shift-spring-legal

Shift Spring Privacy Policy

Last updated: 1 September 2026

1. Who We Are

Shift Spring is provided by Taskara Systems Limited, a company registered in England and Wales.

• Company number: 16879355
• Registered address: 259 Wallasey Village, Wallasey, Wirral, England, CH45 3LR
• Contact email: shiftspring.contact@taskarasystems.com

We are the data controller for the personal data processed through the Shift Spring mobile application.

2. What This Policy Covers

This privacy policy explains how we collect, use, store, and protect your personal data when you use the Shift Spring mobile application (package name: com.shiftspring.app), available on the Google Play Store.

3. What Data We Collect

3.1 Data You Provide Directly

• Email address (optional — only if you sign in via email)
• Display name (optional)
• Profile photo (optional — if you choose one from your device’s photo library)
• Employer name (optional)
• Shift types and schedules — your rota patterns, shift definitions, and any daily overrides including actual start and end times
• Pay information — hourly rate, pay frequency, enhancement rules, overtime rules, and manual pay adjustments (such as bonuses, deductions, or mileage)
• Leave records — leave bookings, leave type, and leave policy settings (annual allowance, accrual rules)
• Preferences — timezone, locale, currency, theme, and notification settings

3.2 Data Generated Through Use

• Activity flags — whether you have viewed your pay forecast
• Streak and achievement data — usage streaks for engagement features
• Subscription status — whether your account is on the free or pro tier

3.3 Diagnostic Data

If the app crashes or hits an error, we receive a diagnostic report through Sentry (see Section 6). This contains:

• The error and its technical stack trace
• Device model, operating system version, and app version
• The sequence of actions in the app leading up to the error

A sample of performance measurements (roughly one session in five) is also collected so we can find slow screens. Diagnostic reporting is switched off in development builds and active only in the released app.

We do not send your email address, display name, or the contents of your shifts, pay, or leave records with these reports. Sentry may process your IP address as part of receiving them.

4. How and Why We Use Your Data

We process your data for the following purposes, each with a legal basis under UK GDPR:

Data	Purpose	Legal Basis
Shift schedules, rota patterns, overrides	Provide the shift planning service	Contract performance — Article 6(1)(b)
Pay rates, enhancement and overtime rules, adjustments	Provide pay forecasting	Contract performance — Article 6(1)(b)
Leave bookings and leave policy	Provide leave tracking	Contract performance — Article 6(1)(b)
Timezone, locale, currency	Display the service correctly for your region	Contract performance — Article 6(1)(b)
Email address, display name, profile photo	Authenticate your account and personalise the app	Consent — Article 6(1)(a)
Activity flags, streaks	Improve your experience within the app	Legitimate interest — Article 6(1)(f)
Notification preferences	Deliver the shift reminders and summaries you request	Legitimate interest — Article 6(1)(f)
Subscription and purchase status	Provide and verify Pro features	Contract performance — Article 6(1)(b)
Crash reports and diagnostic data	Identify and fix faults so the app stays reliable	Legitimate interest — Article 6(1)(f)

Where we rely on legitimate interest, we have assessed that our interest in providing a functional and engaging app does not override your rights. You can object to processing based on legitimate interest at any time (see Section 9).

5. How We Store Your Data

Local Storage

All your data is stored locally on your device using the app’s built-in storage. This data remains on your device even after you sign out. You can remove it at any time by uninstalling the app or clearing the app’s data through your device settings.

Cloud Storage

If you sign in with email, your data is also synced to our cloud database, provided by InstantDB, so that it can be backed up, recovered, and used across your devices. Each user’s data is isolated — only you can access your own records.

If you do not sign in, your data stays on your device only. Nothing is sent to our cloud database until you create an account, at which point the data already on your device is uploaded and linked to it.

All data sent between the app and our servers is encrypted in transit using HTTPS/TLS. Data stored locally on your device is subject to your device’s own security settings (such as device encryption and screen lock).

6. Data Sharing and Third Parties

We share your data with the following third-party services, and no others:

InstantDB (Instant, Inc.)

• Purpose: Cloud database, user authentication, and real-time data synchronisation
• Data shared: Your profile information and a snapshot of your app data (shifts, pay, leave, preferences)
• Privacy policy: https://www.instantdb.com/privacy

Sentry (Functional Software, Inc.)

