Privacy Policy

1. Scope and contact

This policy explains how personal data is handled by the ShiftCal mobile app and its related account, calendar, shared planning, backup and support services, offered under the SryyaLabs brand. The developer and data controller is Süreyya Karabay. Use the contact address below for privacy questions and requests.

2. Data we process

Account information: the name, email address and password you provide during registration, plus account and membership identifiers. Passwords are stored on the server as hashes. Access tokens are used to manage signed-in sessions.

Device and notification information: an app-generated installation identifier, device name, iOS or Android platform, last connection time, language and notification preferences, and a Firebase Cloud Messaging notification token.

Planning data: shifts, activity types, start and end times, time zone, colours, notes, templates and shared plans. Your hourly rate preference is stored on your device; estimated earnings are calculated from work entries. When you use cloud backup, the backed-up calendar entries are sent to the server.

Subscription information: store, product, transaction or purchase token, account-specific store association identifier, verified subscription status, trial, renewal and access expiry. Verification proofs are encrypted on the server. We do not receive payment card details; Apple App Store or Google Play processes payment. Your partner can see the subscription source, trial status and access expiry, but cannot see your transaction token.

Partner connections: invitation and connection identifiers, the connected account, shared plan proposals and your responses to them.

Support information: request subjects, messages, replies, language, timestamps and read status. If you contact us by email, your sender address and message content are used to handle your request. Do not include passwords or payment card details in messages.

Technical information: server infrastructure may process connection and error information, such as IP addresses and request times, when you connect to the service. The app stores language and appearance preferences and a copy of calendar entries on your device.

3. Why we use your data

We use data to create your account and manage sessions, store and synchronise calendar entries, enable shared planning with your chosen partner, provide requested backup and restore features, send notifications according to your preferences and respond to support requests.

We also process necessary data to secure accounts and services, resolve errors, prevent abuse and meet applicable legal obligations. Processing is based on providing the service, legitimate security needs and applicable legal obligations; features requiring permission operate with your permission.

4. Sharing with partners and service providers

When you establish a partner connection, the connected account name, time intervals marked as working, sleeping, free or busy, and shared plan information can be visible to your connected partner. The daily availability view does not include personal activity notes or your hourly rate. Information you enter in shared plans may be shown to the other participant.

Service providers, including server and hosting infrastructure, support email services and Google Firebase Cloud Messaging, may process the data needed to provide their services. Firebase delivers notifications to your device. These providers may process data outside your country because of the locations of their infrastructure.

We do not sell your personal data. The current app does not include advertising SDKs, Firebase Analytics or Crashlytics. Necessary information may be disclosed in response to lawful requests from authorities or where required to protect rights.

Firebase privacy and security information

5. Permissions and on-device storage

Notifications and reminders use operating system notification permission and, where needed, alarm settings. You can change these preferences in the app or device settings. The app uses your time zone to display times correctly; it does not request access to GPS location, contacts, microphone or your photo library.

Session information is kept using secure device storage, while calendars and preferences are kept in local app storage. This page does not contain third-party advertising or analytics tracking code; the web infrastructure may use necessary session and security cookies.

6. Retention and security

Account and service data is kept for as long as needed to provide your account and related features. Support correspondence is used to resolve and follow up requests. When deletion is requested, the relevant active data is deleted; limited records that must be retained for legal obligations, security or disputes are kept only for the period necessary for those purposes. We explain any such exceptions when handling your request.

Deleting an individual activity does not automatically remove an earlier cloud backup or copies you exported yourself. Please specify if you also want your cloud backup deleted. You need to remove copies on your own devices and in exported files separately.

We use HTTPS for app-to-server connections, hashed account passwords, authorised access and records scoped to each user. No method of digital storage or transmission can guarantee absolute security.

7. Request account and data deletion

You can permanently delete your ShiftCal account and data in Settings > Delete my account. Memberships in other apps are preserved. Accounts created with Apple require Apple reauthentication. Any store subscription must be canceled separately in the App Store or Google Play. You can request account and data deletion without installing the app. Use the email link below to send a message with the subject “ShiftCal account deletion” from your registered email address. If you can access your account, you can also submit a request through the in-app Support section. Do not send your password; we may request additional information to verify account ownership.

Your request covers deletion of calendar entries, cloud backup, device and notification records, partner connections, shared plans and support data associated with your ShiftCal account. Deleting shared plans may also affect your partner’s view. Any limited records that must be retained will be explained to you.

8. Your rights and choices

Depending on applicable law, you may have rights to learn whether your data is processed, request information and access, correct inaccurate information, request deletion, object to processing and request a portable copy where applicable. You can withdraw permissions for permission-based features. Contact us at the address below to exercise your rights; we may need to verify your identity. You may also contact the relevant data protection authority.

9. Children’s privacy and policy updates

ShiftCal is not designed as a service for children. If you believe a child has provided personal data without any required parental permission, contact us so we can review removal of the relevant data.

We update this policy and its last updated date when features or data practices change. Significant changes are communicated through the app or our contact channels where needed.