Privacy Policy

1. What this covers

This policy explains what Shiftaroo collects, why, who else can see it, and what you can do about it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Shiftaroo is small. We have chosen to hold ourselves to the Privacy Act in full rather than rely on any exemption available to a small business, because of what a roster reveals.

2. Why we treat roster data as sensitive

A week of shifts shows when somebody needs support, how much, whether they need someone overnight, and how that changes. That is information about a person's disability and health, and the Privacy Act calls that sensitive information. It gets the strongest protection in this policy.

By setting up a roster you consent to us collecting and handling this information for the purpose of running that roster. If you enter details about another person — a participant, a family member, a support worker — you are confirming you are allowed to.

3. What we collect

Because you gave it to us

• Who you are: your name, your mobile number, and your email if you add one.
• The roster: the participant's name, shifts, times, who is on them, labels, notes, leave, and any record of a shift your household covered itself. A note can be marked as "something went wrong" — that marks it so you can find it again, and reports nothing to anybody.
• "How to support me", if your household writes one: whatever you choose to put there for the people who work with the participant. It is optional, you write it in your own words, and everyone on that roster can read it — including support workers, which is the point of it.
• Your team: the names and mobile numbers of the support workers you invite, the rates you agree with each of them, and the role you give each person.
• Invoicing details, if you are a worker who uses invoicing: your business name, ABN, and how you would like to be paid — account name, BSB, account number and PayID — as you want them printed. They are stored so we can put them on the invoices you produce, and that is the only thing they are ever used for. We do not check them against any bank, we never share them with anyone but the household you invoice, and Shiftaroo never moves money.

Because the service runs

• Sign-in records: one-time codes and magic links, and when they were used. We store only a one-way hash of a code or token, never the code itself.
• An activity log of changes to a roster — who changed what, and when — so a household can see what happened.
• Ordinary technical logs such as IP address, timestamp and error details, kept briefly for security and to fix faults.
• A notification token for each phone you allow notifications on, so we can reach that device. Turn notifications off, or sign out, and it is deleted.
• Passkeys, if you set one up: a public key and a name for the device, and nothing else. Your face, fingerprint and PIN never leave your phone and are never sent to us — your device checks them itself and only tells us that it was satisfied. A passkey is optional, you can remove it from Me at any time, and your mobile code and email link keep working regardless.

What we do not collect

• No location, ever. Shiftaroo has no GPS, no geofencing and no location-verified clock-in, and the apps do not ask for a location permission. This is a permanent product decision, not a current limitation.
• No advertising or analytics trackers, and no third-party marketing pixels.
• No passwords. Signing in is by a code to your mobile or a link to your email, so there is no password for us to lose.
• No participant NDIS number in readable form. Where it is stored at all, it is encrypted.

4. Why we use it

To run the roster and show it to the people entitled to see it; to tell a support worker about a shift; to work out time bands and rates; to produce invoices; to keep accounts secure; and to fix problems.

We do not use roster information for anything else. We do not sell it, rent it, trade it, or use it to build a profile of anybody. We do not use it to train machine learning models. If we ever wanted to use it for a new purpose, we would ask you first.

5. One roster never sees another

Support workers usually work for several households, and Shiftaroo is built so those households stay invisible to each other. A worker sees their own week across everyone they work for; a roster shows only itself.

If a worker is already booked elsewhere when you try to roster them, you are shown only that they are unavailable — never whose roster it is, the times, or that it exists at all.

6. Your phone's calendar

If you turn it on, Shiftaroo puts your own shifts into your phone's calendar and keeps them in step, so one that moves or is cancelled changes there too. It writes who the shift is for and the times, and nothing else — no notes, no addresses.

We never read your calendar. Nothing already in it is looked at, sent to us, or stored by us. Shiftaroo only ever touches the events it created for your own shifts.

The permission we ask for is wider than "add an event", and it is worth explaining why. Phones offer an add-only permission, and on the face of it that is the more respectful thing to ask for. It cannot update or remove anything — so a shift that moved would never move in your calendar, a cancelled shift would sit there looking real, and turning this off would leave every one of them behind. That is not a smaller promise, it is a broken one, and the person most likely to be caught out is a support worker turning up on a day nobody expects them.

