Privacy policy

This website

shiftwallet.app is a set of plain pages. The fonts and images come from the site itself, there are no ads and no social media buttons, and the calculators work out everything in your browser. What you type into them isn't saved and isn't sent anywhere, not to Google Analytics either.

Cookies and Google Analytics

To see which pages actually help people, the site uses Google Analytics 4, a Google service. In Europe it only runs if you allow it, and anywhere else you can switch it off:

• If your device is set to a European time zone, or to UTC, Google Analytics doesn't load until you press Accept on the cookie banner. If you press Reject, or don't answer, it never loads.
• Anywhere else it loads with the page. If you press Reject, the site deletes the Google Analytics cookies, for the rest of that page Google Analytics only sends data without cookies, and from the next page on it doesn't load at all. As a second safeguard, if Google sees the visit coming from the European Economic Area, the United Kingdom or Switzerland, it sets no cookies until you accept and counts the visit without them.

When it runs, Google Analytics sets two cookies for shiftwallet.app, _ga and _ga_B4CRPN851K, which last 13 months from your last visit. They let it tell one visit from another and a new visitor from one who comes back. With them it records the pages you open, the page you came from, whether you scroll to the end of a page, the links that take you off the site and taps on the App Store buttons, plus your browser, your type of device and a rough location (country and city) that Google works out from your IP address. Google says Analytics doesn't store the IP address itself. This site never passes on your name or email, since there's nowhere on it to type them. The advertising features are off: no ad cookies, no ad personalisation and no Google Signals. Google Analytics keeps the detailed data for 14 months and then deletes it, and Google may process it outside the EU, including in the United States.

Your choice is saved in your browser's local storage (sw_consent, with the date), not in a cookie, and it isn't sent anywhere. It lasts 12 months, then the banner asks again. To change it, open Cookie settings at the bottom of any page. If you reject after accepting, the site deletes the _ga cookies Google Analytics had set, and from then on it works as after a Reject above: data without cookies for the rest of that page, and no Google Analytics from the next page on. In the EU and the UK the legal basis is your consent (Article 6(1)(a) of the GDPR and of the UK GDPR). What Google does with the data is in the Google Privacy Policy and in how Google uses information from sites that use its services.

Download buttons and the server log

Like any web server, the one that hosts this site (Banahosting) writes each request to a log: the IP address, the page, the time and the browser. Those logs are there for security, to fix errors and to count visits, not to follow anyone.

The App Store buttons first go to shiftwallet.app/go/app-store/, which sends you straight on to Apple. That request goes into the same log as any other, with a code for the page the button was on, so I can count which pages send people to the App Store without any cookies. On the App Store, Apple's privacy policy applies. The site is written by Jan Daniel Naftanaila. You can reach me at jan@digitalnafta.com.

The ShiftWallet app

The rest of this page is the app's privacy policy. It was last updated on 25 October 2026 and applies to ShiftWallet 2.2 and later. In it, "we" means Digital Nafta Portal FZCO, the company that operates the app.

• Company: Digital Nafta Portal FZCO
• Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE
• Licence: IFZA/DIEZ License 78656
• Contact: jan@digitalnafta.com

In short: pay calculations run on your device. Your work data is backed up to our cloud on Google Firebase, even if you never create an account. If you use the AI features, the paycheck or roster photo you choose, and for a paycheck the shifts of that pay period, are sent to OpenAI through our secure relay, which does not store them. OpenAI may keep them for up to 30 days to detect abuse and does not use them to train its models. If you import your roster from a calendar, the App reads the calendars you pick on your device and does not upload them. We use analytics and crash reports to improve the App. We do not show ads and we do not sell your data.

1. Information we collect

Account and authentication data

When you open the App for the first time, it creates an anonymous account with Firebase Authentication. This account is a random user ID with no name or email, and it lets the App back up your data before you sign in. If you create an account, we collect your email address, the identifier of your sign-in provider and, if you type one or your Apple ID or Google account provides it, your name. When you sign in, your anonymous account is linked to your new account so your data carries over. We do not store your passwords directly. If you use Sign in with Apple, we also keep the token Apple issues so we can revoke it when you delete your account.

