ShiftSum

Privacy policy

Effective 18 October 2026

ShiftSum is run by Dr Omar Kirresh, Jerusalem, Israel. This policy covers the ShiftSum app and website at shiftsum.app and the ShiftSum app for Android. Write to hello@shiftsum.app about anything in it.

The short version: we keep what the app needs to work for you; nobody else gets it except the services that run it; there are no ads, no tracking and no selling; and you can export or delete everything yourself, at any time.

1. What we keep

Your account. Your email address and a password (we hold only a hash of it, through our sign-in provider). If you sign in with Google or Apple: the name, email address and account identifier they pass us (Apple may pass a relay address rather than your own). Your two-step sign-in secret, if you turn it on. When your account was signed into, with scrambled fingerprints of the network and the device (not the addresses themselves), kept about 13 months and used only to warn you about a sign-in that looks unusual.

Your details. Your name; the language, country, currency and week start you choose; and, if you invoice, your business number, address, bank details for payment and your logo.

Your work. Your workplaces and clients (names, numbers, addresses, rates and pay rules); your shifts and days off; your events, to-dos and the photos you attach to them; your notes; the figures from payslips you check (never the payslip picture, which isn't kept); your expenses and receipt pictures; the documents you issue (invoices, receipts, hours reports, the accountant's pack) and records of where they were sent.

Rotas you send in. A rota you photograph or upload is read and the result shown to you to check; the picture or file isn't kept once it's read. An email you forward to your ShiftSum rota address is kept (sender, subject, text and attachment) until you've used or dismissed it, then removed.

Connections you choose. Your Tax Authority connection and your document-signing key, both encrypted with a key held only on our server; the address your phone's notification service gives us for reminders; a token for the Android widgets; the private link for your own calendar feed. A calendar you add to ShiftSum by link stays on your device: the link never reaches our database or a backup, and our server fetches that calendar only when your device asks, keeping nothing.

Usage counts. How many AI readings your account made this month, to keep every account within fair use. Free readings are also counted against scrambled codes made from your email address, the network the reading came from and your email's domain (not the address itself). Those codes stay when an account is deleted, so the free readings can't be had again by making the account again; nothing in them identifies you.

Technical records. Our server keeps short-lived records of errors and of its scheduled jobs (what ran, when, whether it worked), never the contents of your data. When something fails we may receive an error report with technical details.

Feedback you send. If you send feedback from the app, it reaches us by email: your answer, your stars and words, your email address (so we can reply), the app's version, its language and the kind of screen. It stays in our inbox and isn't added to your account.

2. What we don't do

No advertising. No selling, renting or sharing your data for anyone else's purposes. No analytics or tracking services, and no tracking across other apps or sites. No training of AI models on your data, by us or by the AI provider. We don't look at your data except to fix a problem you ask us to look at, or where the law requires.

3. Who else handles it, and why

Each of these handles your data only to do the job named, under its own contract with us:

No one else. If a new provider ever handles your data, this page will say so before it does.

Where. Your data is kept in Frankfurt, in the EU. Israel has an EU adequacy decision, so data moving between the EU and Israel needs no further safeguard; where a provider processes data elsewhere, we rely on its standard contractual clauses.

4. What you share yourself

A document link, a shared picture of your day or week, your calendar feed link and your rota email address work for anyone who holds them. Share them with care. You can replace your calendar feed link and your rota address in Me.

Speaking instead of typing. The mic uses your phone's or browser's own speech recognition (Google's in Chrome and on Android, Apple's in Safari and on iPhone, Microsoft's in Edge). That company turns what you say into text under its own terms; ShiftSum receives only the text, never the audio, and keeps no recording.

5. Your rights

We answer within 30 days, and never charge for any of this.

For readers in the EU and the UK, the legal bases are: providing the service you asked for (contract); keeping it secure and fair, including the usage counts and sign-in records (legitimate interests); the reminders, connections and sign-in providers you choose (consent, which you can withdraw in the app); and legal obligations we may have.

For readers in California: we don't sell or share personal information as the CCPA defines those words, and we don't use it for targeted advertising.

6. How long we keep it

Until you delete it, or delete your account, except: sign-in records (about 13 months); forwarded rota emails (until used or dismissed); server records (days); and the scrambled free-reading codes, which stay as explained above. Database backups kept by our provider expire on their own after a short period.

7. Security

Everything travels encrypted and is stored encrypted at rest. Each account can read only its own rows: the database enforces that on every query. Your Tax Authority connection and signing key are encrypted again with a key only our server holds. Two-step sign-in is in Me. No system is perfect; if we learn of a breach that affects you, we'll tell you.

8. Children

ShiftSum is for working adults. It isn't meant for anyone under 16, and we don't knowingly keep their data.

9. Changes, and which text applies

If this policy changes in a way that matters, the app will say so before the change applies; the date at the top is the current version. This policy is written in English. The Hebrew and Arabic texts are translations for your convenience, and the English applies if they differ.

Terms of useRefund policyContactBack to ShiftSum