Privacy Policy

Effective 6 October 2026

In short: without an account, your shifts, notes, pay rates and settings stay on your phone. The app only asks our server whether an update or maintenance is due, without any identifier. There are no ads and no crash reporting. Unless you turn it off in Settings, the app sends anonymous usage statistics to Google Analytics for Firebase: which screens and features are used, never your calendar or who you are.

An account is optional. If you create one, our server in Turkey keeps your account details, and your calendar once you turn on cloud sync or join a Friends group. A team you join keeps its schedule there too. This page says exactly what, who sees it and for how long.

Who we are

Shift Calendar: Work Planner (“the app”, package com.talan.shiftcalendar) and its server at shiftcal.quantix.studio are run by Eren Talan, an individual developer (“we”, “us”). We are the data controller for the processing described here. You can reach us at support@quantix.studio.

Data on your device

The app stores the following in its private storage on your phone:

Your shift types, with their names, codes, colours, hours, breaks and pay rates
The rotations you apply and the shift on each day, including notes, changed times and swapped days
Pay rules such as currency, overtime and differentials, if you enter them
Reminder and alarm settings, your holiday region, theme and other preferences
Calendars a partner shared with you as a file, if you import one
When you're signed in: your session, encrypted with a key held by Android, and the shifts a team published for you

Holidays, pay totals and statistics are calculated on the phone. Reminder and alarm settings and your theme never leave the phone, even with cloud sync on.

Using the app without an account

You can use the whole calendar without signing in. Then:

Your calendar is not sent to us or to anyone else.
Once each time it starts, the app asks our server whether this version needs an update or whether the service is under maintenance. The request carries the app version and your language. Like any server, ours sees the IP address it comes from. It carries no account, no device identifier and no calendar data.
To check, make or restore a purchase, the app talks to Google Play and RevenueCat, as described under Services we use.
Unless you turn it off, the app sends anonymous usage statistics to Google Analytics for Firebase, as described in the next section. They contain no calendar data and no account.

Anonymous usage statistics

To learn which features people use and where they get stuck, the app uses Google Analytics for Firebase, a service of Google. It is on when you install the app, with or without an account, and you can turn it off at any time.

What is sent. Only a fixed list of events, each with at most a short label and never free text:

finishing or skipping the first setup (and whether a rotation was chosen); applying a ready-made rotation (which one, and whether from the first setup or the rotation list); creating a custom rotation
the first shift appearing on your calendar (only how it got there: the first setup, a ready-made or custom rotation, or by hand); setting a shift by hand (only whether on one day or several, at most once per app start)
answering a permission request: notifications, exact alarms, battery optimisation or the phone's calendar (which one, and whether it was allowed)
the Premium screen being shown or closed (and which part of the app opened it); a completed purchase (which product); reaching a Premium-only feature (which feature, and the name of the screen it was reached from); the short explanation of a Premium feature being shown, and whether you chose to try it or not now
opening a calendar space (only its kind: your own, a Friends group or a team); creating or joining a Friends group; proposing a swap; creating a team; accepting an invitation; publishing a schedule
adding a widget (which kind); turning on an alarm; exporting a backup; turning on cloud sync
the name of each screen or sheet you open, such as the calendar, the first setup's pages or the day editor

The Analytics software also records a few events by itself, such as the first time the app is opened, the start of a session, how long it is in use and an app update, together with a random app-instance ID for this installation, the device model, the Android and app version, the language, and an approximate location such as the country or city, which Google works out from your IP address.

What is never sent: your name, e-mail address or account ID, your calendar, shifts, notes, pay or comments, anything you type, or your advertising ID. We don't set a user ID, so the statistics are not linked to your account or to you. We have not turned on Google signals, and the data is not used for advertising or to personalise ads.

How to turn it off. In the app, open Settings and switch off Anonymous usage statistics, the last row. From then on nothing is sent, and the analytics data on the phone (the app-instance ID and any events not yet sent) is reset. Deleting your account resets it too. If you turn it on again later, the app starts with a new app-instance ID.

How long it is kept. Google keeps the event data for at most 14 months and then deletes it automatically. Summary reports built from it, such as how many installations used a feature in a month, may be kept longer; they contain no app-instance IDs.

