Privacy Policy

1. Scope

This policy explains how Granvure LLC handles information through Shift’s mobile app, cloud services, and support experience. “Shift,” “we,” and “us” refer to Granvure LLC as the operator of Shift.

You can use the core local planner without creating an account. Creating an account enables optional account-based features such as sharing, purchase restoration, data requests, and Cloud Ask. A planner created for or explicitly bound to an account remains stored on that installation but is locked to the same verified account; binding does not upload or synchronize the planner.

2. Information we handle

Information stored on your device

Shift stores your work profiles, schedule versions, exceptions, extra shifts, pay settings and estimates, personal calendars and events, reminders, preferences, and pending synchronization changes in its local app storage. Shift also stores a local custody record that says whether the planner is anonymous or account-bound; an account-bound record contains the account’s internal identifier so the app can prevent another account on the same installation from opening it. Secure device storage may retain the same internal identifier as a last-verified local owner proof so an already-bound planner can remain available during a network outage. That proof is cleared on explicit sign-out, account switch, or deletion and cannot authorize cloud or purchase actions. Local search and Local Quick Questions run on-device.

Account and cloud information

If you create an account or enable account-based features, we process your email address, account identifier, authentication state, sharing invitations and relationships, revision metadata, entitlement state, Cloud Ask quota/audit metadata, and account export or deletion requests. A joint calendar separately stores its name, membership, member display names and colors, manual shared event titles, dates, times, locations, notes and assignments, and work times you explicitly choose to publish. Joint-calendar changes synchronize with the service; this does not upload or synchronize your whole personal planner, private notes, wage rates, or pay history. Shift does not collect payment-card details; Apple processes App Store payments.

Optional member photos

You may select one image for your profile in a joint calendar. Shift crops and resizes it, re-encodes it as a bounded JPEG, and removes image metadata before private upload. Current authorized members of that calendar may view it through authenticated access; there is no public avatar URL. The original library image is not uploaded. Removing a photo or calendar access hides the image and queues private object cleanup; cleanup is not a promise of instantaneous physical deletion.

Calendar and notification information

With your permission, Shift can read events from device calendars you select, write only after a separate choice, and schedule local reminders. Device-calendar information is normally processed locally and is not automatically published to a joint calendar. If you deliberately ask Cloud Ask a question that depends on calendar context, a minimized relevant tool result may be processed to answer that request. Local notification content does not contain wage or pay totals.

If you opt into a joint-calendar daily overview, Shift processes your chosen local time and time zone, calendar membership and notification preference. On a supported installation, enabling notifications registers an Expo project-scoped push token and an account/session-bound installation record. Installation security secrets and push tokens are not shared with calendar members or included in cloud exports. Remote reminder bodies are generic and omit event details, names, locations, work times and pay; opening a reminder requires current account and membership authorization. Automatic daily delivery is not yet enabled in the current private TestFlight release. Saving a preference is not proof of delivery, and notification services and your phone may delay or suppress reminders.

Ask Shift

Local Quick Questions use deterministic tools on your device and do not use cloud AI or Cloud Ask quota. Cloud Ask is an optional Shift Pro feature. When you choose Cloud Ask, your question is sent through Shift’s server to OpenAI so the model can select a deterministic Shift tool and explain its structured result. The model is not permitted to calculate authoritative schedules, dates, durations, availability, hours, or pay.

Shift does not store raw Cloud Ask prompts or responses in its application database and requests that OpenAI not store the response as product application state. We retain limited audit metadata—such as a request identifier, selected tool, outcome, and timestamps—for up to 30 days. Privacy-minimized provider-attempt records containing identifiers, stage, and timestamp may remain for up to 35 days so monthly security, abuse-prevention, and cost limits cannot be erased by a retry or refund. OpenAI states that API data is not used for training by default unless the account owner opts in. Its default abuse-monitoring logs may retain request and response content for up to 30 days, and supported GPT-5.6 requests may use encrypted prompt-cache tensors that expire within 24 hours, unless Granvure’s production project is approved and configured for Zero Data Retention or Modified Abuse Monitoring. The applicable production setting must be verified before release.

Product analytics and diagnostics

If configured and not opted out, PostHog receives a limited catalog of coarse feature events and app/device metadata. Shift disables PostHog session replay, automatic event/error capture, and IP-based geolocation. Shift does not send schedule values, pay values, calendar content, locations, partner data, email addresses, or Ask prompts to product analytics. You can opt out in More → AI & privacy. Sentry may receive privacy-scrubbed crash, device, and app-version diagnostics; performance tracing is disabled. Shift removes default personal identifiers, request bodies, breadcrumbs, and sensitive exception messages before sending reports.

3. How we use information

• Provide, secure, and troubleshoot Shift.
• Authenticate accounts and prevent unauthorized access.
• Calculate deterministic schedules and pay estimates.
• Support reminders and user-requested calendar actions.
• Maintain subscription access and restore purchases.
• Provide private joint calendars, optional member photos, and separately authorized read-only schedule sharing, without sharing pay.
• Enforce Cloud Ask entitlement, rate, and quota limits.
• Measure coarse product reliability and improve the app.
• Handle account export and deletion requests.

