Privacy Policy for ShiftWake Alarm

This Privacy Policy explains how we collect, use, share, and protect your personal data when using the ShiftWake Alarm mobile application (hereinafter referred to as the "App"). These rules are designed to comply with global privacy standards, including the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the US.

If you do not agree with this policy, please do not use our App.

Short Version

• ShiftWake Alarm does not sell personal data.
• ShiftWake Alarm shows no ads. It collects usage statistics through Google Analytics for Firebase, together with the device's advertising ID, only with your consent, which you can withdraw at any time in the app's Settings.
• Alarms, schedules, exceptions and vacations are stored on your phone and, once backup is turned on, also on our servers in Google Firebase, so you have them on a new phone and can share them with people you choose.
• The website does not collect personal data and does not use any analytics or tracking tools.
• Payments, subscriptions and refunds are handled by Google Play. We have no access to your payment card details.

1. What Data We Collect

When using the App, we may collect and process the following categories of data:

• Account data: Your email address and the name from your Google account (if it has one). We receive them when you register or sign in.
• App and Usage Data: Your alarm settings, work schedules, shift types, and time-off records.
• Shared data: If you share your schedule, the App generates a code. Anyone who receives it from you and enters it will see your name, email address and your schedule. For a shift swap, a colleague finds you by your email address; they see your name and whether you have not used the App for a long time. The number of such searches is limited.
• Diagnostics and statistics: Crashlytics collects diagnostic data about app crashes (device type, system version, error log). Google Analytics for Firebase collects app usage data and the device's advertising ID only if you give your consent in the App. The Firebase Cloud Messaging token is used to deliver notifications.
• Payment Data: The App may offer subscriptions or trials. All payments are processed exclusively by third parties (Google Play Store or Apple App Store). We do not collect, store, or have access to your payment card numbers.
• Newsletter emails: If you tick the consent box in the App, we store your email address so we can send you news about ShiftWake. Consent is optional. You can withdraw it in the App's Settings or via the link in every email.
• Subscription verification: We send the identifier of your Google Play purchase to our server, which checks with Google until when your subscription is paid and whether it renews automatically.

Device Permissions and Local Data:

• Biometric Data: If you use biometric authentication (e.g., fingerprint or face recognition) to unlock the App or dismiss alarms, this data is processed strictly locally on your device. We do not collect, access, store, or transmit your biometric data to our servers or any third parties.
• Local Storage and Media: The App requests access to your device's external storage and audio files solely to allow you to select a custom alarm sound. These files are not uploaded to our servers.

2. How We Use Your Data & Legal Basis

We use your personal data exclusively for the following purposes, relying on the specified legal bases under the GDPR:

• Providing and maintaining core functionality (syncing alarms, shift management): Performance of a contract.
• Enabling user interaction (sharing schedules, swapping shifts): Performance of a contract.
• Sending service and push notifications (e.g., notification of a received shift swap request): Performance of a contract.
• Verifying and managing subscriptions or trial periods: Performance of a contract.
• App crash diagnostics (Crashlytics): Legitimate interest (app stability). Usage statistics and advertising ID (Google Analytics for Firebase): Consent.
• Sending newsletter emails: Consent.
• Abuse prevention (verifying that requests to our server come from the genuine App from Google Play, and limiting the number of colleague searches): Legitimate interest.
• Record of consent to the Terms and Policy, kept after account deletion: Legitimate interest (proof of consent and defence of legal claims, Art. 17(3)(e) GDPR).
• Record of the used free week, kept after account deletion: Legitimate interest (preventing the free period from being obtained repeatedly).

3. Data Sharing with Third Parties

We do not sell your personal data to any third parties for marketing or other purposes. We share data exclusively with reliable service providers who ensure the technical operation of the App:

• Google LLC / Google Ireland Limited (Firebase services): Firebase Authentication (sign-in), Cloud Firestore (database), Cloud Functions (server functions), Cloud Storage and Remote Config (holiday list and app settings), Firebase Cloud Messaging (notifications), Firebase App Check with Google Play Integrity (verifying the genuine App), Crashlytics (crash diagnostics) and – only with your consent – Google Analytics for Firebase.
• App stores (Google Play, Apple App Store): To verify the status of your payments and subscription, in the App and from our server.
• Other Users: Data may be disclosed to other App users only based on your explicit action (e.g., if you provide another user with your secure schedule-sharing code).

4. International Data Transfer

Because we use Google cloud services to operate the App, your data may be transferred to and stored on servers located outside your state, province, or country (including the US). These transfers are protected and subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Data Retention Period

We retain personal data only for as long as necessary to provide our services.

• Account and Schedule Data: Retained until you delete your account.
• Shift swaps: Automatically deleted 30 days after the swap date.
• Technical Logs and Analytics: Typically retained for a maximum of 90 days.
• Device records (for delivering notifications): Deleted no later than 6 months after the App was last used on that device.
• Newsletter email address: Until you withdraw consent or delete your account.
• Record of consent and record of the free week: 4 years after account deletion, then deleted automatically.

6. Your Rights (GDPR and Global Rights)

Depending on your place of residence, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data directly in the App.
• Erasure (Right to be Forgotten): Permanently delete your account and all associated data at any time directly through the App settings ("Settings" -> "Delete Account").
• Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Withdraw consent: You can withdraw consent to statistics and the advertising ID, as well as consent to newsletter emails, at any time in the App's Settings. You can turn off notifications in your phone's settings.
• Right to Lodge a Complaint: If you believe your privacy rights have been violated, you have the right to lodge a complaint with the data protection authority in your country of residence.

7. Additional Rights for California Residents (CCPA)

In compliance with the CCPA, we explicitly state that we do not sell your personal data ("Do Not Sell My Personal Information"). You can exercise your rights to access or deletion directly in the App or by contacting us via email.

8. Children's Privacy (COPPA / GDPR-K)

Our App serves as a tool for managing work shifts and alarms and is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently obtained data from a person under 16, we will take steps to immediately delete such information from our servers.

9. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes directly in the App or by updating the "Last updated" date at the top of this document.

Data Retention After Deletion

When you delete your account, we delete your account, profile, alarms, schedules, exceptions, vacations, shares, shift swaps and records of your devices and subscription, and remove your email address from the newsletter list. We keep only two records, both with your email address: a record of consent (which version of the Terms of Use and Privacy Policy you agreed to and when) – solely to prove consent and to defend legal claims (Art. 17(3)(e) GDPR), and a record of the used free week, so that the free period cannot be obtained repeatedly with a new account. Both records are deleted automatically 4 years after the account is deleted. We do not store IP addresses.

10. Contact Us

If you have any questions, requests, or concerns regarding this Privacy Policy, you can contact us:

• By email: info@shiftwake.com
• Operator:
  Registra SK s. r. o.
  Registered office: Predmier 280, 013 51 Predmier, Slovak Republic
  Company ID (IČO): 55376886
  Tax ID (DIČ): 2121961072
  Registered in the Commercial Register of the District Court Žilina, Section: Sro, Insert No. 81819/L