Privacy policy

The short version

ShiftSwap stores the minimum it needs to schedule shifts: your name, your email address, the facility you belong to, the shifts you work, and which certifications you hold. It does not sell data, does not run advertising, and does not track you across other sites. The only cookie it sets is the one that keeps you signed in.

Who is responsible

ShiftSwap operates ShiftSwap and is the data controller for the information described here. Questions and requests go to eroth29@icloud.com.

What is collected

• Account details. Your name and email address. Email is used to sign you in (by emailed link — there are no passwords) and to send you notifications.
• Facility membership. Which facility you belong to and whether you are a manager or staff there.
• Schedule data. Shifts assigned to you, shifts you have released, shifts you have claimed, and the decisions your manager made about them.
• Certifications. Which of your facility's certifications you hold and when they expire. Entered by your manager.
• Roster entries about people without accounts. A manager can add a person to the schedule by name before that person has ever signed in. That name, and any shifts booked against it, exist in the system until the person accepts an invitation and takes the profile over, or the manager removes it.
• Technical logs. Standard server logs (IP address, browser type, time of request) kept by the hosting provider for security and debugging.

What is not collected

No payment details, no location tracking, no contacts from your phone, no advertising identifiers. Page-view analytics, where enabled, are aggregate and cookieless — they count visits, not visitors.

Why it is used

• To show you your schedule and let you release, claim, and cover shifts.
• To check that whoever picks up a shift holds the certification it requires.
• To notify you — by email — when a shift you could cover opens up, when your claim is approved or declined, and when someone has covered a shift you released.
• To keep the service secure and working.

The legal basis, where one is required, is performance of the arrangement between you and your facility for account and schedule data, and legitimate interest for security logs.

Who can see it

Your manager can see everything above for everyone in the facility. Other staff at your facility can see your name on shifts that are open for coverage, and on shifts they share with you. They cannot see your email address, your certifications, or your full schedule. These limits are enforced by the database itself, not just the interface.

Data is processed by these providers on our behalf:

• Supabase — database, authentication, and sign-in emails.
• Resend — delivery of notification and invitation emails.
• Vercel — hosting and, where enabled, cookieless analytics.

Each is bound by its own privacy terms and receives only what it needs to do its job. Nobody else gets your data unless the law requires it.

Cookies

One cookie, set when you sign in, keeps you signed in. It is strictly necessary for the service to function and expires when your session does. There are no advertising, tracking, or third-party cookies. Your browser's local storage is used only to remember that you have dismissed the cookie notice.

How long it is kept

For as long as you have an account at a facility. When a manager deactivates you, your upcoming shifts are released and your pending claims withdrawn, but your name stays on shifts you already worked — that is the facility's attendance record. When a facility is closed down, its data is deleted. Server logs are kept for a short, fixed period by the hosting provider and then discarded.

Your rights

You can ask to see the data held about you, have it corrected, or have it deleted. Depending on where you live you may have further rights, including to object to processing or to take your data elsewhere. Email eroth29@icloud.com; requests are answered within 30 days. Deleting your account removes your name and email, but shifts you worked remain on the facility's record with your name replaced.

Children

ShiftSwap is a workplace tool. It is not directed at children under 16, and accounts should be created only for people employed or engaged by the facility.

Changes

If this policy changes in a way that matters, you will see a notice when you next sign in. The effective date at the top always reflects the current version.