Privacy Policy.

Who is responsible

MarEwe (ShiftSheet) is responsible for the ShiftSheet website and app. For privacy questions or requests, email shiftsheet@icloud.com. A postal address is available on request.

This policy covers both this public marketing website and the separate ShiftSheet app. The marketing website does not hold your timesheet records.

The website

This site introduces ShiftSheet and links to the app. It has a contact form but no account sign-up. It does not collect your timesheets, holiday entries or app profile details.

What happens when you visit

• Page delivery. Your browser sends technical request information, such as IP address, browser details and requested page, to the website hosting service. This is necessary to deliver and protect the site. Our lawful basis, where UK GDPR applies, is our legitimate interest in running a secure, accessible website.
• Messages you send. If you submit the contact form, we collect your name, email, subject and message and store the submission privately so we can respond. We also use a one-way fingerprint of the request's IP address to limit spam submissions. Each submission is also sent by email through our email service provider's mail servers from our website mailbox to ShiftSheet's contact mailbox, with your email address set as the reply address so we can answer you. When you email us, we use your address and message to handle your enquiry or privacy request. Our lawful basis is our legitimate interest in responding and protecting the form from abuse; where required, we also process requests to comply with legal obligations. Please avoid including sensitive employment details unless necessary.
• Google Fonts. The site loads fonts from Google. Your browser connects to Google to request them, which may expose technical request information, including your IP address. We use these fonts for the presentation of the website under our legitimate interest in operating the site.

Cookies and analytics

This website does not implement analytics, advertising or marketing cookies. The contact form sends your details to our private website storage and to ShiftSheet's contact mailbox by email, not to the separate ShiftSheet app. Third-party services may handle technical request data under their own terms; this is separate from any tracking implemented by ShiftSheet.

The ShiftSheet app

The app works offline by default. Information you enter stays on your device unless you choose Cloud Backup, share a PDF or use the bank holiday lookup. The app is intended for people in employment and is not aimed at children.

Records on your device

Local information may include your first and last name, employee number, working pattern, timesheet entries, supervisor signature images, holiday entries and entitlement settings, and app preferences. You enter and use these details to keep your own working-time and holiday records. ShiftSheet does not receive this locally stored information simply because you use the app.

Optional Cloud Backup

If you choose Cloud Backup, you create an account. Your email address and password are processed through the authentication service; passwords are stored as hashes. One private backup record holds a copy of your local app data so you can restore it on the same or another device. Database access to that backup is restricted to the account that created it. The lawful basis for processing Cloud Backup account and backup data is performance of our contract with you: providing the backup and restore feature you requested. You do not need Cloud Backup to keep local records.

Bank holidays and PDFs

When you use the UK bank holiday lookup, the app fetches public holiday dates from GOV.UK. No account details or timesheet data are sent to GOV.UK; ordinary web-request information, such as your IP address, may be visible to it. This lookup supports the holiday feature as requested by you.

PDFs are generated locally. If you share or email a PDF, your device's share sheet and your chosen email or sharing provider handle that transfer. ShiftSheet does not receive a copy through this action. Choose recipients with care, especially when a PDF contains working-time or signature information.

The app does not use advertising, analytics, tracking or marketing cookies, or sell or share user data for those purposes. It does not carry out profiling or automated decisions with legal or similarly significant effects.

Sharing & transfers

Supabase provides the authentication and database services for optional Cloud Backup. It processes account and backup data to provide that feature. The website uses a hosting service and Google Fonts to deliver pages and typefaces. Email you send passes through email providers; a PDF you choose to share passes through the device and sharing service you select. GOV.UK is a public source of bank-holiday dates, not a processor of ShiftSheet account or timesheet data.

Cloud Backup information may be stored or processed outside the UK. We do not assume that it stays in the UK. Where UK law requires safeguards for an international transfer, appropriate transfer arrangements must be in place.

Transfer safeguard to confirm: The exact safeguard applicable to the current Supabase arrangement has not been verified. Please contact us for the current transfer details.

How long data is kept

Local records stay on your device until you delete or reset them or uninstall the app. Cloud Backup remains until it is overwritten or you delete your account. Deleting the Cloud Backup account removes the account and its cloud backup; routine infrastructure backups may retain a copy for a short period before expiry.

Website request data, contact form submissions and email correspondence are kept only as long as needed for site operation, security, responding to enquiries or legal obligations, as applicable. No fixed periods are stated here where they have not been established.

Your rights & choices

In the app, you can edit your entries, export your data through Settings → Data → Export Backup, reset local data, and delete your Cloud Backup account from Settings. Removing an account does not itself erase data still held locally on a device; use the local reset controls for that.

Depending on the circumstances, UK data protection law may give you rights to access, correct or erase personal data we hold, restrict or object to its processing, and receive or transfer your data. If processing relies on consent, you may withdraw it; withdrawal does not affect earlier lawful processing. These rights are not absolute, and we may need to verify your identity. To make a request, email us using the address below.

Contact & complaints

For privacy questions or data requests concerning either the website or app, email shiftsheet@icloud.com. A postal address is available on request. You can also visit our contact page.

If you are unhappy with how your data is handled, you have the right to complain to the UK Information Commissioner's Office (ICO). Visit ico.org.uk/make-a-complaint/. We would welcome the chance to address your concern first.