailbox, so Google processes the recipient's address and the contents of those messages.

If your employer connects a payroll provider such as ADP or Workday, hours and pay data are exported to that provider at their direction.

We may also disclose information where legally required, or to protect the safety and rights of users.

Traffic is encrypted in transit with HTTPS and the database is encrypted at rest. Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies. Password-reset links are single-use and expire. Access within an organisation is enforced by role on every request, not just hidden in the interface.

No system is perfectly secure, and we cannot guarantee absolute security.

Account and time records are retained while the organisation's account is active, since employers generally have legal obligations to keep payroll records for several years. When an account is closed, we delete or anonymise the data unless we are required to retain it.

The record of a deletion request, which includes your name and email address, is kept for 7 years after the request is done, then deleted. It is used only to show the deletion was carried out.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to withdraw consent. Employees should raise these with their employer, who administers the account; account owners can contact us directly.

How to delete your account and data — what is erased, what is kept as a payroll record, and how long it takes.

ShiftAnchor is a workplace tool and is not directed at children. We do not knowingly collect information from anyone under 16 except where an employer enters details for a lawfully employed young worker.

If this policy changes materially we will update the date above and notify account owners by email.

Questions about this policy or a privacy request: email shift.anchor.support@gmail.com or call 778 858 3885.