• Purpose: Crash and error reporting, plus performance diagnostics, so we can find and fix faults in the app
• Data shared: Error reports and stack traces, device model, operating system and app version, the sequence of actions leading up to an error, and a sample of performance measurements. Your IP address may be processed as part of delivering these reports. Your schedule, pay, and leave data are not sent.
• Privacy policy: https://sentry.io/privacy/

RevenueCat (RevenueCat, Inc.)

• Purpose: Managing Pro subscriptions and verifying purchase status
• Data shared: A subscription identifier and your purchase history for this app. Until you sign in this identifier is anonymous; once you do, it is linked to your account ID so your subscription follows you across devices. Payment details are handled entirely by Google Play and are never seen by us or by RevenueCat.
• Privacy policy: https://www.revenuecat.com/privacy

What We Do Not Do

• We do not use advertising or product-analytics services, and we do not track you across other apps or websites
• We do not display advertisements or share data with advertising networks
• We do not sell, rent, or trade your personal data to any third party
• We do not send push notifications through any cloud messaging service — all notifications are scheduled locally on your device
• We do not access your device’s calendar, contacts, or location

7. International Data Transfers

Our cloud database provider InstantDB, our diagnostics provider Sentry, and our subscription provider RevenueCat all store data on servers located in the United States. This means your personal data is transferred outside the United Kingdom.

These transfers are protected by appropriate safeguards in accordance with UK GDPR, including the UK-US Data Bridge and/or Standard Contractual Clauses.

You may contact us at shiftspring.contact@taskarasystems.com to request further details about the safeguards in place.

8. Data Retention

• Active accounts: We retain your data for as long as your account is active and you continue to use the app.
• Deleted accounts: When you request account deletion (see Section 10), the data on your device is cleared immediately and your cloud-stored data is permanently deleted within 7 days. We do not retain backup copies of deleted data.
• Local data: Data stored on your device is under your control. You can remove it by uninstalling the app or clearing the app’s data through your device settings.

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can correct inaccurate data. Most data can be edited directly within the app.
• Right to erasure — You can request deletion of all your personal data (see Section 10).
• Right to restrict processing — You can ask us to limit how we process your data in certain circumstances.
• Right to data portability — You can request your data in a structured, commonly used, machine-readable format.
• Right to object — You can object to processing based on legitimate interest. We will stop processing unless we have compelling grounds to continue.
• Right to withdraw consent — Where we process data based on your consent (such as your email address for authentication), you can withdraw consent at any time. This does not affect the lawfulness of any processing carried out before withdrawal.
• Right to lodge a complaint — You have the right to complain to the Information Commissioner’s Office (ICO) if you believe your data rights have been violated.

To exercise any of these rights, contact us at shiftspring.contact@taskarasystems.com.

10. How to Delete Your Account

You can delete your account and all associated data directly within the app:

1. Open Shift Spring
2. Go to the Profile tab
3. Tap Delete Account
4. Confirm through the safety prompts

Your local data is cleared from your device immediately, and you are signed out.

Your cloud-stored data — including your profile, shift schedules, pay information, and leave records — is then permanently deleted within 7 days. Deletion requests are processed automatically every Sunday. This deletion is irreversible and covers all data held about you.

If you need assistance, you can also request account deletion by emailing shiftspring.contact@taskarasystems.com.

11. Device Permissions

The app requests the following device permissions:

• Internet — Required for cloud synchronisation and authentication.
• Notifications — Used to deliver shift reminders and weekly summaries. All notifications are scheduled and delivered locally on your device — no cloud push notification service is used.

Each permission is requested at the point of use and can be revoked at any time through your device settings.

If you choose to set a profile photo, the app opens your device’s system photo picker. We receive only the single image you select; the app is not granted access to the rest of your photo library.

12. Children’s Privacy

Shift Spring is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16.

If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at shiftspring.contact@taskarasystems.com.

13. Security

We take reasonable measures to protect your personal data:

• All data transmitted between the app and our servers is encrypted using HTTPS/TLS.
• Cloud-stored data is protected by row-level access controls — only you can view and modify your own records.
• Authentication is handled through secure token exchange.
• Local data stored on your device is subject to your device’s own security measures, such as device encryption and screen lock.

14. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the “Last updated” date at the top of this page.

For material changes, we will notify you through the app or by email (if you have provided one).

We encourage you to review this policy periodically to stay informed about how we protect your data.

15. Contact Us

If you have any questions about this privacy policy or how we handle your data, please contact us:

Taskara Systems Limited 259 Wallasey Village, Wallasey, Wirral, England, CH45 3LR Email: shiftspring.contact@taskarasystems.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113