Privacy policy

1. In short

Without an account, your schedule stays on your phone. We cannot see it.

Cloud, sharing and syncing your devices are optional and require an account.

No ads, no location tracking, no access to your contacts, SMS, microphone, photos or calendar.

2. What the app keeps on your phone

In local mode (the default), your schedules, shift types, exceptions, confirmed hours and settings are stored on your device only. They are removed when you uninstall the app, or via « Settings > My data > Erase all my data ».

Your exports (JSON backup, .ics calendar file, CSV export) are files you create and share yourself: they do not go through any of our servers.

3. What we process if you turn on the cloud

The cloud is optional. If you sign in (Google account or e-mail address), the following data leaves your phone:

E-mail address, account ID and display name, to sign you in, verify your account and manage sharing. Provider: Google Firebase Authentication.

Your schedules (shifts, shift types, exceptions, rotation rules, confirmed hours), for backup, syncing between your devices and read-only sharing. Provider: Cloudflare (Workers and the D1 database).

Device ID and notification token, used only to signal that an update is available. The message contains no schedule data. Providers: Google Firebase Cloud Messaging and Cloudflare.

Exchanges with our servers are encrypted (HTTPS).

4. Sharing your schedule

You can invite someone by link, code or QR code. Invitations expire after 7 days.

An invited person sees the shared days, shift types and times, read-only. They never receive your confirmed hours, statistics or preferences. They see “Shared by” followed by your name.

As the owner of a shared schedule, you see the name and e-mail address of the people you invite. You can remove access at any time: it is cut right away. A copy that an invited person has already downloaded and keeps offline cannot be erased remotely.

5. The Premium purchase

Premium is a one-time purchase handled by Google Play and RevenueCat (subscriber ID, purchase status). We never receive your payment method or banking identity.

If you turn on the cloud, your account ID is linked to your purchase at RevenueCat, and our server keeps a minimal row (an ID and the Premium level) so that you do not lose your purchase if you sign in again. That row contains no schedule data.

6. Crash reports

When the option is on (it is by default, and you can turn it off in « Settings > Language and about »), Firebase Crashlytics receives anonymous technical reports if the app crashes: device model, Android version, installation ID and the error trace. No schedule data is included. They are kept for 90 days at most.

7. What we do not collect

We do not collect your location, contacts, SMS, photos, files or audio recordings, any health data, or your web activity. The app shows no ads and uses no advertising ID. It does not read your phone's calendar: the .ics export only produces a file that you import yourself.

8. Why we process this data

To provide the service you ask for (account, sync, sharing, Premium purchase), and for our legitimate interest in keeping the app secure and fixing crashes. We do not sell your data and do not use it for advertising.

9. How long we keep it

On your phone: until you uninstall the app or erase the data.

In the cloud: as long as your account exists. Deleting a schedule or the account is immediate in our database; Cloudflare may keep technical database backups for 30 days at most, which are not used to restore a deleted account and are erased automatically.

Crash reports: 90 days at most. Purchase history: kept by Google Play and RevenueCat under their own rules.

10. Your rights and deleting your data

You can access, correct, export (JSON backup) and erase your data, and object to its processing.

From the app: « Settings > Sync and sharing > Delete my cloud account » erases your account, your cloud schedules, shared access, invitations and registered devices. A single schedule can also be deleted, cloud copy included, and « Settings > My data > Erase all my data » erases the data on the device.

Without the app: follow the account deletion page or write to [email protected] from your account's address; we handle your request within 30 days at most.

Files you already exported cannot be erased remotely. Google Play purchases are not automatically refunded. You may contact the data protection authority of your country.

11. Transfers outside the European Union

Google (Firebase), Cloudflare and RevenueCat may process data outside the European Union, in particular in the United States, with the safeguards provided by the GDPR (standard contractual clauses or an equivalent mechanism).

12. Children

The app is not directed to children under 13.

13. Changes

We will post any material change to this policy here, with its update date.