Privacy Policy

Last updated: September 24, 2026

This Privacy Policy explains what data the Shiftly app collects, how it is stored, how it is protected, and how it is used.

Account & sign-in

You can use Shiftly signed out (data stays only on your device) or signed in, either with Google or with an email and password. Signing in with email requires confirming your address before your data can sync, to prevent abuse. When you sign in with Google, the app uses Firebase Authentication to identify your account; we store your display name, email address, and profile photo URL for the profile UI.

Where your data is stored

Signed-out data (or before your first sign-in) is kept only in your browser's local storage. Once you sign in, your shifts, hourly rate, currency, and other settings are stored in Google Firestore (a Google Cloud database) under an account tied to your user ID, so they sync across your devices. Firestore rules restrict this data to your own account — no other user can read or write it.

Calendar access

Calendar access is requested only when you enable calendar sync, and only the two narrowest Google Calendar permissions needed for the feature are requested:

• calendar.events.owned — lets Shiftly create, update, and delete the events that represent your shifts in the calendar you selected. Shiftly only manages the shift events it creates.
• calendar.calendarlist.readonly — lets Shiftly read the list of your calendars (names, ids, and write access) so you can choose which calendar your shifts sync to. Shiftly does not read the events inside your calendars.

This connection is handled entirely by our server (Firebase Cloud Functions) — your Google Calendar refresh token is encrypted at rest and never sent to or readable by the client app. Calendar access is optional and used only for this event-syncing feature; you can disconnect it at any time in Settings → Integrations, which revokes the token with Google and deletes it from our systems.

How we protect your data

• Encryption in transit. All traffic between the app, our servers, and Google services uses TLS (HTTPS). The app is never served over an unencrypted connection.
• Encryption at rest. All data stored in Google Firestore is encrypted at rest by Google Cloud. Google Calendar refresh tokens are additionally encrypted at the application level with AES-256-GCM before being stored; the encryption key is kept in Google Secret Manager and is never present in code, in the database, or on the client.
• Access control. Firestore security rules restrict every user's data to that user's authenticated account. Calendar tokens are stored in a server-only collection that no client can read or write — only our Cloud Functions can access them, solely to perform the calendar sync you enabled.
• Least privilege. We request only the minimum Google permissions required for the features you turn on, and calendar permissions are not requested at all until you enable calendar sync.
• Retention and deletion. Disconnecting a calendar account revokes its token with Google and deletes it from our systems. Deleting your account removes your shifts, settings, calendar connections, and sign-in record immediately and irreversibly.
• Incident response. If we become aware of a breach affecting your personal data, we will notify affected users by email without undue delay.

Google user data & Limited Use

Shiftly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data (your calendar list and the shift events Shiftly manages) is used only to provide the calendar-sync feature you enabled. We do not sell it, do not share it with third parties, do not use it for advertising, and do not use it to develop or train generalized artificial intelligence or machine-learning models.

Third-party services

The app uses Firebase (Authentication, Firestore, Cloud Functions), Google APIs (Sign-In, Calendar) and Cloudflare (hosting and cookie-free web analytics). Your data is transmitted to these services only for authentication, the sync features and the usage statistics described in this policy. We do not sell your data or use it for advertising.

Usage statistics

To learn which of our pages and links actually help people, Shiftly counts a few anonymous events: a visit to the website, a click into the app or a store, an app session, and the first shift saved on a device. Each count records only the channel that brought the visit (for example a search engine, a Telegram link or a campaign tag in the link), the landing page, the language and the platform. It carries no account ID, no device ID, no IP address and no cookie, so it cannot be linked to you.

So that a later sign-up can be credited to the link that brought you, the app remembers that channel on your device, in local storage, for up to 90 days. When you create an account, this channel, the landing page and the date you first arrived are saved once with your account. They are used only to understand which channels work, are visible only to the Shiftly team, and are deleted together with your account.

The website also uses Cloudflare Web Analytics, which measures page views and page performance without cookies and without storing anything on your device.

Exporting and deleting your data

You can export a full backup of your data (JSON) or a spreadsheet of a given year (Excel) at any time from Settings → Export data. You can permanently delete your account from Settings → Danger zone → Delete account: this removes your shifts, settings, calendar connections, and sign-in record from our systems immediately and cannot be undone.

Contact

Questions about this policy or your data can be sent to shiftlyteam.app@gmail.com.

If you do not accept this policy, please do not use the app or enable Google sign-in/sync.