Privacy Policy

1. Who we are

ShiftKal (“the app”, “we”, “us”) is provided by Xboost, the data controller for the limited personal data described below.

• Controller: Xboost (based in Vietnam)
• Contact: andrew@xboostapp.io

This policy explains what data ShiftKal handles, why, and the choices you have. It applies to the ShiftKal iOS app and this website, and is written for users in the EU/EEA (GDPR) and North America.

2. Your schedule: on your device, or synced

Your schedule includes your shifts, shift templates, rotations, workplaces (jobs), shift titles, notes and locations, pay settings (pay rates, premiums and overtime rules — financial information), personal events, and your app settings (such as language, theme, and display name). Where it lives depends on whether you sign in:

If you don’t sign in

Your schedule is stored only on your iPhone. We do not receive it, store it on our servers, or log it. Deleting the app removes it, so we recommend a device backup if you want to keep it.

If you sign in with Apple

Your schedule is stored on our servers in the EU (Supabase) and synced to every device where you sign in with the same Apple Account, so it comes back after you reinstall the app or move to a new phone. It is protected by access rules that let only your account read or change it (plus the people you choose to share with — see section 4), and it travels over an encrypted connection. It is not end-to-end encrypted: our infrastructure stores it in readable form so it can sync and apply your sharing rules. We never use it for advertising and never send it to our analytics or advertising-measurement providers. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

To let your other devices know something changed, the app also updates a single timestamp in your private iCloud database (Apple CloudKit). It contains no schedule data.

Always on your device only

• Your scheduled alarms and reminder notifications
• The rota photos you take and the files you import (see section 8)

Your iPhone calendar

If you connect your iPhone calendar, ShiftKal can add your shifts to a calendar on your device (which may sync through your own iCloud or calendar account) and show events from calendars you pick. Events you choose to show become part of your schedule in ShiftKal, so if you are signed in they sync like the rest of your schedule. You can disconnect at any time in Settings.

3. Sign in with Apple

Signing in is optional and only needed for sync and sharing. When you sign in, Apple shares with us a stable, app-specific user identifier and — the first time only — the name you allow. We do not request your email address. Your name is used as your display name, shown to people you share with (or, if you join someone else’s calendar, to its owner).

Sign out keeps your schedule on the phone and pauses syncing. Delete account (Settings → Apple Account) permanently erases your account and all its data from our servers — schedule, shares and viewer access, settings, feedback, and scan allowance — removes your Apple sign-in from our system, and wipes the data on that device. Delete account does not cancel an App Store subscription; manage that in your Apple Account settings.

4. Sharing your schedule

If you are signed in, you can create a share link (a short code such as rota.xboostapp.io/s/K7Q2M9X) and send it to people you choose. To view it, they install ShiftKal and sign in with Apple, so you always see who has access. What they can see is enforced on our servers:

• They get a read-only view of the jobs and date range you pick.
• Never shared: notes, pay and earnings data, absence or sick status, and any shift you mark as hidden.
• Your workplace (its name and address) is shared only if you turn it on; personal events only if you choose to include them.
• You can change these settings per person, remove anyone, or close the link at any time; removed people lose access immediately.

When you share, your display name is shown to people who open the link (including on our website’s invite page), and viewers’ display names are shown to you. To notify viewers of changes and owners of new viewers, we store a push-notification token for each signed-in device and send notifications through Apple’s push service. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR). Please share only with people you trust, and only schedule information you are entitled to share.

5. Data we process

Beyond your schedule (sections 2–4), a small amount of data is processed by us and our service providers to provide entitlements, billing, product improvement, and to measure our advertising. None of it identifies you by email.

Anonymous app identifier

To keep track of your subscription and scan allowance, the app uses an app-generated identifier (a random Supabase account UUID), created automatically on first launch even if you never sign in. If you sign in with Apple, this same identifier becomes your account. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

Purchases and subscriptions

When you subscribe or buy a scan pack, purchase status is processed through Apple and our subscription provider (RevenueCat) so we can unlock and restore features. Apple handles your payment; we never see your card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Product analytics

To understand how the app is used and fix problems, we collect usage events (for example, “a rota was scanned” or “an alarm was created”) through PostHog, an EU-hosted analytics provider. Events are tied to your pseudonymous account identifier (the random UUID described above), never to your name or email, so they are linked to your account. This in-app analytics is separate from our advertising measurement — the events are not sent to our attribution provider. We never log the content of your rota, images, files, or personal shift details. Legal basis: our legitimate interest in understanding and improving the app (Art. 6(1)(f) GDPR). You can object at any time by emailing us (see section 12) and we will stop analytics for your installation.

Feedback you send us

If you send feedback from within the app, we receive the message you wrote so we can respond and improve. Please don’t include sensitive personal data in feedback.

6. Advertising, attribution & App Tracking Transparency

Like most apps, we run ads to reach new shift workers. To learn which campaign led you to install ShiftKal — and nothing more — we use AppsFlyer as our mobile measurement partner.

