Privacy notice

MyShiftLog is for people aged 16 and over. Your calendar belongs to your account. Your employer does not automatically receive your entries.

Your email is used for your account and account messages. The service also handles technical information to run and protect the app. Do not send your password or recovery key to support.

New calendars use account-managed access: sign in with your email and password, and use password reset if needed. No separate recovery key is required. Existing calendars that use a recovery key keep that model unless their owner chooses Switch to simpler sign-in.

Deleting your account removes its active records. Provider backups and security logs may remain for longer, and files you downloaded stay on your devices.

You can ask about your information, correct it or request deletion. Contact contactmyshiftlog@gmail.com if you need help.

MyShiftLog is a work calendar for people aged 16 and over to keep their own shift roles, tips and time-off records. This notice explains how personal information is used to provide it.

MyShiftLog is operated by Ionut Munteanu, an individual based in the United Kingdom. For privacy questions or requests, email contactmyshiftlog@gmail.com.

To create and use an account, you provide an email address and password. The authentication provider manages sign-in, password verification, recovery and related security information. Account identifiers and technical information are also needed to operate the service.

During private-calendar setup, you enter your name, an employer or job name, timezone and currency. You choose the calendar information you enter, including work roles, dates, payroll tips, actual tips, and time-off markers. A Sick marker records absence; it does not ask for a diagnosis or medical explanation. Please do not add unnecessary information about other people.

Your browser stores information needed for sign-in and security. The Cookies & browser storage control lets you turn off saved display preferences, including appearance, navigation layout and view filters. Turning it off removes those saved display choices; choices still work temporarily during your visit. We retain a small record of this setting so your choice is respected. For an existing recovery-key calendar, if you choose Remember this private device, it also stores local access material for your encrypted records, including an encrypted recovery-key copy.

If you contact support, the operator receives your email address and the information you include through the Gmail support mailbox. Do not email passwords, recovery keys or unnecessary sensitive records.

We rely on legitimate interests to provide the private account and calendar you request: helping you keep and access your own work records. This includes the account support needed to use that service. Our assessment gives extra weight to the privacy and interests of users aged 16–17. We use necessary technical information to protect accounts, prevent abuse and investigate faults, relying on our legitimate interests in keeping MyShiftLog secure and reliable. Account support uses the information needed to resolve your request. Where applicable law requires us to handle a privacy request or disclose information, we use the information necessary to meet that obligation. Accepting the Terms is not blanket consent to other uses of your information.

When you agree to the Terms, we record your account identifier, the exact Terms version and the time you agree. The agreement record is kept with your account and removed on completed account deletion. It is not consent to unrelated uses of your information.

The app uses your entries to display your calendar and compare the tip amounts you record. It does not make employment decisions or determine what your employer legally owes you.

Supabase supplies authentication, database and private file storage, with the database project in its London region. Vercel hosts the website; its current project function setting selects a US region. Information is not processed only in the UK. Providers and their subprocessors process information needed to deliver and secure their services, including processing outside the UK.

Supabase and Vercel’s data-processing terms provide Standard Contractual Clauses with the UK Addendum for relevant restricted transfers. The Supabase contracting entity is in Singapore; Vercel’s is in the United States. The Gmail support mailbox is covered by Google’s consumer privacy terms and transfer arrangements, rather than a Google Workspace data-processing agreement. Contact contactmyshiftlog@gmail.com for information about these safeguards or how to obtain a copy. These arrangements do not mean that every provider copy stays in the UK.

For account-managed calendars, work records are encrypted before storage and the service also stores the access key against the authenticated account. This is not end-to-end encryption: MyShiftLog and its infrastructure providers can technically decrypt the records. Other users have no automatic access to your private records. This arrangement lets you open your calendar on another device and recover access through your account email. Existing recovery-key calendars retain their previous access model until the owner explicitly switches; we verify the existing key before enabling account access, without rewriting calendar records. Account and service metadata remain outside the encrypted content. Older accounts may also retain earlier readable records.

Your account and saved calendar records are kept to provide your account until you remove them or complete account deletion. Earlier versions or record history may be retained by the service; removing an individual entry is not a promise to erase every historic copy.

You can edit or remove calendar entries in the app. You can request help at contactmyshiftlog@gmail.com.

The account-deletion service removes your sign-in account, linked application records and files from active private storage. The Settings flow requires explicit confirmation and clears that account’s remembered access in the browser used for deletion. Downloads you previously saved and local access material on other devices are not erased remotely.

Deletion can fail part-way through file removal; the app shows an error when completion is not confirmed. Provider backups and security logs can follow separate retention rules.

Supabase Free publishes one day for API and database log retention and a separate one-hour window for Auth Audit Logs. MyShiftLog uses Vercel Pro with Observability Plus, which publishes 30 days for runtime logs. These are limits for those named log products, not a promise that every provider copy is erased within those times.

Supabase may hold database backups after an individual account is deleted. Its Free-plan documentation describes conditional daily backups but does not establish a guaranteed expiry for every copy of a deleted user's information. We have not yet verified that deadline. Database backups do not include the contents of files stored through Supabase Storage.

The current app release no longer includes the Vercel Speed Insights collection component. Removing it does not delete previously collected performance events. Vercel publishes a 30-day reporting window for Speed Insights on Pro; a reporting window is not a guarantee that every underlying copy is erased at its end.

Support conversations are kept while handling the request and necessary follow-up. At closure, unnecessary material is reviewed for removal. A limited record may be retained for a specific unresolved complaint, security issue or legal obligation, with a recorded reason and review date.

Depending on the circumstances and the lawful basis used, you may ask to access, correct or erase personal information, restrict its use, object to processing or receive a portable copy. Contact contactmyshiftlog@gmail.com to make a request. Any identity check should be proportionate to the request.

You do not need to send us your password or encryption recovery key. Access requests are normally answered without charge and within one calendar month, subject to applicable identity checks and lawful extensions.

Right to object: where processing relies on legitimate interests, you can object to that processing.

Where processing relies on consent, you can withdraw it.

You can also complain to the UK Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/.