Privacy Policy

What we collect

ShiftWell collects the information you provide directly:

• Account information — your name and email address
• Profile data — profession, shift type, union/organization type, chronotype, and primary wellness goal
• Recovery check-ins — sleep quality and duration, energy level, stress, fatigue, emotional state, caffeine intake, movement, and free-text reflections
• Shift schedule — your rotation pattern and individual shift overrides
• Calendar events — personal events you add to your calendar
• Group information — group memberships, invite codes, join requests, member moderation actions, and reports you submit
• Wage information — pay rate, FTE, and shift premium configuration you enter voluntarily
• Subscription information — subscription status and app-store or web billing management links; we do not store card numbers
• Wearable data — if you connect an Oura Ring, we access sleep metrics from the Oura API on your behalf
• Notifications — if you opt in, we store browser or device push tokens and notification preferences
• Diagnostics and product analytics — app events, device type, crash reports, and performance data used to improve reliability

How we use it

Your data is used to power your ShiftWell experience — generating AI recovery insights, tracking your streaks, calculating pay estimates, supporting group availability, sending notifications you request, moderating group safety, and personalising recommendations. We do not sell your data. We do not share your data with third parties except the services required to operate the app, listed below.

Aggregate research data

ShiftWell may use anonymised, aggregated data — data that cannot identify any individual user — for research purposes, including understanding shift work health patterns across occupations and informing future product development.

This means we may analyse trends such as average sleep duration across professions, or energy recovery patterns following night shifts, across our user base as a whole. No individual user's data is ever published, shared with researchers, or disclosed in a form that could identify you.

If we ever pursue formal research partnerships that involve sharing data beyond anonymised aggregates, we will obtain your explicit consent before doing so.

Third-party services

ShiftWell uses the following third-party services. Each handles data under their own privacy policy:

• Supabase — database, authentication, and file storage (US-hosted)
• Anthropic (Claude API) — generates your AI recovery insights from your check-in data
• Stripe — processes subscription payments. ShiftWell never sees or stores your card details — they go directly to Stripe
• RevenueCat, Apple, and Google — manage mobile subscriptions and app-store purchase status
• Vercel — hosts and serves the application
• Resend — sends transactional and notification emails
• Expo — delivers mobile push notifications when you enable them
• PostHog — product analytics used to understand feature usage and improve the app
• Sentry — crash and error reporting for the mobile app
• Oura — if you connect your Oura Ring, Oura's own privacy policy governs how they handle your health data on their end

AI processing

Your check-in data is sent to Anthropic's Claude API to generate your personalised insights. This data is processed according to Anthropic's privacy policy and is not used to train their models. Only the data relevant to your current insight is sent — we do not transmit your full account history in a single request.

Groups and shared data

If you join a group, other members of that group can see your display name and shift availability windows (morning, afternoon, evening free or busy). They cannot see your event titles, check-in data, recovery scores, pay information, or personal health information. Only time-of-day availability is shared — the same information you would share when finding a mutual free time to meet.

Group owners can approve join requests, regenerate invite codes, and remove members. Members can report groups or other members, and can block another member so that person is hidden from their shared group views. Reports and moderation actions are stored so ShiftWell can review safety issues and enforce our Terms of Service.

Health-related data

Check-in data (sleep, stress, fatigue, emotional state) is health-adjacent information. We treat it with the same care as personal health data: it is encrypted at rest, transmitted over TLS, never sold, and only processed to generate your own insights. ShiftWell is a wellness tool, not a medical service. See our Terms of Service.

Data storage and security

Your data is stored in Supabase (PostgreSQL), hosted in the United States. All data is encrypted at rest and in transit. Row-level security policies in the database ensure only you — and services acting on your behalf — can access your records. Your device may also cache data locally (via the PWA service worker) to support offline use. This local cache is not accessible to other apps or users.

Push notifications

If you opt in to push notifications, your browser or mobile device generates a push token that is stored in our database and used only to deliver ShiftWell notifications to that device. You can revoke this at any time from your Profile page, device settings, or browser settings.

Email communications

We send transactional emails (account confirmation, password reset) and, with your consent, notification emails such as post-shift reminders, streak alerts, and weekly digests. Notification emails include a one-click unsubscribe link. ShiftWell complies with Canada's Anti-Spam Legislation (CASL).

Cookies

ShiftWell uses cookies and local storage required for authentication and app function (session management via Supabase). We do not use advertising cookies. Product analytics are used only to improve ShiftWell and are not sold to advertisers.

Your rights

You can delete your account and all associated data at any time from your Profile page. Deletion is permanent and irreversible. You may also:

• Request a copy of your data
• Request correction of inaccurate data
• Withdraw consent for notifications at any time
• Disconnect third-party integrations (Oura) from your Profile page
• Leave groups, block or unblock members, and ask us to review moderation reports
• Manage subscriptions through the app store, RevenueCat management link, or Stripe billing portal, depending on where you subscribed

To exercise any of these rights, email us at hello@theshiftwell.ca.

Jurisdiction

ShiftWell is operated from British Columbia, Canada. This policy is governed by the laws of British Columbia and the applicable laws of Canada, including PIPEDA and CASL.

Contact

Questions about privacy? Email hello@theshiftwell.ca