1. Scope & Age Requirement

This Policy describes how we handle information when you install, use, or contact us in connection with the Shift Show Android app and the website at shiftshow.app. It applies worldwide and is intended to meet our obligations under the South African Protection of Personal Information Act (POPIA), the EU and UK General Data Protection Regulations (GDPR / UK-GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), and other applicable data protection laws.

Shift Show is intended solely for users aged 18 and over, consistent with our Terms of Use. The app is not directed at, marketed to, or intended for use by children, and we do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently processed data (such as crash diagnostics or advertising identifiers) from a user under 18, we will take reasonable steps to delete it; you can request this at any time via support@shiftshow.app.

2. Information We Do Not Collect

• We do not require an account, name, email address, phone number, date of birth, or any other identifier to use the app.
• We do not collect, transmit, or have access to your shifts, tasks, events, leave entries, overtime entries, alarms, custom holidays, HR report settings (employee name, staff number, company name, shift times, counting rules), or any other in-app content. All of that data stays on your device unless you choose to back it up to your own Google Drive or share it manually.
• We do not sell, rent, trade, or otherwise share your personal information for monetary or other valuable consideration. For CCPA purposes: we do not "sell" personal information. The use of advertising identifiers by AdMob may qualify as "sharing for cross-context behavioural advertising" under CCPA — see Section 4 for how to opt out.

3. Information We Do Collect or Process

• Crash and diagnostic data (Firebase Crashlytics, operated by Google): when the app crashes, pseudonymous technical information is collected — device model, operating system version, app version, crash stack trace, and a randomly-generated installation identifier. This identifier is not directly tied to your name or contact details, but it is not fully anonymous either, since it can distinguish one installation from another. No personal content from the app is included. Lawful basis: legitimate interests in maintaining and improving app stability (GDPR Art. 6(1)(f)).
• Advertising data (Google AdMob): We use Google AdMob to display advertisements. Google may process device and advertising-related information, such as device type, app version, advertising identifier (AAID), and language, to deliver and measure advertisements. If you are in the European Economic Area, the United Kingdom, or Switzerland, the app automatically requests only non-personalised ads for you — Google does not build an advertising profile of you or use your advertising identifier for ad targeting. Outside those regions, ads may be personalised. Lawful basis: legitimate interests in showing and measuring advertising that supports the free provision of the app (GDPR Art. 6(1)(f)). We do not rely on consent for ad personalisation, because the app does not personalise ads for users in the EEA, UK, or Switzerland in the first place. For more information about how Google uses data for advertising, please see Google's Privacy Policy and Google's advertising information.
• Approximate location: As part of serving and measuring advertisements, Google AdMob derives your approximate (coarse) location from your device's IP address. We do not separately collect precise GPS location, and the app does not request device location permissions for its own scheduling features. This matches the "Approximate location" category disclosed in the app's Google Play Data Safety section.
• App activity: Google AdMob records ad-interaction events (such as ad views and clicks) for delivery, measurement, and fraud prevention. We do not track or receive analytics on how you use the scheduling features themselves (e.g. which shifts, reports, or settings you use) — this category only covers ad interactions. This matches the "App interactions" category disclosed in the app's Google Play Data Safety section.
• Support communications: if you email us at support@shiftshow.app, your email address and the content of your message are stored on our support inbox infrastructure (hosted by reputable third-party email/cloud providers acting as our processors under written agreements) for the purpose of responding to you and keeping a record. Lawful basis: legitimate interests in providing user support, or your consent where you have initiated the contact.
• Google Play data: when you install or update the app, Google Play processes information under Google's Privacy Policy. We receive only aggregated, anonymised install/uninstall statistics through the Google Play Console.
• Optional Google Drive backups: if you choose the app's "Backup to Google Drive" feature, the app creates a backup file on your device and opens the Google Drive app so that you can upload it to your own Google Drive account. We do not use the Google Drive API or Google's app-data scope for this feature, we do not store this data on our servers, cannot read other files in your Drive, and cannot access these backups ourselves.

