Shifts Privacy Policy

1. Scope and who is responsible

This policy applies to the Shifts app for Android and iOS. Shifts lets staff of businesses that use the Shifts service see their rota, request time off, record clock events and keep their details up to date. Craft Innkeeper LTD provides the app and the Shifts service.

Your employer (the business that added you to Shifts) decides what workplace information is held about you, such as your shifts, pay rates and leave, and is responsible for those employment records. We process that information on their behalf to run the service. For questions or privacy requests, email admin@craft-innkeeper.co.uk with the subject “Shifts privacy”, or use the Shifts support form.

2. Signing in

There is no public sign-up. You sign in to an existing staff profile that your employer created, with your email address and password or with Google. When you choose Google, Google confirms your name and email address to us so we can match you to your existing profile; we do not receive your Google password. Google handles that step under Google's Privacy Policy.

Each signed-in device is recorded as a session (device name and last-used time) so that you can see and sign out your other devices from the app.

3. Information the app shows and sends

The app exchanges the following with the Shifts service over an encrypted connection, only for the businesses and sites you belong to:

• your rota, shift details, shift confirmations and day notes for your sites;
• estimated pay for your own shifts, shown separately for each employer (these are estimates, not payslips);
• time-off requests, comments, balances and decisions;
• availability, shift swap, offer and pick-up requests;
• clock-in and clock-out events, with the time on your device and the site;
• your contact details and emergency contact, when you view or edit your profile;
• your skills and qualifications, with their expiry dates and evidence notes;
• your notification list and notification preferences;
• if you are a manager, the rota, requests and approvals for the sites you have permission to manage.

Managers at your employer can see your information according to the permissions they hold for each site. We do not use it for any other purpose.

4. Location

Shifts asks for approximate location only, and only at the moment you tap a clock action at a site that requires it. That location is sent with that one clock event so your employer can confirm you were on site. The app does not track your location in the background or at any other time. You can refuse or withdraw location permission in your device settings; clock events at sites that require location may then not be accepted.

5. Calendar

If you choose to add a shift to your device calendar, Shifts writes that event to your calendar and reads your calendar only to avoid creating duplicates. Your calendar is not uploaded to us. Calendar access is requested only when you first use this option and can be withdrawn in your device settings.

You can also create a calendar subscription link for your own shifts, or, with permission, a site's team rota. Anyone who has that link can see the shifts it contains, so keep it private. You can reset the link (the old one stops working) or turn it off in the app at any time.

6. Information stored on your device

To work with a poor or no connection, the app keeps a copy of your recent information on your device and queues any changes you make until they can be sent. Your sign-in tokens are kept in the Android Keystore or the iOS Keychain. Android app backup is turned off for Shifts. Signing out removes your sign-in tokens from the device; deleting the app removes its stored data.

7. Notifications

The app shows notifications held for you on the Shifts service, such as published shift changes and request decisions, and lets you choose which ones you receive. The current version does not send push notifications. If that changes, we will update this policy and ask for your permission on your device first.

8. No advertising, analytics or tracking

Shifts has no advertising, analytics, tracking or third-party data collection SDK. We do not sell, rent or share your information with advertisers, data brokers or analytics providers. Your information is shared only with your employer as described above, with Google for Google sign-in if you choose it, and with the hosting provider that runs the Shifts service on our behalf.

9. Google Play and the Apple App Store

Google and Apple handle app distribution and updates under their own policies and may process account, device and download information to do so. We receive only the information they make available to developers, such as download totals and crash reports you agree to share with them. See Google's Privacy Policy and Apple's Privacy Policy.

10. Retention, security and deletion

Workplace records such as shifts, clock events, pay and leave are kept for as long as your employer needs them and as the law requires (for example payroll and working-time records). Ask your employer first about those records; you can also contact us and we will pass your request to them or act on it where we are responsible. Sign-in sessions you revoke stop working immediately.

All traffic uses HTTPS; unencrypted connections are disabled in the app. Sign-in uses short-lived, rotating tokens stored in the device's secure storage. Access to the service is restricted to authorised people at your employer according to their site permissions, and to authorised personnel at Craft Innkeeper LTD who run the service.

11. Contacting us and your rights

If you contact us, we receive the details you include so we can respond. Please do not send passwords, bank details or other people's personal information. Support correspondence is kept only as long as needed to resolve your enquiry and meet any legal obligations.

You can ask for access to, correction or deletion of your personal information, or raise a privacy concern. Where applicable you may also object to processing, request restriction or portability, and complain to the UK Information Commissioner's Office or your local data protection authority. You can correct your own contact and emergency details directly in the app.

12. Children and policy changes

Shifts is a workplace tool for people employed or engaged by businesses that use it. It is not directed at children, and we do not knowingly collect information from children outside that workplace use.

We will publish any changes to this policy on this page and update the date above. If the app's data practices change, we will also update the store disclosures and ask for any permission or consent required before introducing the change.

Shifts support · About the Shifts app