Overview

This policy explains exactly what data ShiftFlow collects from you, why we collect it, how long we keep it, and what happens when you delete it. We believe transparency is non-negotiable when an app touches your payroll and financial records.

ShiftFlow is designed on a data minimisation principle: we collect only what is necessary to deliver the features you use, and nothing more.

What We Collect

Account Information

Email address (required for account creation and recovery)
Display name
Password hash (bcrypt — we never store your plaintext password)
Apple ID or Google ID if you use Sign In with Apple / Google
Timezone and currency preference
Country code (two-letter ISO code, used for tax and payroll rules)

Shift & Payroll Data

Shift start and end times
Break durations
Employer / job name, hourly rate, overtime configuration
Tips, mileage, and expense entries
Tags and shift notes
Calculated gross pay, net pay, and overtime hours (server-computed — we never trust client-side calculations for financial figures)
Pay schedule (frequency, anchor date, next payday)

Financial Calculations

Tax rate (user-configured)
Tax profile (filing status, deductions — optional)
Invoice data (client name, line items, amounts, due dates)
Paycheck anomaly detection results

Device & Session Data

Device token for push notifications (APNs) — deleted when you log out
Device name and OS version (for the Security Centre session list)
IP address hash (hashed, not stored in plaintext — used for suspicious login detection)
JWT access tokens (short-lived, 1 hour) and refresh tokens (30 days, httpOnly cookie)

Analytics & Crash Data

Feature-usage events via PostHog, linked to your account ID (e.g. “shift_logged”, “paywall_viewed”)
Crash reports and performance traces via Sentry (device model, OS version, stack trace — no PII)
Session counts and retention metrics (aggregate only)

Subscription Data

Subscription status, plan, and expiry date (synced from RevenueCat)
RevenueCat customer ID
Trial start and end dates
We never store credit card numbers, CVVs, or bank account details — all billing is handled exclusively by Apple in-app purchase

AI & Wellbeing Data

Energy scores and mood entries (logged per shift — optional)
Stress scores (1–10, optional)
AI Memory Profile: preferred shift patterns, financial goals, burnout triggers, income priorities — stored server-side and used only to personalise your AI recommendations
Work journal entries (text, optional)

What Is Optional

The following data is never required to use ShiftFlow's core features:

Energy scores, mood, and stress entries per shift
Work journal entries
AI Memory (can be disabled in Profile → AI Settings → AI Memory)
Location data for automatic clock-in (requires explicit permission, can be revoked at any time in iOS Settings)
Push notifications (can be declined or disabled in iOS Settings)
Analytics participation (linked to your account — cannot be opted out of individually, but contains no PII)
Tax profile details beyond your basic tax rate
Invoice client details

AI Memory Behaviour

ShiftFlow's AI assistant maintains an optional memory profile that stores preferences and patterns to personalise responses. This memory:

Is stored in our database under your user ID and encrypted at rest by our database provider
Is used only to improve AI recommendations within your account — it is never used to train models or shared with any third party
Can be cleared at any time: Profile → AI Settings → Delete AI History
Can be disabled entirely: Profile → AI Settings → Disable AI Memory
Is deleted permanently on account deletion (no grace period)

To generate insights and answer your questions, ShiftFlow sends the relevant financial context — such as your earnings totals, hourly and tax rates, paycheck amounts, employer names, and the messages you send in AI chat — to our AI provider, DeepSeek, for processing. This information is sent to produce your requested insight or reply and is subject to DeepSeek's privacy terms. ShiftFlow does not store your AI conversations on our servers; only a short-lived cache of generated results (cleared within 24 hours) and anonymous token-usage counts are kept. You can clear or disable your AI Memory at any time in the app.

AI Training Usage

ShiftFlow does not train any AI models on your data.ShiftFlow builds no first-party models; AI features call the DeepSeek API in inference-only mode. We do not use your data to train models and we do not sell it. Whether the AI provider retains or trains on API inputs is governed by that provider's own terms, which we encourage you to review.

Third-Party Providers

Provider	Purpose	Data Shared
RevenueCat	Subscription management	User ID, subscription events — no payment card data
Apple App Store	In-app purchase billing	Handled entirely by Apple — we receive only a receipt and subscription status
PostHog	Product analytics	Event names and properties linked to your account ID — no payroll figures or document content
Sentry	Crash monitoring	Stack traces, device model, OS version — no user data, no payroll data
DeepSeek	AI insights & chat	Financial context for your request — earnings, rates, paycheck amounts, employer names, and your chat messages
Railway / Cloudflare	Cloud hosting and CDN	Encrypted data at rest — providers cannot read your financial records

Retention Periods

Data Type	Retention Period
Active account data (shifts, invoices, payroll)	Kept until account deletion
Soft-deleted shifts and invoices	30-day grace period, then hard-deleted
Account data after deletion request	30-day grace period for recovery, then hard-deleted
AI Memory Profile	Deleted immediately on account deletion or manual clear
Audit logs (admin-only)	90 days
Push notification tokens	Deleted on logout or account deletion
Analytics events (PostHog)	Linked to your account ID (via PostHog)
Crash reports (Sentry)	90 days per Sentry's default policy
OCR-processed paystub files	Not stored server-side — processed and discarded immediately

Deletion Behaviour

When you delete your account (Profile → Settings → Delete Account), ShiftFlow initiates a full deletion sequence:

Your account is immediately soft-deleted — you cannot log in, and your data is no longer accessible
You have a 30-day window to contact support and recover your account
After 30 days, a scheduled job hard-deletes all records associated with your account: shifts, invoices, payroll records, journals, AI memory, goals, device tokens, notification preferences, and analytics identifiers
AI Memory is deleted immediately — no grace period
Analytics events already sent to PostHog are retained under PostHog’s own retention policy
RevenueCat retains your subscription history for their own legal compliance requirements

To request account deletion directly: shiftflowx.net/delete or email support@shiftflowx.net.

Your Rights

Depending on your jurisdiction, you may have the right to:

Access — request a copy of all data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your account and all associated data
Portability — export your shifts and earnings as CSV or JSON
Restriction — request that we stop processing your data while a complaint is investigated
Objection — object to any processing based on legitimate interests
Withdraw consent — disable AI Memory, revoke notification permissions, or delete your AI chat history at any time

GDPR users (EEA/UK): You may lodge a complaint with your local supervisory authority.

CCPA users (California): We do not sell personal information. You have the right to know, delete, and opt-out of sale (not applicable — we do not sell).

To exercise any of these rights, contact info@shiftflowx.net.

Contact

For questions about this policy, data requests, or privacy concerns:

Email: info@shiftflowx.net
Support: shiftflowx.net/support

We aim to respond to all data requests within 30 days.

Data Collection Policy