Secure Your Data with Shift Tracker: Gig Worker Guide
The Short Answer
ShiftTracker encrypts all stored data with AES-256 and all data in transit with TLS/SSL — the same standards used by major financial institutions.
The app collects only 4 data types (account info, earnings, mileage, expenses) — each tied directly to a specific product feature, with nothing extra stored.
ShiftTracker has a legally binding no-data-sale policy: your earnings and location data are never sold or traded for advertising.
Users hold full privacy rights — access, correction, deletion, and export — exercisable through in-app settings or a support request.
During tax season, exported files are encrypted on demand and available only to the authenticated account holder, reducing stale data risk.
See your real hourly rate after car costs.
Table of Contents
Data security for gig workers is about keeping your income records, location history, and personal identity out of the wrong hands. This guide breaks down exactly what ShiftTracker collects, how it's encrypted, what your rights are, and what you should do to keep your tax exports safe during filing season.
What Data Does ShiftTracker Actually Collect?
ShiftTracker collects four data types only, nothing more. Each one maps directly to a product feature you use. That's the principle of data minimality, and it matters because a smaller data footprint means a smaller attack surface if anything ever goes wrong.
Data Type | Purpose | Protection |
|---|---|---|
Account info (email, display name) | Account access, communication, recovery | Encrypted; access limited to authorized support roles |
Earnings & shift records | Real-time earnings analytics, tax exports | Encrypted in transit and at rest; export controls enforced |
Mileage / Location logs | Odometer-based mileage tracking and tax reporting | Approximate location only (city and state, no route); encrypted storage; retention limits |
Expenses | Tax categorization and expense tracking | Encrypted backups; restricted staff access with audit trails |
A 2019 Pew Research Center survey found that 79% of U.S. adults are very or somewhat concerned about how companies use the data they collect about them. For gig workers who store financial records in third-party apps, choosing a platform with documented data minimality practices and a clear no-sale policy directly reduces exposure to misuse. (Pew Research Center, "Americans and Privacy: Concerned, Confused and Feeling Lack of Control," 2019)
Source: Pew Research Center
Which Personal and Financial Data Is Stored?
Basic account data (email, display name), shift times, fares, tips, expenses, and earnings summaries. That's it. The app avoids storing unnecessary personal metadata, which keeps your exposure narrow and your data footprint small.
How Does ShiftTracker Handle Location Permissions?
Location access is used only to capture your approximate city and state at shift start and end, not to build a long-term movement history. There's no GPS route tracking and no background location running between those two points — ShiftTracker isn't watching where you go, only where each shift began and ended.
Location is captured only twice per shift: an approximate city and state when you start, and again when you end.
There's no background GPS running between those two points, and no route is recorded.
Your odometer readings, not GPS coordinates, are what calculate your mileage.
Want to understand how mileage tracking connects to your tax deductions? See IRS mileage rules for gig workers in 2026 for the full picture.
Encryption: AES-256 at Rest, TLS/SSL in Transit
Industry-standard encryption is the technical foundation. Here's what that means in plain terms.
Protection Domain | Method | What It Prevents |
|---|---|---|
Data in transit | TLS/SSL | Eavesdropping when your device syncs to servers |
Data at rest | AES-256 | Unauthorized reads if storage were ever accessed |
Backups | Encrypted snapshots + key rotation | Data exposure from backup compromise |
Admin access | RBAC + mandatory MFA + audit logs | Insider access and credential-based breaches |
TLS is the same protocol your bank uses when you log in online. AES-256 is a widely used encryption standard. Both are well-tested, widely audited, and appropriate for financial records.
Role-Based Access and Incident Response
Only specific, authorized roles can view sensitive data. Every privileged action triggers an audit log entry. Multi-factor authentication is mandatory for all admin accounts. And if something goes wrong, a documented incident-response plan covers containment and user notification.
RBAC limits visibility to only the data each role requires.
MFA on all privileged accounts reduces credential-theft risk.
Continuous monitoring flags anomalous behavior for rapid response.
Your Privacy Rights: Access, Correction, Deletion, Portability
You own your data. ShiftTracker doesn't sell it. That's a legally binding commitment, not marketing copy. Here's exactly how to exercise each right.
User Right | How to Exercise | Typical Response |
|---|---|---|
Access | In-app export features or contact support | Provided within policy timelines |
Correction | Edit profile directly or submit a correction request | Changes applied and confirmed |
Deletion | App settings or support channel | Data removed except where legal retention applies |
Portability | Request structured export of earnings and expenses | Delivered in machine-readable formats |
Data sharing is limited to vetted service providers (payment processors, analytics vendors, cloud infrastructure) under contractual restrictions. Third parties receive only what's needed to run the feature in question. No advertising networks. No data brokers.
