Privacy Policy

1. The short version

• We collect only what we need to run your account: your email, your account and billing status, and your text-alert details (when SMS reminders launch). When you're signed in, your schedules and plans are saved to your account so they follow you across devices — a working copy also stays in your browser on your device.
• We do not sell your personal information, and we don't share your sleep or health-related data for advertising.
• You can download or delete your data at any time by emailing hello@myshiftsync.com.
• ShiftSync is a planning tool. It is not medical advice and does not assess fitness for duty.

2. Information we collect

Information you give us:

• Account info: your email address and sign-in details. You sign in with an email and password or with a one-time email link we send you. Passwords are hashed and stored by our auth provider (Supabase) — we never see or store your plain-text password.
• Profile and work setup: your role (for example nurse, physician, EMS, flight medical, fire, police, pharmacy, warehouse) when you give it to us — for example when you join the email list. Your shift pattern is saved with your account when you're signed in (see Schedules, below).
• Schedules: the shift dates and times, days off, and calendar entries you create are saved to your account when you're signed in — stored with our database provider (Supabase) — so your plan follows you from device to device. A working copy is also kept in your browser on your device. One exception: if you ask us to email tonight's plan, we receive that night's shift and plan times to compose and send the email. We don't store those times in our database; the message is delivered through our email provider (Resend) like any other email.
• Sleep and fatigue inputs: sleep times, naps, caffeine intake, how alert you feel, and similar entries you choose to log are saved with your account when you're signed in, with a working copy kept in your browser on your device.
• Support messages: anything you send us.
• Payment info: subscriptions are handled by Stripe, our payment processor. We get confirmation of your plan and payment status. We don't store your full card number.

Information from connected services

Some of these are future features. We only collect this data if you turn the feature on.

• Apple Watch / Apple Health (coming soon): if you turn it on, we may read sleep, heart rate, and activity data that you allow in Apple Health permissions. We will only use this data to provide and improve your sleep planning features. We will not use it for advertising or sell it, and we will follow Apple's HealthKit rules. You can turn off access at any time in your device settings.
• Calendars: calendar export (.ics) creates a file you control. If we later add calendar sync, we'll only access the calendars you choose.
• SMS reminders (coming soon): if you sign up, we'll collect your phone number to send reminders. Message and data rates may apply. Reply STOP to opt out.

Collected automatically

• Device and browser type, IP address, pages viewed, rough location based on your IP, and diagnostic and crash logs.
• Cookies and similar tools that keep you signed in, remember your settings, and help us understand how the site is used. See section 7.
• Marketing links may include UTM tags (for example utm_source) that tell us where you found us.

3. How we use your information

• To provide ShiftSync: building rest windows, tonight's timeline, fatigue scores, 72-hour charts, the circadian clock, and reminders.
• To sign you in and keep your account secure.
• To process subscriptions, free trials, renewals, and refunds.
• To send service emails, such as sign-in links, receipts, trial-ending notices, and important changes. Product updates and marketing emails are optional, and you can unsubscribe at any time.
• To fix bugs, prevent abuse, and improve the product, using aggregated or de-identified data where we can.
• To meet legal obligations.
• We do not use your sleep, fatigue, or health-related data to target ads, and we don't sell it.

4. How we share information

We share information only:

• With service providers that help us run ShiftSync. They must protect your data and may only use it to provide services to us: Stripe (payments), Resend (email delivery), Supabase (database), and Vercel (hosting).
• When you tell us to, for example when you export a calendar.
• For legal reasons: to follow the law, respond to valid legal requests, or protect the rights, safety, and property of our users, ourselves, or others.
• In a business transfer, such as a merger or acquisition. Any new owner must keep honoring this policy, and we'll notify you.
• We don't share your data with your employer. ShiftSync is not an employer tool, and your employer can't see your data.

5. Your choices and rights

• Access, correct, download, or delete your data: email hello@myshiftsync.com. We'll reply within 45 days.
• Disconnect integrations, such as Apple Health or calendars, at any time.
• Unsubscribe from marketing emails using the link in any email.
• Depending on where you live (for example California, Washington, Colorado, Virginia, Connecticut, and other states), you may have more rights. These can include the right to know what we collect, to withdraw consent for health data, to opt out of “sale” or “sharing” (we don't do either), and to appeal a decision we make about your request. To appeal, email hello@myshiftsync.com with “Privacy Appeal” in the subject line.
• We won't treat you differently for using your privacy rights.

6. Data retention

We keep your data while your account is active. If you delete your account, we delete or de-identify your personal data within 30 days. Backups may take up to 90 days to clear. Some records, such as billing records, may be kept longer if the law requires it.

7. Cookies and analytics

We use essential cookies to keep you signed in. We do not currently use third-party analytics. If we add analytics in the future, we will update this section. You can block cookies in your browser, but parts of the service may stop working.

8. Security

We use reasonable safeguards, including encryption in transit (HTTPS), access controls, and encryption at rest through our database provider. Sign-in links expire after 60 minutes and can only be used once. No system is perfectly secure. If a breach affects your data, we'll notify you as the law requires.

9. Not HIPAA-covered; not medical advice

ShiftSync is a consumer app. It is not a healthcare provider, and we don't act on behalf of your hospital, agency, or employer. Because of that, HIPAA generally doesn't apply to us, but we still treat your sleep and fatigue data as sensitive. Please don't enter patient information into ShiftSync.

10. Children

ShiftSync is for adults 18 and older. We don't knowingly collect data from children under 13 (or under 16 where state law sets a higher age). If you think a child has given us data, contact hello@myshiftsync.com.

11. Where data is stored

We store data in the United States. If you use ShiftSync from outside the US, your data will be transferred to and processed in the US.

12. Changes to this policy

If we make material changes, we'll email you or post a notice in the app before the changes take effect. The “Effective date” at the top shows when this policy was last updated.

13. Contact

ShiftSync (operated by Symone Gates), Texas · hello@myshiftsync.com