So we ask for full access, only at the moment you turn this on, never when the app starts. What we do with it does not change: we write your shifts, keep them in step, and take them away again when you say so. You can withdraw it in your phone's settings whenever you like, and nothing else about the app stops working.

Turning it off in the app takes the shifts back out again. You can also remove Shiftaroo's calendar permission in your phone's settings at any time, and nothing else about the app stops working.

The app also keeps a copy of your week on your phone, so you can still see where you're meant to be when there's no signal. It holds the times, who each shift is for by first name, its status and its title — never shift notes, addresses or pay rates. It's replaced each time you look at your week, and it's deleted when you sign out.

7. Text messages, and how to stop them

We text you when there is something you need to know and no email address on your account — a roster you work on is closing, or somebody has invited you to one. Every one of those ends with Reply STOP to opt out, and replying STOP stops them. Reply START if you change your mind.

Sign-in codes keep coming, and that is on purpose. A code is only ever sent because you have just asked for one, and if STOP silenced those too you could never get back into your own account — not to your invoices, not to your shifts, and with no way for us to tell you why. The same goes for a message saying your account has been moved to a different mobile number: that is how you would find out somebody else had taken it.

Opting out means we may have no way to reach you. If a roster you work on is being deleted, you would not be told, and unbilled shifts on it would go with it. Worth knowing before you decide.

8. Who else can see your information

When a support worker emails you an invoice, the message carries the total, the invoice number, the dates and a link — not the shifts, hours or support types on it. Those stay behind a sign-in. That is deliberate: an itemised invoice is a picture of a week of somebody's care, email travels in the clear through mail servers we do not control, and the person receiving it can already see every line by following the link. The message goes only to whoever owns the roster.

Only the people you have given access to, and the services we need to run Shiftaroo:

• Microsoft Azure — the database, in their Sydney region. Backups are held in a second Australian region so a single data centre cannot take your roster with it. Your roster does not leave Australia.
• Cloudflare — running the application and protecting sign-in from bots.
• Amazon Web Services — sending our email: sign-in links, invitations, an invoice when a support worker asks us to send one, and replies from our support desk. They receive the email address and the message, and send it from their Sydney region. Nothing about your roster travels in them beyond what the message itself says.
• Crazytel — sending the text messages that carry sign-in codes, invites and the notices above, and handling STOP replies.
• Google (Firebase Cloud Messaging) — delivering push notifications to the apps. Google receives a device identifier and the text of the notification itself, which is why those are kept short and say as little as possible: "Dave has booked time off", never a participant's details.
• Anthropic — only if you use "start a week from a document". The picture or text you choose to upload is sent to Anthropic's servers, outside Australia, to be read into shifts. We do not keep it, and nothing else on your roster is sent. Anthropic handles it under their own terms, which allow them to hold it for a short period to check for misuse. You are told this on the upload screen and have to tick a box before anything goes. If you never use that feature, nothing of yours ever goes to Anthropic.
• Anthropic, again — live chat. When you open the chat, the question you type is answered first by an assistant. To answer it usefully we send your question along with a small amount about your own roster: what it is called, what day your week starts on, its timezone, whether it can be changed right now, how many shifts are unsent, and the next few shifts coming up — the date, the time, and who is on each. If you are connected to more than one roster, information from each of them may be included. We limit what goes to what the assistant needs in order to answer you, and we do not include shift notes, photos or rates. If you would rather not, use the form instead of the chat, or email support@shiftaroo.app.
• Chatwoot — our own support system, on our own servers in Australia. It holds your support conversations and the email address you can be replied to on.

These providers act on our instructions and are not allowed to use your information for their own purposes. We may also disclose information where the law requires it, or where it is necessary to prevent a serious threat to somebody's life, health or safety.

If Shiftaroo were ever sold or transferred, roster data could go with it. We would tell you before that happened, and this policy would continue to apply until you were told otherwise.

9. Where your information is stored

The database is in Sydney, Australia, and stays there. Its backups are kept in a second Australian region. We do not store uploaded files at all — there is nowhere for them to go, because nothing in Shiftaroo keeps one.

