This Privacy Policy explains how Handoff Shifts LLC("Handoff Shifts," "we," "us") handles information when you use the Handoff Shifts mobile app, website, and related services (the "Service"). Handoff Shifts is a workplace operations platform that employers (restaurant operators and their organizations) provide to their employees. This policy is written for both: the employers who administer accounts and the employees who use the Service day-to-day.
1. Our role and your employer's role
Handoff Shifts is provided to employers under a separate agreement with each employer. When you use the Service as an employee, your employer decides what features are enabled, what information is entered about you, and how long records are kept. Your employer is the "data controller" for that information, and Handoff Shifts acts as their "processor" — we handle data on their instructions.
If you have questions about why specific information was entered about you, how long it is retained, or want a copy or deletion, the fastest path is usually to ask your employer first. You can also write to us at privacy@handoffshifts.com and we will route your request appropriately.
2. Information we collect
Account information
When your employer adds you to the Service, we receive your name, email address, and role, and — if you or your employer provide one — a phone number we use to contact you about your work, such as shift coordination. When you sign in, our authentication provider (Clerk) collects a password or sign-in code, optional multi-factor authentication factors, and (if you provide one) a profile photo. Clerk also records sign-in events for security purposes.
Work and operational information
Depending on which features your employer uses, the Service stores information about your work, including: position assignments, schedules, completed checklists, training records and certifications, recognition and coaching notes, writeups, shift notes, food and warehouse orders, and related operational records.
Content you create
The Service includes features for posting shift notes, completing checklists, and uploading photos (for example, store-item images or checklist evidence). We store this content so it can be displayed to authorized members of your workplace.
Device and notification information
If you install our mobile app and grant notification permission, your device provides us with a push notification token from Apple Push Notification service (APNs) or Google's Firebase Cloud Messaging (FCM). We use this token only to deliver the notifications you have opted into. We do not collect your contacts or location.
Cookies and session information
The Service uses cookies and similar storage to keep you signed in and to remember your preferences. Authentication cookies are set by Clerk; we do not use third-party advertising cookies or web tracking pixels.
Usage and performance information
We use Vercel's first-party analytics and performance tools (Vercel Web Analytics and Speed Insights) to understand aggregate usage and to monitor the performance of the Service. These tools collect limited, privacy-preserving information such as page views, referring pages, general device and browser type, and page-load and performance timings. They are cookieless, do not track you across other apps or websites, and are not used for advertising.
Categories of personal information (California)
Under California law, the categories of personal information we process are: identifiers (name, email, phone number, account ID, push token); professional or employment-related information (role, schedules, assignments, training and certification records, recognition and coaching notes, writeups, shift notes, orders, and related operational records); visual information (profile photo and photos you upload); internet or other electronic activity (aggregate, cookieless usage and performance data); and authentication data (sign-in credentials and security events held by our provider). We collect these to provide and secure the Service for you and your employer as described in Section 4. We do not collect sensitive personal information to infer characteristics about you, we do not sell personal information, and we do not share it for cross-context behavioral advertising.
3. Information we do not collect
To be explicit, because the major app stores ask:
- We do not collect your precise or coarse location (no GPS or network-based location).
- We do not stream, record, or monitor your camera or microphone in the background. Where a feature lets you add a photo, you may either choose an existing file or take a new photo through your device's standard system camera prompt — we receive only the image you choose to submit.
- We do not collect payment, credit-card, or other financial information from individual users.
- We do not collect health, medical, biometric, or sensitive demographic information.
- We do not use third-party advertising networks or cross-app behavioral tracking. Aside from Vercel's cookieless first-party analytics and performance monitoring described above, we do not use advertising or behavioral-tracking SDKs (such as Google Analytics, Meta, Mixpanel, Segment, Amplitude, or PostHog).
- We do not sell your information. We do not share information for cross-context behavioral advertising.
4. How we use information
- To provide the Service to you and your employer — display schedules, deliver notifications, run checklists, and so on.
- To send transactional emails (sign-in codes, password resets, notification alerts your employer configures).
- To produce weekly operational summaries for your employer. These summaries are generated by an AI service (Anthropic's Claude API) using aggregated operational data and may reference employee names where the underlying records include them.
- To secure the Service — detect abuse, troubleshoot errors, and protect accounts.
- To comply with legal obligations and enforce our terms.
5. Service providers
We rely on a small set of third-party services to operate the platform. Each receives only the data needed for its specific function:
- Clerk — user authentication, sign-in security, and identity management.
- Neon — managed PostgreSQL database (hosted on Amazon Web Services). Stores the operational records described above.
- Vercel — application hosting, file storage (Vercel Blob) for uploaded images, and cookieless first-party usage analytics and performance monitoring (Web Analytics and Speed Insights).
- Resend — sending transactional email (sign-in codes, notification digests).
- Anthropic — AI weekly operational summaries. We do not use this service to make decisions about individual employees.
- Firebase Cloud Messaging (Google) — push notification delivery to Android devices. Receives the FCM token and the notification payload only.
- Apple Push Notification service — push notification delivery to iOS devices. Receives the APNs token and the notification payload only.
These providers are contractually required to use information only as instructed by us. We do not authorize them to sell information or use it for their own marketing.
6. Children and minors
Handoff Shifts is a workplace tool, not a consumer app, and it is not directed to children under 13. We do not knowingly accept registrations or collect information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a worker under 13 has been added to the Service, contact us at privacy@handoffshifts.com and we will remove the account and associated information.
We recognize that some employees are minors aged 13 to 17, since federal and state child-labor laws allow some workers as young as 14 to be employed in restaurant settings with restrictions. Where applicable law requires parental or guardian consent before a minor's personal information is collected, the employer is responsible for obtaining and documenting that consent before adding the minor to the Service. A parent or guardian may contact us at privacy@handoffshifts.com to request access to or deletion of a minor's information on the Service.
7. Data retention
We retain personal information for as long as your account is active and for a reasonable period afterward to support your employer's record-keeping and to satisfy legal, tax, audit, and dispute-resolution obligations. Push notification tokens are deleted when they become invalid or when you uninstall the app. Aggregated and de-identified information may be retained for longer to support analytics about the Service itself.
8. Your rights
You can ask us to access, correct, delete, or export your personal information by writing to privacy@handoffshifts.com. Because Handoff Shifts holds most employee information on behalf of an employer, we will forward applicable requests to your employer and follow their instructions consistent with law. We do not sell personal information or share it for cross-context behavioral advertising.
If you are a California resident, you have the right to know the categories and specific pieces of personal information we hold about you, to request deletion or correction, to request a portable copy, and to designate an authorized agent to make a request on your behalf. We do not sell or share personal information, so there is nothing to opt out of, and we will not discriminate or retaliate against you for exercising any of these rights. We will take reasonable steps to verify your identity before fulfilling a request and will respond within the timeframe required by applicable law.
9. Security
We protect information using industry-standard practices: HTTPS for all network traffic, encrypted database backups, scoped access controls, and security review of third-party providers. No system is perfectly secure, but if we become aware of a breach that affects you, we will notify your employer and, where required, you directly.
10. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, for significant changes, notify you through the Service or by email.
11. Contact us
For any privacy question, request, or concern, write to us at privacy@handoffshifts.com.