Because the statistics are not linked to you, we cannot find, export or delete them for a particular person. Turning the switch off is how you stop them and reset what is on your phone. How Google handles this data: How Google uses information from sites or apps that use its services.

Your account

An account is needed only for cloud sync, Friends groups and Teams. You can sign up with an e-mail address and password, or with Continue with Google.

What we keep: your e-mail address, your password (only as an argon2id hash, never the password itself), your display name, profile colour, language and time zone, and a random account ID. With Google sign-in, Google tells us your Google account ID, e-mail address, name and language, and we keep those instead of a password.
Your signed-in devices: for each phone you sign in on, a random installation ID, a device name such as the manufacturer and model, the platform and the app version, so you can see your devices and sign them out. If notifications are set up, also that phone's notification token.
Why: to sign you in, keep your phones in step, show your name to the groups and teams you join, send the e-mails the service needs (verification codes, password reset, account deletion, invitations, and notices about swaps, schedules and Team plans) and send notifications at the right local time.

Your e-mail address is never shown to the members of a Friends group. In a team, the owner and admins see it (see Teams).

What our server stores, where and for how long

Our server is a virtual server in Turkey, rented from TAYNET TEKNOLOJİ. The database (PostgreSQL) runs on the same server. Nightly backups of it are kept on the same server for 14 days, and a copy of each is kept for 30 days in a Cloudflare R2 storage bucket, so the service can be restored if the server is lost; Cloudflare encrypts it at rest. We don't sell, rent or use your data for advertising.

Data	When	Kept
Account and devices	You create an account (see above)	Until you sign a device out or delete the account
Calendar	Cloud sync is on, or you're in a Friends group: shift types (name, code, colour, hours, break, pay rate), days (shift, note, changed times), custom and applied rotations, pay rules, and calendar settings (first day of the week, 24-hour time, holiday country)	Until you delete it or the account. The batches of changes that phones exchange are kept for 7 days.
Friends	Groups you create or join, your share level, day comments with mentions and reactions, swap requests and their notes, the members you blocked, and comment reports	Until you leave, delete them or delete the account. Reports: 90 days after we handle them.
Team	Your membership and role, invitations (the invitee's e-mail), an employee code if an admin sets one, schedules and their notes, requests and decision notes, availability, announcements, publish messages, the team's pay rules and hourly rates, and a log of changes	As long as the team keeps them (see Teams)
Notifications	The list of notices shown in the app, such as a new comment or a published schedule	90 days
Purchases	Your RevenueCat app user ID and the purchase and subscription events RevenueCat reports to us, including Team plans	As long as accounting and tax law require, also after the account is deleted
E-mail log	A record of each e-mail we sent: to which address, what kind, when and whether it was delivered	90 days
Server logs	The web server's access log: IP address, time, the address requested, user agent and app version. The app's own log records errors and events.	Access log 14 days; app log 30 days

We never collect your precise location, contacts, photos, health data or advertising ID. The only location involved is the approximate one Google Analytics works out from your IP address, as described under Anonymous usage statistics.

Only we have access to the server. We use our admin tools to run the service, answer your requests (including data export), check e-mail and notification delivery, handle purchases and review reports.

Cloud sync

Cloud sync is part of Premium. When you turn on Back up and sync this calendar in your account, the calendar data listed above is copied to our server and kept in step on every phone you sign in on. It is how you get your calendar back on a new phone. Alarm and reminder settings and the theme are never synced.

Sharing for Friends groups. A Friends group can only show your calendar if our server has it. So when you're in a group without Premium, the app still sends your calendar to our server (it only sends; it doesn't download to other phones). That copy includes your pay rates and pay rules, like cloud sync does, but the group never sees pay: the server cuts your calendar down to your share level before anyone else reads it.

Friends groups: who sees what

A Friends group is a shared calendar for your partner, family or crew. Members of a group see:

your display name, profile colour and role in the group
your calendar at the share level you choose for that group: Codes (which shift you have and your days off, no hours), Hours (also the shift's name and hours; the default) or Notes (also the notes you write on your days)
in the free-day finder, only whether you're free or working
the comments, reactions and swap requests posted in the group

Members never see your e-mail address, and pay is never shared with friends. When you leave a group, it stops seeing your calendar at once.