Email is sent from Sydney. Our email goes out through Amazon Web Services in their Sydney region: sign-in links, invitations, an invoice if a support worker asks us to send one, and replies from our support desk. What travels is the address and the message, and we keep those messages thin on purpose — an invoice email carries a number, a date and a link rather than the week it was built from. Once sent, an email is delivered by whoever runs your mailbox, which may keep it overseas. If you sign in with a mobile number instead of an email address, the codes go by text message through an Australian provider.

Two things do go overseas, and both are yours to choose. If you use "start a week from a document" — reading a photo, a screenshot or pasted text into shifts — that document is sent to Anthropic in the United States to be read, and the shifts come back. We do not store the document: we keep the shifts, and a fingerprint of the file so that pressing the button twice does not read it twice. Anthropic may hold it briefly under their own terms to check for misuse. Nothing else about your roster goes with it. The upload screen says so plainly and asks you to tick a box first, and if you never use that feature nothing of yours leaves Australia this way.

Live chat is the second, and it is worth being plain about. When you open the chat, your question is answered first by an assistant, so the question and a small amount about your own roster go to Anthropic in the United States — the settings that decide how your week is laid out, whether it can be changed right now, and the next few shifts with their times and who is on them. It is bounded on purpose: we send what the assistant needs in order to answer your question, drawn from the rosters you are connected to — which may be more than one. Shift notes, photos and rates are not included. Your support conversation itself stays on our own server in Australia. The form and email reach a person without any of that.

We should be straight with you about one thing. Cloudflare, which runs the application, is a global network. We configure Shiftaroo to run next to the Australian database and we do not allow roster data to be cached at the edge — but a request you make while overseas, or in an unusual failover, may be handled at a location outside Australia in transit. Nothing personal is stored there.

10. Keeping it safe

Traffic is encrypted. Sessions are signed, and sign-in codes and links are stored only as one-way hashes, expire quickly and work once. Access to the production database is restricted and audited. Test and staging environments are seeded with made-up data — we do not copy real rosters into them.

No system is perfectly secure. If a data breach happens that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

11. How long we keep it

The roster keeps 90 days. Shifts, notes, leave and the activity log are deleted once they are more than 90 days old. The window rotates forward with you, so you have about the last three months and never more. Sign-in codes and links are deleted shortly after they expire.

Invoices are kept while the account exists. An invoice is a financial record rather than a roster, its contents are hours and amounts rather than somebody's support needs, and a support worker may be asked for it years later. It is deleted when the account is — and an account nobody has signed in to for 12 months is closed, after we email twice: 30 days before, and again 7 days before.

Two different clocks, on purpose. A roster going stale and an account being abandoned are not the same thing. Ninety days is right for a week nobody is using; it is far too short for ending somebody's account, because a hospital stay or a hard few months can easily run past it. Signing in resets the 12-month clock. Shiftaroo is free, so an account is never closed, locked or deleted over a payment.

So Shiftaroo is not your long-term record. If you need shifts, notes or invoices beyond what we hold — for a plan review, for your tax, or for any other reason — export them and keep your own copy. We will not have them.

We keep the roster short on purpose. A roster says a great deal about a person's disability and daily life, and the safest thing to do with information nobody is using is not to hold it.

If you ask us to delete a roster we will do so, and we will tell you first about anything we have to keep — for example, records we are required by law to hold.

If Shiftaroo itself ever closes, we will give you at least 30 days' notice, and you can export everything throughout. Everything is deleted 7 days after the closing date, and our backups then expire within a further 14 days.

12. Seeing, correcting and taking your data

You can see and correct most of your information inside Shiftaroo, and you can export your full roster data at any time while your account exists, free. We do not keep it indefinitely — see section 11.

If you want a copy of anything not visible in the app, or want something corrected or deleted, email hello@shiftaroo.app. We will respond within 30 days. We will need to be sure it is you before we hand anything over.

If you are a support worker, your identity is yours: it belongs to you rather than to any roster, it follows you if you change your number, and being removed from one does not delete it.

13. Children and young people

A participant may be a child, and their roster is run by the adult who set it up. Shiftaroo is not designed for children to use directly, and you need to be at least 16 to have your own account.

14. Complaints

If you think we have mishandled your information, email hello@shiftaroo.app and we will investigate and reply within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

15. Changes

We will update this policy as Shiftaroo changes. If a change affects how we use information you have already given us, we will tell you before it takes effect.