# Privacy Policy — ShiftOps

Last updated: 2026-07-25

ShiftOps is an internal operations tool for restaurant/facility staff — daily
and weekly checklists, vendor ordering, staffing schedules, and performance
scoring. It is not customer-facing and does not process consumer data. This
document covers the personal data of the staff (managers, supervisors, and
employees) who use it.

## What we collect

- **Account data:** full name, assigned role (manager/supervisor/staff),
  facility assignment, and a login credential — either a PIN or a password,
  both stored using bcrypt hashing (never in plain text), plus an optional
  passkey (WebAuthn) credential for hardware-backed login.
- **Work activity:** checklist completions, task photos (food-safety checks,
  bug reports, delivery receiving), vendor order history, schedule and
  staffing records, and performance/scoring history tied to your account.
- **Device data (optional):** if you enable push notifications, your
  browser's push subscription endpoint is stored so the server can deliver
  alerts to that device.

We do not collect payment card numbers, government ID numbers, or any data
from anyone outside the staff using this system.

## How data is stored

Production data lives in a PostgreSQL database on a private server. Login
credentials are bcrypt-hashed. Task/bug-report photos are stored on the
server's private upload volume, not a public bucket, and served only to
authenticated users.

## Who we share data with

We do not sell or share staff data for advertising or any purpose unrelated
to running this system. Two optional, admin-configured integrations can send
limited data to outside services:

- **Order emails (Gmail SMTP).** If a manager configures the order-email
  feature, placing a vendor order sends an email — via the business's own
  Gmail account, using an app password — to the vendor's order-receiving
  address, optionally copying an internal manager distribution list. The
  email contains order line items and quantities; it does not include staff
  PINs, passwords, or scoring data. Sending is entirely optional: leaving the
  SMTP settings unset disables it.
- **Error monitoring (Sentry).** If enabled by an administrator (via a
  `SENTRY_DSN` setting), application errors are reported to Sentry to help
  diagnose bugs. This is configured to exclude cookies, request headers,
  request bodies, query strings, and IP addresses — only an internal account
  ID (not your name, email, or any other identifying detail) is attached to
  an error report. Disabled entirely if no `SENTRY_DSN` is configured, and
  always disabled in the test environment.
- **Checklist record archive (Gmail SMTP).** If an administrator configures
  `CHECKLIST_ARCHIVE_RECIPIENT`, every completed checklist is emailed as a
  PDF — via the same business Gmail account the order-email feature uses —
  to that configured address, once as a one-time historical backfill and
  ongoing daily afterward. Each PDF is the same record already visible to
  anyone with in-app access to that checklist: task results and readings,
  and the names of whoever completed, signed off on, or reviewed it. It does
  not include PINs, passwords, or photo evidence. Disabled unless an
  administrator sets a recipient.

Staff data is shared only through the integrations named above, each
optional and admin-configured — no other third-party service receives it.

## Retention and deletion

Work records (checklists, orders, scoring history) are retained as part of
the operational record for as long as the facility uses this system. A
manager can deactivate a departed staff member's account, which blocks login
immediately. Full deletion of an individual's account data is currently a
manual, administrative process rather than a self-service request — contact
a manager to request it.

## Questions

Direct any question about this policy, or a data access/deletion request, to
your facility manager.