ShiftPay
← ShiftPay

ShiftPay Privacy Policy

Last updated: June 6, 2026

This Privacy Policy explains how ShiftPay ("ShiftPay", "we", "us", or "our") collects, uses, stores, and protects personal data when you use the ShiftPay mobile application and related services.

1. What ShiftPay Is

ShiftPay helps hourly workers track shifts, employers, pay rates, advances, expected salary, reports, and reminders. ShiftPay is not a bank, employer, accountant, payroll provider, legal adviser, or tax adviser. Calculations in the app are informational and depend on the data you enter.

2. Data We Collect

We collect only the data needed to operate the app, maintain your account, sync your information, and support the service.

Account Data

  • email address;
  • name or display name, if you add one;
  • account identifier;
  • sign-in data through email/password or Google OAuth;
  • profile avatar, if you add one.

We do not store your password in plain text. Authentication is handled through Supabase Auth.

Data You Enter in ShiftPay

  • employers or workplaces you create in the app;
  • hourly rates, currency, breaks, and pay multipliers for night, weekend, holiday, or overtime shifts;
  • shift dates, start times, and end times;
  • shift notes, if you add them;
  • advance payments, amounts, dates, and notes;
  • shift templates;
  • language, currency, reminder, and app settings;
  • data needed to create salary PDF reports.

Subscription and Purchase Data

If you purchase or restore Premium access, we may receive subscription status information from RevenueCat, Apple App Store, or Google Play, such as product ID, status, expiration date, cancellation date, or grace period. We do not receive your full payment card details.

Technical Data

We may process:

  • device type, operating system, app version, and app environment;
  • technical API logs;
  • minimal data needed for app updates through Expo.

The current mobile app does not use a third-party product analytics SDK or a third-party crash-reporting SDK. Apple, Google, hosting providers, and app stores may independently process technical information under their own policies.

Camera, Photo, and Notification Data

ShiftPay requests camera or photo access only if you choose to add or change your profile avatar. ShiftPay requests notification permission if you enable reminders for shifts or paydays. Current reminders are scheduled on your device.

We do not collect precise location, contacts, browser history, microphone data, SMS data, or health data.

3. How We Use Data

We use data to:

  • create and protect your account;
  • sync your shifts, employers, advances, rates, and settings;
  • calculate expected salary, hours, bonuses, and reports;
  • show reminders for upcoming shifts or payday;
  • provide salary PDF reports;
  • verify Premium subscription status;
  • respond to support requests;
  • find and fix bugs;
  • protect the service from abuse and unauthorized access;
  • comply with legal obligations where applicable.

We do not sell personal data. We do not use ShiftPay data for third-party behavioral advertising.

4. Legal Bases for Processing

If GDPR or similar data protection laws apply to you, we process personal data on the following legal bases:

  • performance of a contract: to provide the core ShiftPay service;
  • consent: for optional permissions such as camera, photos, and notifications;
  • legitimate interests: for security, abuse prevention, technical support, and service stability;
  • legal obligations: when we must retain or disclose certain data under applicable law.

5. Sharing Data

We share data only with providers needed to operate ShiftPay or when required by law.

Service Providers

  • Supabase: authentication, database, avatar storage, and sessions.
  • Render or another API hosting provider: operation of the ShiftPay backend.
  • RevenueCat: subscription and purchase entitlement management.
  • Apple App Store and Google Play: purchase and subscription processing.
  • Expo / EAS: mobile app updates and technical infrastructure.
  • Google OAuth: Google sign-in, if you choose to use it.

These providers may process data in countries other than your country of residence. We use them for limited purposes related to app operation, security, subscriptions, and support.

Legal Requirements

We may disclose data if necessary to comply with law, a court order, a government request, protect user rights, protect service security, or investigate fraud.

6. Data Retention

We retain account data and the data you enter into ShiftPay while your account is active or while the data is needed to provide the service. If you delete records in the app, they are deleted or archived according to the app's functionality.

After an account deletion request, we will delete or anonymize personal data unless we need to retain it for security, legal, or accounting obligations. Backups may remain for a limited period until they are automatically overwritten.

Local data on your device, including cache, app settings, notification settings, and local reminders, may remain on the device until you sign out, clear app data, or uninstall the app.

7. Your Rights and Choices

Depending on where you live, you may have the right to:

  • access your personal data;
  • correct inaccurate data;
  • export part of your data from the app;
  • request deletion of your account and personal data;
  • restrict or object to certain processing;
  • withdraw consent where processing is based on consent;
  • file a complaint with a data protection authority.

To exercise your rights, contact us at support@shiftpay.app. We may ask you to verify your identity to protect your account.

If you are in the European Economic Area, you may also lodge a complaint with your local supervisory authority. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

8. Data Export and Account Deletion

ShiftPay provides a salary PDF report for a selected month. This report is not a complete export of all personal data. To request access to a complete copy of your data or deletion of your account and associated data, email support@shiftpay.app from the email address connected to your ShiftPay account. We may ask you to verify your identity before completing the request.

Account deletion requests are normally completed within 30 days. Data that must be retained for legal, security, fraud-prevention, or accounting purposes may be kept only for the required period. Deleting a ShiftPay account does not automatically cancel an Apple App Store or Google Play subscription.

Deleting your account may permanently remove access to your shift history, employers, advances, reports, and settings.

9. Security

We use technical and organizational measures to protect data, including:

  • authentication through a secure provider;
  • data transfer over HTTPS;
  • limited access to server systems;
  • limiting sensitive data in technical logs;
  • user data separation at the API and database level;
  • dependency updates and vulnerability fixes.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. International Data Transfers

Your data may be processed in countries other than your country of residence, including by providers of infrastructure, authentication, and subscriptions. Where GDPR or similar rules apply, we rely on appropriate legal mechanisms for international data transfers.

11. Children

ShiftPay is not intended for children under 15. Users under 15 may use ShiftPay only with authorization from a parent or legal guardian where required by applicable law. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps.

12. Third-Party Links

ShiftPay may contain links to third-party services, app stores, or provider pages. We do not control their privacy practices. We recommend reviewing the privacy policies of those services.

13. Changes to This Policy

We may update this Privacy Policy when ShiftPay features, providers, legal requirements, or data practices change. The updated version will be posted with a new date. If changes are material, we may notify you in the app or by another available method.

14. Contact

If you have questions about this Privacy Policy or how personal data is processed, contact us:

Data controller: Vitalij Beca

Country: Czech Republic

Email: support@shiftpay.app