Privacy Policy

ShiftTracker ("we," "us," or "our") operates the website at shifttrackerapp.com and the ShiftTracker mobile and web application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using ShiftTracker, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password.
• Profile Information: You may provide information about which gig platforms you use, your vehicle details, your general location (a broad city, state, and country entered during onboarding), and work preferences.
• Shift Data: You manually enter or import shift earnings, hours worked, tips, and platform-specific data.
• Expense Data: You may log fuel costs, maintenance expenses, and other work-related deductions.
• Uploaded Files: You may upload files such as earnings CSV exports from your gig platforms. We store and process these files to power your analytics and reporting features.
• Communications: When you contact us via email or the in-app contact form, we collect the contents of your message and any information you provide.

1.2 Information Collected Automatically

• Mileage & Location: ShiftTracker calculates your business mileage from the odometer readings you enter at the start and end of each shift. The app does not use background GPS and does not capture your precise device location at any point. The only location it asks for is a broad, general location (city, state, and country) that you provide during onboarding; this is used for features such as regional cost-per-mile estimates. See Sections 1.1 and 3.
• Device Information: We collect device type, operating system version, browser type, and unique device identifiers for troubleshooting and analytics.
• Usage Data: We collect information about how you interact with the Service, including pages visited, features used, time spent, and click patterns. See Section 1.3 for exactly what is collected and how it is handled.
• Cookies & Tracking: We use cookies and similar technologies to maintain sessions, remember preferences, and gather analytics. See Section 12 for details.

1.3 Analytics and Session Recording

To understand how ShiftTracker is used and where it can be improved, we collect product analytics covering: screens viewed, features used, onboarding progress, subscription page interactions, and app lifecycle events (such as the app being opened or moved to the background).

Analytics are tied to a pseudonymous account identifier, not to your name or email address. We do not send names or email addresses to our analytics provider.

We record interaction sessions (session replay) — screens, taps, and on-screen content, which may include your earnings data and account details — to diagnose usability problems and improve the app. Session replay runs in our mobile apps only — we do not record sessions on this website. Password fields are never readable in recordings. Recordings are viewable only by ShiftTracker's operator, are retained for approximately 30 days, and are never sold or shared.

Purpose: product improvement and funnel analysis. Legal basis (EEA, UK, and Switzerland): legitimate interest — see Section 8.

Retention: session recordings are retained for approximately 30 days. Other analytics data is retained according to our analytics provider's standard retention period. You may request deletion of the analytics data tied to your account at any time by emailing team@shifttrackerapp.com; deleting your account also triggers this on request. See Section 6.

We do not sell analytics data, and it is not used for third-party advertising.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the ShiftTracker Service
• Generate personalized earnings analytics, shift summaries, and AI-powered insights
• Track mileage and generate IRS-compliant mileage reports
• Send service-related communications (account verification, updates, security alerts)
• Respond to your support requests and feedback
• Detect and prevent fraud, abuse, and security incidents
• Conduct anonymized, aggregated analytics to improve our platform
• Comply with legal obligations

3. AI-Powered Features

Certain features of the Service use artificial intelligence provided by Anthropic's Claude API to generate estimates, summaries, and insights. Depending on which features you use, we send the following information to Anthropic to produce those results:

• Vehicle cost-per-mile estimates: your vehicle details (year, make, model, odometer reading, fuel efficiency, and insurance cost) along with the city or region you provide. To estimate regional prices — such as average fuel costs in your metro area — this feature may also perform web searches.
• In-app assistant: the chat messages you send to our in-app assistant. We also store these messages so you can refer back to your conversations.
• Earnings & shift analysis: your earnings and shift data, used to generate AI-written summaries and analysis of your work.

Under Anthropic's API terms, data sent through the API is not used to train Anthropic's models. AI-generated outputs are estimates and may be inaccurate; you should verify them before relying on them for financial or tax decisions.

4. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

• Service Providers: We share data with trusted third-party vendors who help us operate the Service (hosting, analytics, email delivery). These providers are contractually obligated to protect your data and use it only for the services they provide to us.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or government request.
• Business Transfers: If ShiftTracker is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent: We may share information for other purposes when you give us explicit consent.