Work data

The App lets you log jobs, shifts, hours, earnings and paycheck details. This data is stored on your device using SwiftData and is backed up and synced to Firebase Firestore under your user ID, whether you use an anonymous account or a signed-in account. It includes:

• Jobs: name, hourly rate and rate history, currency, country, overtime, night, holiday and pay rules, allowances, work schedule and scheduled breaks, pay schedule and pay calendar, time off allowance, mileage settings, and, if you set them, the job icon photo, the workplace location and radius, and the Wi-Fi network name used for automatic clock-in
• Shifts: start and end times, breaks, rates, calculated earnings, whether and when you marked them as paid and the amount you received, trips you log with a shift (distance and purpose) and, if you have granted location permission, the location where you clocked in
• The change history of each shift: when it was added, changed or deleted, what changed, how it was entered (for example by hand, with the clock button, from a roster or with Siri) and a short description of the device, such as "iPhone, iOS 26.5" plus a random tag for that installation. The App uses this history for the proof of hours you can export
• Days off: their date, type, hours and pay
• Paychecks you verify: pay period, amounts received and calculated, the difference, the breakdown and your notes
• Tips, bonuses, holidays and your app preferences (for example currency, formats and notification settings)

Some things stay on your device only and are not synced: the planned shifts you import from a roster (until you log them as worked shifts), and the payslip details you enter for the German take-home estimate (tax class, children, church membership, state and age group).

The on-device database is also included in your device backups (iCloud or computer), which Apple stores and protects under your Apple Account.

Live Activities

While a shift is running with a Live Activity on your Lock Screen, the App stores a push token for that Live Activity together with the shift start time, your earnings so far, the earnings rate, the currency and the break status in Firestore. A Cloud Function uses them to advance the earnings shown on your Lock Screen through Apple Push Notification service. This record is removed when the shift ends.

Location data (optional)

ShiftWallet offers an optional geofencing feature that can remind you to clock in or out when you arrive at or leave a workplace you added, or clock you in and out automatically if you turn that on for the job. Location is read with iOS Core Location and is only used when you explicitly grant permission. If you have granted location permission, the App also records the location where you clock in, whether you use the clock-in button or an automatic clock in. The workplace location you set and these clock-in locations are saved with your work data and synced to Firestore like the rest of it. When you export a proof of hours, clock-in places are only included if you switch that option on (it is off by default), and the file goes only where you choose to share it. You can revoke location access at any time in your device Settings. We do not share location data with third parties.

Calendar data (optional)

The App accesses your iOS Calendar through EventKit for two optional features, and only with your explicit permission:

• Importing your roster: if you import shifts from a calendar, the App reads the events of the calendars you pick, for the dates you choose, on your device. You see them in a preview and only the shifts you confirm are saved. The App does not change those calendars and does not upload them.
• Syncing your shifts to a calendar: if you turn it on, the App creates, updates or removes shift events in the calendar you choose. To avoid duplicates, it looks at the events around a shift's time to find the ones it created. If you pick a shared calendar, everyone who can see it also sees these events and the earnings in them.

We do not store or upload your calendar entries. Only the shifts you import or log become part of your work data.

Purchase and subscription data

ShiftWallet uses RevenueCat to validate purchases, restore access and display subscription offers. We send RevenueCat your purchase receipts or transaction information, product identifiers, subscription, trial and entitlement status, and a pseudonymous app user identifier. This identifier is a random value stored on your device. It may persist after sign-out or reinstallation, and it is the same identifier we use for analytics and attach to App Store purchases (as the purchase account token). RevenueCat also processes technical information such as app and operating-system versions and the offers you view in the App. From ShiftWallet 2.5 we also give RevenueCat the identifier that Google Analytics for Firebase generates for your app installation, so that RevenueCat can record your subscription events (for example the start of a trial, a renewal, a cancellation, a refund or a billing problem) in our Google Analytics under the same pseudonymous identifier, and a label that says whether the App was installed from the App Store, from TestFlight or on a test device. If you installed the App from an Apple Ads campaign, RevenueCat also receives the Apple Ads attribution token from Apple's AdServices framework and uses it to look up the campaign details described under Analytics data. We do not send your shift records, paycheck or roster images, or Apple Account password to RevenueCat. Apple processes payments, and we do not receive your full payment-card details.

Analytics data

We use Google Analytics for Firebase to understand how the App is used and to fix problems in the user journey. Analytics events are associated with the pseudonymous app user identifier described above and with identifiers that Firebase generates for your app installation and the identifier for vendor (IDFV) that iOS assigns to our apps on your device, not with your name or email. They include in-app actions (for example creating a job, logging a shift with its duration and its minutes of night work, overtime and breaks, verifying a paycheck, viewing an offer or buying), your onboarding answers, approximate settings such as app language, work country, currency, Pro status and broad ranges of hourly rate or paycheck difference, purchase details (product, price and transaction ID), and technical data such as app version, device model and an approximate location that Google derives from your IP address. We do not send your hourly rate, earnings, paycheck amounts, paycheck contents or notes to Google Analytics, only broad ranges. The App also sends Google Analytics daily counts of how many times the App was closed and how many of those closures were unexpected (for example because it crashed, froze or used too much memory), which iOS provides through its MetricKit framework. From ShiftWallet 2.5, the App also saves the pseudonymous app user identifier on your account record in Firestore, so that your analytics, purchase and crash records can be matched to your account when we need to, for example to answer a support or deletion request.

