Privacy policy
ShiftTally handles your pay records, so this policy is written to be read, not skimmed past. It says exactly what we collect, why, who else touches it, what we do with it, and how to get rid of it.
The short version
- Your documents and pay data are private to your account. Other users cannot see them.
- We do not sell your data to data brokers, hand it to advertisers, or show you ads.
- We use the documents you upload to teach ShiftTally to read documents better and predict pay better. That work runs on what is on the page, not on who you are.
- We measure how the app gets used by adding up data we already store on our own servers. There is no third-party analytics software in the app, and any provider we add later is named on this page before it goes live.
- You can delete your account and everything in it from inside the app, at any time, without asking us.
- If the company is ever sold, your account moves with it. We tell you before that happens.
What we collect, and why
| Data | Why we have it |
|---|---|
| Your email address | To create your account and sign you in. You can sign in with an email and password, or with Google. |
| Photos and PDFs you upload | Clockout slips, tip deposits, and pay stubs. This is the core of the product. We read the numbers off them, keep the original so you have a record, and use them to improve how ShiftTally reads documents. |
| Your pay data | Tips, sales, hours, wages, tip-outs, and pay amounts, either typed by you or extracted from the documents you photographed. This is what the app verifies and reports on. |
| Your corrections | When the app reads a number wrong and you fix it, we keep the fix. It is how the reader stops making that mistake. |
| Your settings | Your tip-out rate, your employer name if you enter one, and your preferences. |
| How you use the app | Which features get used, how often an import succeeds, how much of a pay period gets verified. We work this out on our own servers, by counting records that are already in your account, not by putting tracking software in the app. It tells us what is worth building and what is broken. |
| Crash and error reports | When the phone app crashes or hits an error, it sends a report to Sentry, listed in the table below. A report holds what the app was doing at the time (the error, the stack trace, and the screens visited just before), your device model, your OS version, and the app version. It does not hold your email address, your account, your pay amounts, or anything read off a document: the app strips those before the report leaves your phone. Without this we are guessing at why the app failed on a phone we do not have. |
| Your subscription status | Whether you are on Free or Pro, and when the current period ends. Google Play processes the payment. We never see your card. |
| A Google Calendar token optional |
Only if you choose to connect Google Calendar. You connect it from either app, and after that both apps use it to read your scheduled shifts. Disconnecting removes the token here and revokes it at Google. |
| Your scheduled shifts only if you connect a calendar |
Matching events become draft shifts, and we keep the event's title, its start time, and its date so the draft can stay in step when you move it. Nothing else from your calendar is read or kept, and nothing about your tips or pay is ever sent to Google. |
What we do not collect
No location. No advertising identifier. No device fingerprint. No contact list. Nothing about what you do in other apps or on other websites.
The usage data above is ours and stays inside ShiftTally. It is not an advertising profile, it is not sold, and no ad network receives it. There is no advertising software in the app.
What we do with your documents
Two things, and they are different.
We read them for you. That is the product. A clockout slip goes in, the sales, tips, and hours come out, and the original stays in your account as the record behind the number.
We use them to make the reading better. ShiftTally has to work on a POS slip it has never seen, printed by a machine we have never touched. The only way that happens is by learning from real documents. So we use the documents you upload, the text read off them, the values that came out, and the corrections you make when a value is wrong, to develop and improve ShiftTally's document-recognition and prediction models. The same goes for your shift and pay history as numbers: it is what teaches a forecast to look like a real Friday.
Here is what protects you in that work.
- It runs on the page, not on the person. The models learn layouts, wording, and where a number sits on a slip. They are not trained to recognize you, and no model is built to associate a document with a person.
- Your identity is not part of the training material. Your email address and your account are not fed into it.
- A pay stub has your name printed on it, and we will not pretend otherwise. We do not repaint the pixels of your documents. What was on the paper is in the image. That image stays inside our own systems, under the same access controls as the rest of your account, reachable only by the people who do this work.
- Nothing about you gets published. We do not release examples, model outputs, or documentation that identify a person or reproduce your documents. Averages shown to other ShiftTally users are covered in the next section, and they never identify you.
- The models are ours and stay ours. We do not sell your documents, and we do not licence them to another company as a data set.
- De-identified means de-identified. When we strip data of what connects it to you, we commit to never re-identifying it, and we require the same of anyone who processes it for us.
There is no opt-out from this work, and we would rather say that plainly than hide it in a setting. It is part of the exchange: most of ShiftTally is free, and the free tier exists because the documents people upload teach the app to serve everyone better. If that exchange is not acceptable to you, the honest advice is not to use ShiftTally.
What other ShiftTally users can see
Nothing today. When earnings comparisons ship, here is the shape they will have, and this section is the promise that bounds them.
Pro users will be able to see aggregate earnings statistics: what servers make at a restaurant, in an area, or in a category of restaurant. Your shifts contribute to those averages. The protections are structural, not policy:
- Never fewer than five. No figure is shown unless at least five people contributed to it. Below that, the restaurant shows nothing, and your numbers roll up only into wider area and category averages.
- Ranges, not exact figures. Comparisons show bands like "$140 to $180 a shift", never a precise average someone could do arithmetic against.
- Updated on a delay, not live. Figures recompute on a schedule, so nobody can watch an average move when one person joins or leaves and work out what that person makes.
- Paused when a group changes. When someone joins or leaves a group, its figure pauses until the next scheduled recompute.
These aggregates never include your name, your account, or any number traceable to a single person, and they exist only inside ShiftTally.
Deleting your account deletes your documents and everything derived from them that is still tied to you. A model that already learned from a document does not contain that document, and training that already happened cannot be run backwards. Models and aggregate statistics built before you left stay built.