4. Advertising & Your Choices

• Ads are served by Google AdMob. For more on how Google handles advertising data, see Google's advertising information.
• If you are in the EEA, UK, or Switzerland: the app automatically requests non-personalised ads for you. This happens automatically based on your device's region — there is no in-app consent dialog (such as Google's User Messaging Platform) to interact with, because the app does not attempt to personalise ads for you in the first place.
• Everywhere else: ads may be personalised using your advertising identifier and Google's usual ad-targeting signals. You can control this through your device and Google account settings — see below.
• You can reset or limit your Android advertising identifier at any time: Android Settings → Privacy → Ads (path may vary by device).
• To opt out of personalised ads across Google services: https://adssettings.google.com.
• California residents can opt out of "sharing for cross-context behavioural advertising" by enabling Limit Ad Tracking or resetting the advertising ID on the device, and via Google's Ad Settings linked above.

5. Data Storage, Location & International Transfers

• Your in-app data is stored locally on your device only.
• Crash diagnostics (Firebase) and advertising data (AdMob) are processed by Google LLC, which may store and process information in the United States and other countries. Transfers from the EEA, UK, and Switzerland to Google rely on Google's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Details: Google's Privacy Policy.
• Support email content is stored on our support-inbox provider's infrastructure, which may be located outside South Africa. We use providers that offer appropriate safeguards.

6. Data Retention

• In-app data: retained on your device until you delete it (Settings → Clear Data) or uninstall the app. We have no copy.
• Firebase Crashlytics: retention is controlled by Google (typically 90 days for crash reports; see Google's Firebase data retention policy).
• Google AdMob: retention is controlled by Google (typically up to 14 months for measurement data).
• Support emails: retained for as long as reasonably necessary to handle your enquiry and our records (typically up to 24 months), or longer if required by law.

7. Security

We apply reasonable technical and organisational measures to protect the limited data we process (encrypted transport, access controls on our support inbox, reputable third-party processors). No internet transmission or electronic storage can be guaranteed 100% secure. You are responsible for the security of your device and any backups you create.

8. Your Rights

Subject to applicable law, you have the following rights regarding the limited personal data we process (crash diagnostics, ad identifiers, support emails). We do not have access to your in-app schedule data, so most rights below relate to support emails and crash diagnostics and ad data held by our third-party processors.

• POPIA (South Africa): rights of access, correction, objection, and complaint to the Information Regulator (inforegulator.org.za).
• GDPR / UK-GDPR (EEA, UK): rights of access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent (without affecting prior processing), and lodging a complaint with your local supervisory authority.
• CCPA/CPRA (California): rights to know, delete, correct, opt out of sale/sharing, and non-discrimination.
• Other jurisdictions: equivalent rights as granted by applicable law.

To exercise any right, email support@shiftshow.app. We will respond within the time period required by applicable law. We may request information to verify your identity. You can delete all locally-stored app data at any time using Settings → Clear Data inside the app.

9. Third-Party Services & Links

The app uses the following third-party services. Their privacy practices are governed by their own policies:

• Google AdMob — policies.google.com/privacy
• Firebase Crashlytics (Google) — firebase.google.com/support/privacy
• Google Drive (optional, for your backups) — policies.google.com/privacy
• Google Play — policies.google.com/privacy

Advertisements may link to third-party websites. We are not responsible for the content, accuracy, or privacy practices of those sites.

10. Business Email Compromise

While we apply reasonable security measures to support communications, email is inherently susceptible to phishing, spoofing, and Business Email Compromise (BEC). Always verify unexpected or sensitive requests through a separate channel. No electronic communication can be guaranteed completely secure.

11. App Testers

Participation in the application's testing program (including closed testing and any other form of beta testing) is entirely voluntary. App testers may withdraw from the testing program at any time and may request that their email address be removed from the registered tester list by contacting us.

In accordance with Google's requirements for developers, we collect and register the email addresses of app testers in order to grant early access to applicable testing programs, including closed testing. Email addresses collected for this purpose are used solely to register testers and administer access to the test version of the application.

Participation in the testing program does not constitute employment, a contractual relationship, or any other form of paid engagement with Shift Show. App testers are not entitled to and will not receive payment, compensation, rewards, or other benefits in connection with their participation. Access to the test version of the application is provided free of charge and on an "as-is" basis, without warranties of any kind.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date will be revised, and the current version will be available at https://shiftshow.app/privacy.html. Material changes will be notified via the app or this page.

13. Contact

For privacy questions, requests, or complaints, contact us at support@shiftshow.app