Privacy

Who runs ShiftClick

ShiftClick is run by Lachlan Jones, an individual in the United Kingdom. For anything on this page, email hello@shiftclick.app.

If you sign up for shifts

The organiser of your event decides what to ask for and uses it to plan the rota. ShiftClick stores it for them.

• What we store: your name, email address and phone number, the shifts you tick, whether you’re happy to do two shifts in a row, who you signed up with, the shifts you’re given, and any you cancel.
• Who sees it: the event’s organisers see all of it. People on the same shift as you see your full name. Nobody else does.
• If someone signed you up with them: they gave us your name, and your email address if they added one.
• Emails: we email you about this event only: your sign-up, your personal link, your shifts, changes to them and a reminder the day before. No marketing.
• Your personal link is the key to your page. Anyone who has it can change your shifts, so don’t forward it.

If you organise an event

• Signing in with Google: Google tells us your name, email address and profile picture address. We use the name and the email address.
• Signing in by email: we store the email address you type and send the sign-in link to it.
• Your events: we store what you enter, including the contact names, phone numbers and photos you add. The people who sign up see the contact details.
• A record of changes: each event keeps a log of who changed what and when.

Cookies and counting visits

• One cookie, for organisers: it keeps you signed in. People who sign up for shifts get no cookie from us; the emailed link is the key.
• Light or dark: your browser remembers the theme you pick. It isn’t sent to us.
• Page views: on the homepage and the pricing, sign-in, demo and privacy pages we count visits with Vercel Web Analytics. It uses no cookies and doesn’t identify you. Event pages and personal pages aren’t counted.
• No advertising or tracking cookies.

Keeping bots out

Sign-up forms and email sign-in run a bot check from Cloudflare. To stop the forms being used to send unwanted email, we also count recent attempts against your IP address and a scrambled form of your email address. Those counts are deleted within two days.

Companies that handle data for us

• Supabase: the database and sign-in. The data is stored in London.
• Vercel: runs the website.
• Resend: sends the emails.
• Cloudflare: the bot check, and forwarding mail sent to hello@shiftclick.app.
• Google: only if you sign in with Google.

Some of these companies may process data outside the United Kingdom. We don’t sell data or share it with anyone else.

How long we keep it

• Nothing is deleted automatically yet. An event’s data, including everyone who signed up, is kept until the event is deleted.
• Organisers can’t delete an event themselves in the app yet. Email hello@shiftclick.app and we’ll delete it.
• Anyone can ask for their own data to be deleted by emailing hello@shiftclick.app.
• Withdrawing from an event takes you off its rota but keeps your details, so you can rejoin. Email us if you want them deleted.

Your rights

Under UK data protection law you can ask for a copy of your data, ask for it to be corrected or deleted, and object to how it’s used. Email hello@shiftclick.app. If you signed up for shifts, you can also ask the event’s organiser, whose contact details are on your page. If you’re unhappy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.