Who else processes your data
We use a small number of service providers to run ShiftTally. They process data on our behalf, under contract, and are not permitted to use it for their own purposes.
| Provider | What it sees |
|---|---|
| Supabase | Hosts our database, file storage, and authentication. Your documents and pay records live here. |
| Vercel | Serves the web app and this website. Like any web host it sees the address your browser connects from and the pages it asks for, in short-lived request logs. Your documents and pay data do not pass through it; the web app talks to Supabase directly. |
| Google Cloud Vision | When you import a document, the image is sent to Google's Vision service, which returns the text it reads. This is how ShiftTally gets the numbers off a photo without you typing them. Google returns the text and is not authorized to retain the image or use it for anything else. |
| Google Play | Handles your Pro subscription: the purchase, the renewal, the cancellation, and the money. Google tells us whether your subscription is active. Your card details never reach us. |
| Sentry | Receives crash and error reports from the phone app: the error, what the app was doing, your device model, your OS version, and the app version. Reports are stripped of your email address, your pay amounts, and anything read off a document before they are sent. Sentry is not authorized to use them for anything but showing them to us. |
| Google Sign-In optional |
If you sign in with Google, Google handles that sign-in. It does not receive your slips, tips, or pay data. |
| Google Calendar optional |
You connect it from either app. Once connected, both apps read your calendar events to find scheduled shifts. We do not write to your calendar or send it your pay data. |
That is the whole list as of the date at the top of this page. If we add a service provider that touches your documents, your pay data, or your usage, including a crash reporter or an analytics provider, it gets added to this table before it goes live.
How your data is protected
- Private to you. Every row and every file is locked to your account at the database level. Another signed-in user cannot read your data even if they try.
- Encrypted in transit. All traffic between the app and our servers runs over HTTPS.
- Encrypted at rest. Our hosting provider encrypts stored data and stored files.
- Private file storage. Your document images are not public. They are served to you through short-lived signed links.
No system is perfect, and we will not pretend otherwise. If we ever discover a breach affecting your data, we will tell you.
How long we keep it
We keep your data for as long as your account exists, because the whole point is a record that lasts. When you delete your account, we delete it. See Delete your account or data for exactly what goes and how fast.
An abandoned account does not live forever. If you have not signed in for 36 months, we delete the account and everything in it, the same as if you had pressed the button yourself. You will hear from us first: emails at 30, 34, and 35 months, each with a one-tap way to keep the account, and signing in at any point resets the clock. Three years is deliberate. It is long enough that leaving the industry and coming back at tax time still works, and short enough that we are not warehousing documents nobody will ever return for.
Three things outlast deletion. Routine backups, taken for disaster recovery and rotated out within 30 days. They exist to restore the whole service after a failure. We do not open them to look up one person, and we do not use them to bring deleted data back. Models and aggregate statistics that were built before you left, which hold no copy of your documents and no longer point back at you. And, if we have made one, a de-identified copy of a document: a version with your name and every detail that identifies you blacked out of the image itself. A copy like that is no longer about you, it is about how a slip is laid out, and it may stay in our training material after your account is gone. Where no such copy exists, the document is simply gone.
If the company is sold
ShiftTally is a business. If it is merged, acquired, or if its assets are sold or transferred, including in bankruptcy or as part of winding the company down, your account and its data transfer with the rest of the business. There is no version of that sale where the app changes hands and the accounts stay behind.
The buyer receives your data under this policy and stays bound by it until they publish a policy of their own. We will tell you in the app and by email before your data moves, and if you would rather not go, delete your account first. That option stays open right up to the transfer.
One thing is not a sale: moving ShiftTally into a company Eduardo forms and owns, such as an LLC. That changes the name at the top of this page and nothing else. This policy keeps applying and your account is untouched.
Your choices
- Delete. Settings has a Delete Account button that erases everything. No support ticket, no waiting.
- Correct. Shifts, documents, and the values you entered can be edited or deleted in the app.
- Get a copy. Email us and we will send you your data. We will not charge you or make it difficult.
If you are in California
The CCPA gives you the right to know what personal information we collect and why, to get a copy of it, to correct it, to delete it, to opt out of the sale or sharing of it, and to not be treated worse for exercising any of that. The sections above answer the first four. Delete Account in the app handles deletion in ten seconds.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, which is the specific thing the CCPA means by "share". No ad network, data broker, or advertiser receives your documents or your pay data.
Two clarifications so this paragraph stays true as the business grows. First, we use your documents to develop our own models, which the CCPA treats as our own business purpose and not a sale. Second, if the company is sold, your data transfers as part of that transaction, which the CCPA treats as part of the deal rather than as a sale, and which is described in full in the section above.
Your documents may contain information California classifies as sensitive, because pay stubs are printed that way. We use it to run the service and to improve how ShiftTally reads documents, and for nothing else. We do not use it to infer characteristics about you, and we do not disclose it for advertising.
To exercise any right, email support@getshifttally.com from the address on your account. We answer within 45 days and usually the same week.
Children and age
ShiftTally is for working adults. You must be 18 or older to have an account. The Terms of Service make that a hard requirement, and this policy is written on the same footing.
We do not knowingly collect data from anyone under 18, and we do not knowingly collect data from children under 13. If you believe someone under 18 has created an account, email us and we will close it and delete its data.
Where your data lives
ShiftTally is offered in the United States and your data is stored in the United States. If you use it from somewhere else, that is where the data is going.
Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. If the change is significant, we will tell you in the app before it takes effect.
Contact
Email support@getshifttally.com. A person reads it. That address is also how you reach us about anything in this policy, including a legal notice, and it is the fastest way to get an answer.