We do not sell personal information, serve advertising, use IDFA, broker data, or authorize cross-company tracking.

4. Service providers

These providers process information for the enabled Shift services under their applicable agreements and safeguards. Personal planner reminders are local; optional joint-calendar overview registration is a separate cloud feature.

5. Partner and family sharing

Together provides a private joint calendar for accepted members. Members can add and edit manual shared events and assign them to one member or everyone; titles, locations and notes deliberately entered into a shared event are visible to current members. Only the host manages invitations and removes members or closes the calendar. Members may leave and control their own profile, optional photo, color, shift publication and overview preference.

Work entries are read-only projections of the profiles and scope you explicitly select. They update after the publishing device saves or reconciles while connected, not through guaranteed continuous background synchronization. Other members cannot edit your source work schedule or see pay, wage rules, private planner notes, or external-calendar contents. Existing availability-only and schedule-detail relationship sharing remains read-only and pay-free. Leaving or revocation denies subsequent server access; cached shared views are revalidated and cleared during reconciliation. Access removal cannot recall copies another person already obtained.

6. Your choices

• Use an anonymous local planner without creating an account.
• When signing in over an anonymous planner, explicitly bind it locally, export it, sign back out and keep it anonymous, or erase it.
• Decline calendar or notification permission and keep using eligible core features.
• Choose which device calendars Shift may display or write to.
• Use Local Quick Questions without Cloud Ask.
• Decline or disable Cloud Ask processing.
• Opt out of product analytics in More.
• Leave a joint calendar, stop publishing your work times, remove your photo, turn off your overview, or revoke a sharing relationship.
• Export a device-planner archive or separately export supported cloud account data in More → Data controls.
• Contact support for cloud-account deletion while controlled processing is not yet enabled.
• Manage or cancel an App Store subscription through Apple.

7. Retention and deletion

Your personal planner and Calendar Core remain device-local; joint calendars, published work projections, member photos and overview preferences are separate cloud records. Anonymous planner data remains available locally; account-bound planner data remains on the installation but is hidden after sign-out or account mismatch until the same account is verified or you explicitly erase it. Shift does not automatically erase, release, or reassign planner custody. Local information otherwise remains until you explicitly erase or release it, clear app data, or uninstall Shift, subject to platform backup behavior. Cloud account records are retained while your account is active and as needed to provide requested services. A supported cloud export includes your owned joint contributions, membership/preferences and active owned photos, not another member’s photos or notification credentials. It is available for authorized download for up to 48 hours, then queued for private object cleanup; physical removal timing depends on the cleanup service. Each authorized download link lasts about five minutes.

Controlled cloud-account deletion processing is not yet enabled in the current private TestFlight release. Contact support for a deletion request; a request or queued status is not a completion confirmation. When supported processing is enabled, recent password verification permits an immediate queue or seven-day delay. A request can be cancelled only before processing claims it; sharing is revoked when accepted and is not automatically restored by cancellation. Processing must verify private photo removal and provider-account absence, not just an asynchronous RevenueCat acknowledgement, before reporting completion. The completion mechanism retains an opaque receipt and hashed provider replay/security metadata for up to 90 days, without the deleted account identifier. Backup copies are outside ordinary processing; this page does not promise an unverified backup-erasure deadline. AI audit metadata expires after 30 days; privacy-minimized provider-attempt accounting expires after 35 days.

Inactive notification tokens expire after 30 days; overview provider ticket identifiers are removed after 24 hours and non-content overview receipt metadata after 30 days by the relevant enabled cleanup service. These configured periods do not mean cleanup has already run while that service is disabled. Opt-out or access removal suppresses further authorized overview dispatches. Photo removal invalidates member access and queues bounded private object cleanup.

Cloud-account completion does not automatically erase the device planner or copies you explicitly wrote to Apple, Google, or Exchange Calendar. After verified completion and local session removal, the app asks whether to keep eligible matching planner data anonymously—while removing deleted-account subscription cache and Cloud Ask consent—or erase it. If the receipt is missing or unreadable, Shift keeps content, export, binding, and release locked but still permits a separately confirmed permanent local erase. External calendar copies must be removed in that calendar. Deleting Shift does not cancel an App Store subscription. Shift does not claim per-user deletion from PostHog, Sentry, or OpenAI where no such deletion call is implemented; legal or security records may be retained only as disclosed or required.

8. Security

Shift uses encryption in transit, secure session storage, local planner custody checks, least-privilege access, database row-level security, server-side authorization, effective-dated history, privacy-minimized logs, and idempotent mutation handling. Before showing planner content, the app verifies both the signed-in account and the matching local custody record. It clears Shift widgets and notifications during owner transitions so an earlier account’s data does not reappear for another account. No online service can promise absolute security. Please contact support if you believe your account or data is at risk.

9. Children and geographic scope

Shift is designed for workers and is not directed to children under 13. The initial public release is intended for the United States in English with USD estimates. If you access Shift elsewhere, local laws may provide additional rights.

10. Contact and changes

For privacy questions, contact hello@granvure.com. Account-request controls are in More → Data controls after sign-in. Contact support for cloud-account deletion while controlled processing is not yet enabled; a request is not completion.

We may update this policy as Shift changes. We will publish the revised effective date and provide additional notice when required.