Report and block. You can report a comment (as spam, harassment, inappropriate or other). The report and a copy of the comment come to us; we review it and may remove the content or suspend the account behind it. We delete a report 90 days after handling it. You can also block a member: you no longer see their comments or get notifications about them. You both stay in the group, and you can unblock them at any time.

Teams: who sees what

A team is a workplace schedule that an organisation runs in the app: a planner makes the schedule, publishes it, and members see their shifts in their own calendar.

The owner and admins see members' e-mail addresses, schedules, requests, availability and the pay rules they manage.
Operators see and edit the schedule of the units they run, decide their requests and see those units' history.
Members see their own schedule, the names of the people in their units and, if the team allows it, their own pay.

A team never sees your personal calendar: only the shifts the team itself published for you. The team's data (its schedule, requests, announcements and pay rules) belongs to the organisation that runs the team, and it decides what the team contains. For that data we act on the organisation's behalf; questions about it are best sent to your team's owner first, and we will help where we can.

Services we use

These companies process data for us, each only for the purpose given:

Google Sign-In (Google, through Android's Credential Manager): if you choose Continue with Google, Google confirms who you are and gives us the account details listed above. Google Privacy Policy.
Firebase Cloud Messaging (Google): delivers notifications about comments, swaps, schedules and your team while you're signed in. The phone's notification token goes only to our server, and is removed when you sign out. The notification text, such as a friend's name and comment, passes through Google on its way to your phone. Firebase privacy.
Google Analytics for Firebase (Google): receives the anonymous usage statistics described under Anonymous usage statistics, unless you turn them off. Firebase privacy.
Google Play Billing (Google): takes payment for Premium and Team plans. We never receive your payment details. Google Privacy Policy.
RevenueCat (RevenueCat, Inc.): keeps track of purchases. It receives a random, anonymous app user ID, your purchase history for this app, basic device and app information and your IP address. While you're signed in, it also receives your account ID from us, so a purchase follows your account; a Team purchase also carries the team's ID. RevenueCat never receives your e-mail address or calendar. RevenueCat privacy policy.
E-mail delivery (Resend, Inc.): sends our e-mails, such as sign-up codes, password resets and invitations, on our behalf. It receives only the recipient address and the message. Resend privacy policy.
Hosting: TAYNET TEKNOLOJİ provides the server in Turkey that stores the data described above.
Backup storage (Cloudflare R2, Cloudflare, Inc.): keeps the copy of our nightly database backups for 30 days. Nobody at Cloudflare uses its content. Cloudflare privacy policy.

The app contains no advertising or crash-reporting SDKs. Its only analytics software is Google Analytics for Firebase, used only as described under Anonymous usage statistics.

International transfers

Our server is in Turkey. Google (including the usage statistics from Google Analytics for Firebase), RevenueCat, Resend and Cloudflare may process data in the United States and other countries. Where data goes from the EU, the UK or Turkey to such a country, it is protected by standard contractual clauses or another safeguard the law allows.

Permissions

The app asks for a permission only when you turn on the feature that needs it, and explains why first.

Permission	Used for
Notifications	The day-before reminder, the alarm notification, and notices from your Friends groups and team.
Receive push messages	Firebase Cloud Messaging, to receive those notices while you're signed in.
Calendar (read and write)	Syncing shifts to a calendar on your phone. The app lists your calendars so you can choose one, then adds, updates and removes only the shift events it created. It doesn't read or upload your other events.
Alarms and reminders	Ringing an alarm at the exact time before a shift.
Full-screen alerts, foreground service, wake lock, vibration	Showing a ringing alarm over the lock screen and keeping it ringing until you answer.
Run at startup	Setting your alarms again after the phone restarts.
Ignore battery optimisation	Offered on the Alarm reliability screen, so the system can't delay an alarm. Only asked for when you choose it.
Internet and network state	The update check, your account, cloud sync, Friends, Teams, purchases and the anonymous usage statistics.
Google Play billing	Buying Premium and Team plans.
Biometrics and fingerprint	Listed because Android's sign-in library (Credential Manager) declares them. Shift Calendar doesn't use them: it never asks for your fingerprint, face or screen lock.

