Privacy Policy

1. Who we are

ShiftKal (“the app”, “we”, “us”) is provided by Xboost, the data controller for the limited personal data described below.

• Controller: Xboost (based in Vietnam)
• Contact: andrew@xboostapp.io

This policy explains what data ShiftKal handles, why, and the choices you have. It applies to the ShiftKal iOS app and this website, and is written for users in the EU/EEA (GDPR) and North America.

2. Data that stays on your device

ShiftKal is local-first. Your schedule lives on your iPhone, and the following are stored only on your device — we do not receive them, store them on our servers, log them, or share them with our analytics or advertising-measurement providers:

• Your shifts, shift templates, and rotations
• Shift titles, notes, and locations
• Colleague or display names you enter
• The rota photos you take and the CSV files you import
• Your alarms, wake-up times, and sleep settings
• Your prep, commute, and buffer times

Because this data never leaves your device, deleting the app removes it. We recommend keeping a device backup if you want to preserve it. (When you choose to scan a photo, the image alone is sent to an AI service purely to read the shifts and is then deleted — see section 6. It is never sent to any advertising or analytics provider.)

3. Data we process

To provide account-free entitlements, billing, product improvement, and to measure our advertising, a small amount of data is processed by us and our service providers. None of it identifies you by name or email.

Anonymous app identifier

To keep track of your subscription, scan allowance, and settings without an account, the app uses an app-generated, anonymous identifier (a random Supabase account UUID). It is not linked to your name, email, or Apple ID. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

Purchases and subscriptions

When you subscribe or buy a scan pack, purchase status is processed through Apple and our subscription provider (RevenueCat) so we can unlock and restore features. Apple handles your payment; we never see your card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Anonymous product analytics

To understand how the app is used and fix problems, we collect non-identifying usage events (for example, “a rota was scanned” or “an alarm was created”) through PostHog, an EU-hosted analytics provider. This in-app analytics is separate from our advertising measurement — the events are not sent to our attribution provider. We never log the content of your rota, images, files, or personal shift details. Analytics are on by default and you can switch them off any time in Settings. Legal basis: your consent / our legitimate interest in improving the app (Art. 6(1)(a)/(f) GDPR).

Feedback you send us

If you send feedback from within the app, we receive the message you wrote so we can respond and improve. Please don’t include sensitive personal data in feedback.

4. Advertising, attribution & App Tracking Transparency

Like most apps, we run ads to reach new shift workers. To learn which campaign led you to install ShiftKal — and nothing more — we use AppsFlyer as our mobile measurement partner.

What AppsFlyer processes

• AppsFlyer ID — an anonymous install identifier the SDK generates on your device. Always used. It is not your name or email.
• Advertising Identifier (IDFA) — collected only if you tap “Allow” on Apple’s App Tracking Transparency (ATT) prompt. If you decline, no IDFA is collected.
• Apple SKAdNetwork — Apple’s privacy-preserving, aggregate way of measuring installs without the IDFA. When you decline ATT, we rely on this plus probabilistic modelling instead.
• Attribution & deep-link data — non-identifying campaign, ad, and click information used to match your install to an ad, and general device/network signals AppsFlyer needs to do so.
• A pseudonymous user identifier — your anonymous Supabase account UUID, passed to AppsFlyer as the “customer user ID”. This is a random identifier, not your real name, email, or other personal details.

What we never send to AppsFlyer: your rota content, photos, imported CSV files, shift titles, notes, names, email, or any other personal data. None of that ever reaches AppsFlyer’s servers or logs.

Linking install to purchase

So we can tell whether an ad campaign actually led to a subscription, the AppsFlyer ID is shared with RevenueCat, which joins your (anonymous) purchase revenue to the install on a server-to-server basis. This lets us measure return on ad spend using only anonymous identifiers — no personal purchase details are exposed.

The App Tracking Transparency prompt

ShiftKal shows Apple’s ATT prompt once, after the onboarding “value moment” and before the paywall. You can decline and the app still works normally — only the IDFA is withheld. Whatever you choose, you can change your mind at any time in iOS Settings → Privacy & Security → Tracking (or under Settings → ShiftKal), where you can turn tracking off to withdraw consent or on to grant it.

Legal bases (GDPR): collection of the IDFA and any cross-app tracking relies on your consent(Art. 6(1)(a) GDPR), given through the ATT prompt. The anonymous AppsFlyer ID, SKAdNetwork measurement, and non-identifying attribution data are processed on the basis of our legitimate interest in understanding and improving the effectiveness of our advertising (Art. 6(1)(f) GDPR). You can object to processing based on legitimate interest at any time (see section 9).

5. What we never collect

• Your name, email address, phone number, or postal address
• Your precise or approximate location
• Health or fitness data (sleep suggestions are calculated on your device)
• Your contacts
• The content of your rota, photos, or imported files — for advertising or analytics

6. Rota scanning and AI

When you scan a rota, the image or the text you provide is sent to a third-party AI provider solely to read your shifts. We have taken the following measures:

• A data-processing agreement is in place with the provider (OpenAI).
• The endpoint is configured for zero retention — the image/text is used to parse your shifts and then deleted, and is not used to train models.
• No identifying account information is attached to the request, and nothing is sent to our advertising or analytics providers.
• We do not store the rota image ourselves; the parsed result is returned to your device for you to review.

You are always shown the parsed shifts and must confirm them before anything is scheduled. If you prefer not to use AI scanning, you can enter shifts manually — no image or text leaves your device in that case.

7. Third-party services

We use a small number of trusted providers to run the app. Each has a distinct role and processes data only on our instructions (or, where they act as an independent controller, under their own policy linked below):

8. Where your data is processed

Our analytics and backend (PostHog and Supabase) are hosted in the European Union. Some providers — including AppsFlyer, RevenueCat, Apple, and OpenAI — process data outside the EU, mainly in the United States. Where that happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

9. How long we keep data

On-device data remains until you delete it or remove the app. Anonymous account and entitlement records are kept while your installation is active and for as long as needed to honour purchases. Attribution data held by AppsFlyer is retained for the limited period needed to measure and validate a campaign, in line with AppsFlyer’s own retention practices. Rota images sent for scanning are not retained after parsing.

10. Your rights

Under the GDPR and similar North American laws you may have the right to access, correct, delete, or restrict processing of your personal data, to object to processing based on legitimate interest (including advertising attribution), to data portability, and to withdraw consent at any time. Because we hold only anonymous data tied to your installation, we may ask for the app’s identifier (shown in Settings) to locate your records.

Withdrawing tracking consent: you can turn off ad tracking at any time in iOS Settings → Privacy & Security → Tracking (or Settings → ShiftKal). This stops any further use of your IDFA. You can turn off in-app analytics in the app’s own Settings.

To make a request — including deleting the data associated with your installation — email andrew@xboostapp.io or see the Support page. You also have the right to complain to your local data protection authority.

11. Children

ShiftKal is intended for adults in the workforce and is not directed at children. We do not knowingly collect data from children under 16.

12. Permissions

The app asks for Camera and Photo Library access only to read a rota you choose to scan, for Notification/alarm permission so alarms can fire, and — through Apple’s ATT prompt — for optional permission to use your advertising identifier for attribution. You can change all of these any time in the iOS Settings app.

13. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date.

14. Contact

Questions about privacy? Email andrew@xboostapp.io.