5. Data Storage & Security

Your data is stored on secure servers provided by industry-standard cloud infrastructure providers. We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (TLS/SSL) and at rest, access controls, and regular security audits.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to notifying affected users without undue delay, and within 72 hours where required by applicable law, in the event of a data breach.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we permanently remove your personal data from all of our application databases immediately — well within the 30 days described in this policy — except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements).

Anonymized diagnostic and crash logs, which do not identify you, may be retained after account deletion for service-reliability and troubleshooting purposes.

Anonymized, aggregated data that cannot identify you may be retained indefinitely for analytics and product improvement.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data, subject to legal retention requirements.
• Portability: Request a machine-readable copy of your data for transfer to another service.
• Restriction: Request that we limit processing of your data under certain circumstances.
• Objection: Object to the processing of your data for specific purposes.
• Withdrawal of Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at team@shifttrackerapp.com. We will respond to your request within 30 days.

8. GDPR (European Economic Area Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). We process your data based on one or more of the following legal bases:

• Contract Performance: Processing necessary to provide the Service you requested.
• Legitimate Interests: Processing for our legitimate business interests (analytics, security, product improvement), balanced against your rights.
• Consent: Processing based on your explicit consent (marketing emails and other optional features).
• Legal Obligation: Processing required to comply with applicable law.

Your data is processed on infrastructure located in the United States. Where personal data is transferred from the EEA, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to protect that data.

You may lodge a complaint with your local data protection authority if you believe we have violated your rights under the GDPR.

9. CCPA (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete personal information we have collected from you.
• Right to Opt-Out of Sale: We do not sell your personal information. If this ever changes, we will provide a clear opt-out mechanism.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at team@shifttrackerapp.com. We will verify your identity before processing the request.

10. Children's Privacy

ShiftTracker is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at team@shifttrackerapp.com.

11. Third-Party Services

We work with the following third-party service providers to operate the Service. Each processes only the data needed to perform its function and is contractually obligated to protect it:

• Supabase: Authentication and database services. When you create an account, your chosen password is checked against known data-breach databases using a privacy-preserving method — only a partial hash is transmitted, and your password itself never leaves our authentication provider.
• Apple App Store & Google Play: In-app purchase billing for subscriptions bought on mobile devices.
• RevenueCat: Subscription management. RevenueCat receives an account identifier and your purchase and entitlement history to keep your subscription status in sync.
• Stripe: Payment processing for purchases billed directly by us on the web. Stripe handles this payment data directly; we do not store your credit card information. Subscriptions purchased on mobile are billed by Apple or Google, not Stripe.
• Anthropic: AI processing for the features described in Section 3. See that section for exactly what is sent and how it is used.
• Google Places API: Location autocomplete. When you type a location, the text you enter is sent to Google Places to suggest matching places.
• MailerLite: Marketing email delivery. Every marketing email includes an unsubscribe link.
• Expo: Push notifications and over-the-air app updates.
• Vercel: Hosting for our web application.
• PostHog (US cloud hosting): Product analytics and session replay, used to understand how the app is used and improve it. PostHog receives a pseudonymous account identifier together with the usage events described in Section 1.3 — not your name or email address. See PostHog's Privacy Policy.

Our marketing website at shifttrackerapp.com uses website analytics (Vercel Analytics, Google Analytics, and PostHog) to understand aggregate site traffic. PostHog captures page views, clicks, and web vitals on the website. See Google's Privacy Policy and PostHog's Privacy Policy. Google Analytics is used on the website only, not within the ShiftTracker application.

These third-party services have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

12. Cookies

Cookies are used primarily on our marketing website at shifttrackerapp.com. We use the following types:

• Essential Cookies: Required for authentication, session management, and core functionality.
• Analytics Cookies: Help us understand how visitors use our website (via Vercel Analytics, Google Analytics, and PostHog). PostHog records page views, clicks, and web vitals. Google Analytics is used on the website only, not within the ShiftTracker application; the app's in-product analytics are described in Section 1.3.
• Preference Cookies: Store your settings and preferences for a better experience.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the "Last Updated" date. For significant changes, we may also notify you via email or in-app notification.

Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: team@shifttrackerapp.com
• Website: shifttrackerapp.com/contact