Privacy Policy

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

We are not required to appoint a data protection officer.

The details follow below.

ShiftLoad is hosted on Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare delivers the app and our domain through its global network, so a request may be processed in the data centre closest to you, which can be outside the EU.

When you open our website, your browser automatically transmits technical data: IP address, date and time of the request, requested page, referrer URL, browser type and version, and operating system. We need this data to deliver the website, keep it stable and secure, and detect misuse. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website). Log data is deleted after a short period unless it is needed to investigate a specific security incident.

To diagnose technical errors, our hosting records error messages from our servers (error message, affected page, time of the request) in application logs at Cloudflare. These logs don't contain your check-ins or account content and are deleted automatically after a few days. Legal basis: Art. 6(1)(f) GDPR.

Cloudflare acts as our processor on the basis of a data processing agreement (Art. 28 GDPR).

We only store information on your device, or access it there, where this is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG), or where you have consented (§ 25(1) TDDDG).

Strictly necessary (no consent required):

The app also uses a service worker so it can be installed on your home screen and work offline. It stores app files (not personal data) in your browser's cache.

We don't use analytics, advertising or tracking cookies.

We currently don't use any analytics or tracking tools. If we introduce one in the future, we'll update this policy and ask for your consent where required.

To use ShiftLoad you create an account with your first name, email address and password. We store the password only as a cryptographic hash. We send you an email to confirm your address, and on request a password reset link. We also store when you accepted our Terms of Use.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Without this data we can't provide an account.

Authentication and the database run on Supabase (Supabase Inc., USA) in a data centre in the EU (Paris, France – region eu-west-3). Supabase is our processor (Art. 28 GDPR).

ShiftLoad is built for two partners who share a digital household. When you create a household, we generate an invite code and send it to you by email. When your partner joins with that code, both accounts are linked to the same household.

We store your daily check-ins (date and choice: "Great Team" or "Survival Mode") and the weekly team score. Your partner in the household can see your check-ins and the weekly reports, and you can see theirs. That is the core purpose of the app.

Legal basis: Art. 6(1)(b) GDPR.

Once a week, ShiftLoad generates a short recap, a team score and two tips for your household using the Gemini API by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA).

What is sent to Google: the dates of the last 7 days, each partner's check-in value for each day ("Great Team", "Survival Mode" or "No check-in"), the calculated team score, and the previous week's summary and tips. Partners are referred to only as "Partner A" and "Partner B".

What is not sent: names, email addresses, account or household IDs, IP addresses, payment data or location data. Your first names are inserted into the report only after it comes back, on our side.

We use the paid Gemini API. Under Google's terms, Google doesn't use this data to train or improve its models. Google may keep requests for a limited period to detect abuse. Google acts as our processor.

Legal basis: Art. 6(1)(b) GDPR. The report is generated automatically. It has no legal effect and doesn't significantly affect you in a similar way, so it is not automated decision-making within the meaning of Art. 22 GDPR. AI-generated content can be inaccurate and is not professional advice (see our Terms of Use).

If you switch on daily reminders, we store your reminder time, time zone and a push subscription (a technical address generated by your browser). The notification is delivered through your browser or device manufacturer's push service (e.g. Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push Service or Microsoft Windows Push Notification Services). These services receive only the technical address and an encrypted message.

We also send occasional push notifications as reminders, for example when you haven't checked in for a few days. You can switch notifications off at any time in Settings or in your browser.

Legal basis: your consent (Art. 6(1)(a) GDPR, granted when you enable notifications) and Art. 6(1)(b) GDPR.

We send service emails only: your invite code, confirmation and password emails, a notice when your shared household is dissolved, and a reminder 2 days before your free trial ends. We don't send newsletters.

Emails are sent through Resend (Resend, Inc., USA) from its EU region, and through Supabase for login-related emails. Both act as our processors.

Legal basis: Art. 6(1)(b) GDPR.

Premium subscriptions are sold and billed through Link, a service of Stripe, which acts as reseller (merchant of record). Payments are processed by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland, and Stripe, Inc., USA). When you click a payment button, you are redirected to Stripe's checkout. There you enter your payment and billing details directly with Stripe and Link. We never see your card details.

We receive from Stripe: a customer reference, your subscription plan and status, and the email used at checkout, so that we can unlock Premium for your household. To match the payment to your account, we pass your user ID to Stripe as a reference. Before you are redirected, we also store that you requested Premium to start immediately (time, plan), as proof for the right of withdrawal (Art. 6(1)(c) and (f) GDPR, kept for 3 years).

Stripe and Link process your payment data as independent controllers. Their privacy policies apply: https://stripe.com/privacy and https://link.com/privacy.

Legal basis: Art. 6(1)(b) GDPR.

If you email us, we process your email address, name and the content of your message to answer you. Our support mailbox is hosted by Zoho (Zoho Corporation B.V., Netherlands) in its EU data centre. Zoho acts as our processor.

Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

If you use our cancellation or withdrawal function, we process your name, email address, the details of your contract and request, and the date and time of submission. We use this data to carry out your request, send you a confirmation and document the request.

Legal basis: Art. 6(1)(b) and (c) GDPR (§§ 312k, 356a BGB) and Art. 6(1)(f) GDPR (proof in case of disputes). We keep these records for 3 years after the end of the year of the request.

We only share your data with the service providers listed above, to the extent necessary. Some of them are based in the USA or may access data from there (Cloudflare, Supabase, Resend, Google, Stripe).

Such transfers are based on the EU–U.S. Data Privacy Framework where the recipient is certified (Art. 45 GDPR), and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17). You can delete your account yourself at any time in Settings,
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21),
• withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, email support@shiftload.app.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de (link to https://www.ldi.nrw.de).

You're not legally required to provide personal data. However, without an email address, password and first name we can't create an account, and without check-ins the app can't work.

ShiftLoad is intended for adults. You must be at least 18 years old to create an account.

All connections are encrypted (TLS). Access to the database is restricted by access rules so that each household can only read its own data.

We update this Privacy Policy when our service or the law changes. The current version is always available at shiftload.app/privacy. We will notify you by email of material changes that affect you.