What AppsFlyer processes

• AppsFlyer ID — an anonymous install identifier the SDK generates on your device. Always used. It is not your name or email.
• Advertising Identifier (IDFA) — collected only if you tap “Allow” on Apple’s App Tracking Transparency (ATT) prompt. If you decline, no IDFA is collected.
• Apple SKAdNetwork — Apple’s privacy-preserving, aggregate way of measuring installs without the IDFA. When you decline ATT, we rely on this plus probabilistic modelling instead.
• Attribution & deep-link data — non-identifying campaign, ad, and click information used to match your install to an ad, and general device/network signals AppsFlyer needs to do so.
• A pseudonymous user identifier — your anonymous Supabase account UUID, passed to AppsFlyer as the “customer user ID”. This is a random identifier, not your real name, email, or other personal details.

What we never send to AppsFlyer: your rota content, photos, imported CSV files, shift titles, notes, names, email, or any other personal data. None of that ever reaches AppsFlyer’s servers or logs.

Linking install to purchase

So we can tell whether an ad campaign actually led to a subscription, the AppsFlyer ID is shared with RevenueCat, which joins your (anonymous) purchase revenue to the install on a server-to-server basis. This lets us measure return on ad spend using only anonymous identifiers — no personal purchase details are exposed.

The App Tracking Transparency prompt

ShiftKal shows Apple’s ATT prompt once, after the onboarding “value moment” and before the paywall. You can decline and the app still works normally — only the IDFA is withheld. Whatever you choose, you can change your mind at any time in iOS Settings → Privacy & Security → Tracking (or under Settings → ShiftKal), where you can turn tracking off to withdraw consent or on to grant it.

Legal bases (GDPR): collection of the IDFA and any cross-app tracking relies on your consent(Art. 6(1)(a) GDPR), given through the ATT prompt. The anonymous AppsFlyer ID, SKAdNetwork measurement, and non-identifying attribution data are processed on the basis of our legitimate interest in understanding and improving the effectiveness of our advertising (Art. 6(1)(f) GDPR). You can object to processing based on legitimate interest at any time (see section 12).

7. What we never collect

• Your email address, phone number, or postal address
• Your name — unless you sign in with Apple and allow it, as your display name
• Your precise or approximate location
• Health or fitness data (sleep suggestions are calculated on your device)
• Your contacts
• The content of your schedule, photos, or imported files — for advertising or analytics

8. Rota scanning and AI

When you scan a rota, the image or the text you provide is sent to a third-party AI provider solely to read your shifts. We have taken the following measures:

• A data-processing agreement is in place with the provider (OpenAI).
• The endpoint is configured for zero retention — the image/text is used to parse your shifts and then deleted, and is not used to train models.
• No identifying account information is attached to the request, and nothing is sent to our advertising or analytics providers.
• We do not store the rota image ourselves; the parsed result is returned to your device for you to review.

You are always shown the parsed shifts and must confirm them before anything is scheduled. If you prefer not to use AI scanning, you can enter shifts manually — no image or text leaves your device in that case.

9. Third-party services

We use a small number of trusted providers to run the app. Each has a distinct role and processes data only on our instructions (or, where they act as an independent controller, under their own policy linked below):

10. Where your data is processed

Our analytics and backend (PostHog and Supabase) are hosted in the European Union. Some providers — including AppsFlyer, RevenueCat, Apple, and OpenAI — process data outside the EU, mainly in the United States. Where that happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

11. How long we keep data

On-device data remains until you delete it or remove the app. Removing the app does not delete data synced to your account — use Delete account in Settings for that. Synced schedule and account records are kept while your account exists and are erased when you delete it. Records tied to an installation that never signed in are kept as long as needed to honour purchases. Attribution data held by AppsFlyer is retained for the limited period needed to measure and validate a campaign, in line with AppsFlyer’s own retention practices. Rota images sent for scanning are not retained after parsing.

12. Your rights

Under the GDPR and similar North American laws you may have the right to access, correct, delete, or restrict processing of your personal data, to object to processing based on legitimate interest (including advertising attribution), to data portability, and to withdraw consent at any time. If you are signed in, you can delete your account and all its data yourself in Settings → Apple Account. For other requests, sending them from the app (Settings → Feedback) lets us match them to your records.

Withdrawing tracking consent: you can turn off ad tracking at any time in iOS Settings → Privacy & Security → Tracking (or Settings → ShiftKal). This stops any further use of your IDFA. To object to in-app analytics, tell us from the app (Settings → Feedback) or by email.

To make any other request — including deleting data for an installation that never signed in — email andrew@xboostapp.io or see the Support page. You also have the right to complain to your local data protection authority.

13. Children

ShiftKal is intended for adults in the workforce and is not directed at children. We do not knowingly collect data from children under 16.

14. Permissions

The app asks for Camera and Photo Library access only to read a rota you choose to scan, for Notification/alarm permission so alarms and sharing updates can reach you, for Calendar access only if you connect your iPhone calendar, and — through Apple’s ATT prompt — for optional permission to use your advertising identifier for attribution. You can change all of these any time in the iOS Settings app.

15. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date.

16. Contact

Questions about privacy? Email andrew@xboostapp.io.