If you sync shifts to a calendar that belongs to an online account, such as Google Calendar, that account's provider stores and syncs those events under its own privacy policy.

Some features make a copy of your schedule when you ask for one: sending your calendar to a partner as a file, exporting an iCal (.ics) file, or exporting a month as a PDF. The app hands that copy to the app you choose in Android's share sheet, such as a messenger or e-mail. These copies are not uploaded to us. What happens next depends on the app and the person you send it to.

Backups

Backup to a file. A backup is a JSON file saved where you choose, such as your phone's storage or a cloud drive you pick in the system file picker. We don't have access to it.

Android backup. If Android backup is on in your phone's settings, Android may include the app's calendar data and settings in your Google account backup, so they come back on a new phone. Google manages this backup, and you can turn it off in your phone's settings. Your sign-in session is never part of it.

Keeping and deleting your data

On the phone. Your data stays until you delete it. You can edit or remove shifts and shift types in the app, delete all of the app's data in Android's app settings under Storage › Clear storage, or uninstall the app. That doesn't remove backup files you saved, events already synced to another calendar, files you shared, or anything in your account.

Your account. You can delete it in the app: Settings › Account › Account and cloud sync › Delete account (at the bottom), then Continue, and confirm with your password (Delete my account) or with Confirm with Google. Or from the web, at shiftcal.quantix.studio/delete-account, where we e-mail you a link to confirm.

The account is switched off at once and every device is signed out. It is permanently deleted after 7 days, together with everything linked to it: your synced calendar, devices and notification tokens, codes, group memberships, comments, reactions, swaps, notifications, team memberships, schedules, requests, availability and personal pay rules.
A group you own passes to another member, or is deleted when nobody is left. If you own a team, hand it over or delete it first; the app asks you to. A team whose owner's account is deleted anyway passes to its earliest admin, or becomes read-only.
Database backups roll off within 30 days after that (14 days on our server, 30 days for the off-site copy).
We keep, without your account: purchase records and the events RevenueCat sent us (accounting and tax law), entries you made in a team's change log and announcements you posted in a team (they belong to the team's record), and our own admin log. E-mail log entries are deleted when they are 90 days old.
Signing in again doesn't cancel a deletion. To keep the account, write to support@quantix.studio within the 7 days.
The calendar on your phone is not touched. The usage-statistics data on the phone is reset (see Anonymous usage statistics).

Your rights

Under the EU and UK GDPR and Turkey's Personal Data Protection Law No. 6698 (KVKK), depending on where you live, you have the right to:

access your data and take it with you: in the app, Settings › Account › Account and cloud sync › Download my data saves a copy of what your account holds, or ask us
correct it: change your name in the account screen; for anything else, write to us
have it deleted, as described above
restrict or object to processing, for example processing based on our legitimate interests
complain to a data protection authority: in Turkey the Personal Data Protection Board (KVKK Kurulu); in the EU or UK, the authority where you live or work

Write to support@quantix.studio from your account's address. We answer within 30 days.

Legal bases

Performing our contract with you: your account, cloud sync, Friends groups, Teams, the e-mails and notifications they need, and providing what you bought.
Our legitimate interests: keeping the service secure and working (server logs, backups, the update check), handling abuse and reports, and understanding how the app is used so we can improve it (the anonymous usage statistics). You can object to the usage statistics at any time by turning off Anonymous usage statistics in Settings.
Legal obligations: keeping purchase records for accounting and tax.

Security

The app talks to our server only over HTTPS (TLS 1.2 or 1.3, with HSTS); unencrypted connections are refused.
Your sign-in session on the phone is encrypted with a key kept in the Android Keystore, and is excluded from backups.
Passwords are stored only as argon2id hashes.
The calendar on your phone is protected by Android's own storage encryption; the app doesn't add its own.

Children

The app is a work-planning tool and is not directed at children under 16. We don't knowingly collect personal data from them. If you believe a child under 16 has created an account, write to us and we will delete it.

Changes to this policy

If the app starts handling data differently, we will update this page and change the effective date above. For significant changes, we will also tell you in the app or in the Google Play release notes.

Contact

Eren Talan, developer of Shift Calendar: Work Planner. Questions or requests about privacy: support@quantix.studio