For a broader look at how tracking apps handle your information, compare options in our best shift tracking apps for gig workers in 2026 roundup.
Regulatory Alignment: GDPR, CCPA, and NIST
ShiftTracker's practices align with the core principles of major privacy frameworks (data minimization, user rights, and breach notification standards) even where specific certifications aren't listed.
GDPR principles: data minimization, portability, right to erasure.
CCPA-type rights: access, deletion, opt-out, supported through in-app controls.
NIST Cybersecurity Framework: informs logging, monitoring, and incident response.
Worth noting: alignment with a framework is different from certification. If specific compliance certifications matter to you (SOC 2, ISO 27001), contact ShiftTracker support directly for current status.
Location Data: What's Stored, How Long, and Who Can See It
Location data gets the most scrutiny from gig workers, and rightly so. Here's the full breakdown of how it's handled.
Location Data Component | Purpose | Protection |
|---|---|---|
Approximate location at shift start | Fills in the start city and state on your mileage log | Minimized to city/state only; encrypted at rest |
Approximate location at shift end | Fills in the end city and state on your mileage log | Minimized to city/state only; encrypted at rest |
Odometer readings | Calculates your business miles for tax records | Encrypted; retained with your shift records |
Exported mileage reports | Tax exports and reimbursement claims | Encrypted; user-controlled downloads |
Because there's no background GPS running, there's nothing extra to disable for privacy: the only location captured is the approximate city and state at shift start and end, and it's captured only in that moment. In-app pause toggles let you stop collection during non-work periods without losing existing records.
Tax Season Security: Protecting Exports and Earnings Records
Tax exports are the highest-risk moment for gig worker data. You're generating files that contain your full earnings history, and you're often sharing them with accountants via email or portals. Here's how to keep that process tight.
Enable device encryption and use a strong passcode before downloading any exports.
Transfer files to accountants via secure portals or encrypted email, not SMS or standard email attachments.
Keep local backups encrypted and delete exported files after your accountant has confirmed receipt.
ShiftTracker generates exports on demand, applies encryption during download, and keeps them available for a limited window only, which reduces the risk of stale files sitting in a public folder.
The IRS says to keep tax records for 3 years in most situations, and for 6 years if you do not report income that you should report and it is more than 25% of the gross income shown on your return. (IRS, How long should I keep records?)
Source: IRS (Internal Revenue Service)
Best Practices for Freelancers Handling Financial Data
Enable MFA on every account that touches financial data.
Use a password manager: unique credentials for every service.
Review app permissions quarterly; revoke anything you're not actively using.
Share exports only through secure, verified channels.
For tracking the mileage that feeds those exports in the first place, see our guide on how to track mileage for gig and delivery drivers. And if you want to understand which deductions you're eligible for, top tax deductions for gig workers covers vehicle, home office, and tech write-offs in detail.
Frequently Asked Questions
Does ShiftTracker sell my earnings data to advertisers?
No. ShiftTracker's privacy policy contains an explicit no-data-sale commitment. Your earnings, mileage, and location data are never sold, traded, or shared with advertising networks. Third-party sharing is limited to service providers operating under contractual restrictions for specific product functions only.
What encryption standards protect my data?
ShiftTracker uses TLS/SSL for all data in transit (the same protocol used by financial institutions) and AES-256 for all data at rest. Role-based access control and mandatory MFA govern who can access stored records internally.
How do I delete my account and all associated data?
Submit a deletion request through in-app settings or the support channel. A verification step prevents unauthorized requests. Most personal data is removed promptly; some records may be retained for legal or compliance reasons, which the privacy policy specifies. You'll receive confirmation when deletion is complete.
Is ShiftTracker compliant with GDPR and CCPA?
ShiftTracker's practices align with GDPR and CCPA principles: data minimization, user rights (access, correction, deletion, portability), and breach notification standards. Users in applicable jurisdictions can exercise these rights through in-app controls or support requests. For specific certification status, contact support directly.
How should I handle tax exports securely?
Download exports only over a secure, private connection. Enable device encryption beforehand. Transfer to your accountant via a password-protected portal or encrypted email, not unencrypted attachments. Delete local copies after your accountant confirms receipt. ShiftTracker exports are encrypted and available for a limited window to reduce stale-data risk.
Founder of ShiftTracker. Lime LP for almost 4 years · 42,000+ tasks completed. Background in financial trading and behavioral optimization.