If you installed the App from an Apple Ads campaign, the App asks Apple's AdServices framework for the campaign details (campaign, ad group, keyword and click date) and records them in analytics so we can measure our own advertising. Purchase events recorded in Google Analytics may be imported into Google Ads as conversions so we can measure our own campaigns. The App never asks for permission to track you, so your device's advertising identifier (IDFA) is not available to us. We do not show ads and we do not track you across other companies' apps and websites.

Crash data

We use Firebase Crashlytics to collect crash logs and diagnostic data. This helps us identify and fix bugs. Crash reports may include device model, OS version, app version, app state, stack traces, the last screen you opened, whether you have Pro, short technical notes the App writes when something fails (for example a sync, a restore or a purchase, with its error code) and the reports iOS gives the App through MetricKit about crashes, freezes and excessive resource use. From ShiftWallet 2.5, crash reports carry the pseudonymous app user identifier described under Purchase and subscription data, so we can see whether several crashes affect the same person and connect a crash with a problem you report to us. We do not attach your name or email to crash reports, and they do not contain your work data.

Cancellation survey

From ShiftWallet 2.5, if you turn off the automatic renewal of a ShiftWallet subscription, the App may show you a single optional question about why you are leaving, once per subscription. You can close it without answering. If you answer, the reason you pick is recorded in analytics, together with whether you also wrote a comment, but never the comment itself. If you write a comment (up to 140 characters), it is saved on your account record in Firestore with the reason, whether the subscription was a trial, the plan, the app version, the date and the App Store identifier of the subscription. We read these answers to improve the App. Please do not include personal details in the comment. It is deleted when you delete your account.

Other technical services

The App uses Firebase Remote Config to receive default labor rules by country, Firebase App Check to confirm that requests to our servers come from the genuine App, and Firebase Cloud Messaging for push notifications. These services process technical identifiers generated for your app installation and basic device and app information.

Our Cloud Functions also write short operational logs when your synced records are processed (for example your user ID, the record ID, the gross pay of a finished shift or the result of a paycheck verification). They are used only for troubleshooting and are kept for a limited period (30 days by default in Google Cloud Logging).

Camera, photos and files (optional)

ShiftWallet can access your camera, photo library or files for these optional purposes:

• To take or pick a photo to use as a custom job icon, which is stored with the job and synced to Firestore.
• To capture or import a paycheck (photo or PDF) for the AI paycheck scanner described in Section 5. ShiftWallet does not keep the photo.
• To import your roster from a photo or a calendar file (.ics). A roster file and a roster photo are read on your device (photos with Apple's on-device text recognition). Only if you choose the AI reading, the photo is sent to OpenAI through our relay as described in Section 5. ShiftWallet does not keep the photo.
• To save an image to your photo library, only when you tap Save Image, for example on a pay summary you share.

Access is only granted with your explicit permission and only the image or file you select is used. We do not browse, copy or upload other images or files.

Notifications, Siri and Shortcuts

Clock reminders and payday reminders are scheduled on your device as local notifications. The actions ShiftWallet offers to Siri and the Shortcuts app (for example clocking in or out, the total of your pay period, or logging hours by voice) run on your device. Apple handles the speech recognition and passes the App only the text. If you start an action from an NFC tag, that is an automation you set up in the Shortcuts app, and ShiftWallet does not read the tag.

Support emails

If you contact support from the App, your email app opens a message with the app version, iOS version and device model filled in. We receive it only if you choose to send it, and we keep it to answer you.

2. Information we do not collect

ShiftWallet does not collect or access:

• Contacts or address book
• Microphone or audio
• Health or fitness data
• Biometric data (Face ID and Touch ID authentication is handled entirely by iOS)
• Messages, calls or browsing history
• Financial account credentials (bank logins, credit card numbers)
• Your device's advertising identifier (IDFA), which the App never asks permission to use
• Photos or files other than the specific ones you explicitly choose (a job icon, a paycheck or a roster)
• Calendar events other than those of the calendars you pick for a roster import

3. How we use your data

We use the information we collect to:

• Provide and maintain the App's core functionality (shift tracking, pay calculation, paycheck verification, tax estimation)
• Back up your work data and sync it across your devices
• Provide the AI paycheck scanner, the AI roster reading and the chat when you use them
• Process and restore purchases and subscriptions
• Improve the App and measure our own marketing through analytics
• Diagnose and fix technical issues via crash reports
• Answer your support requests and communicate important updates about the service

We process your data to provide the service you ask for (contract), and for our legitimate interest in keeping the App secure, measuring and improving it, and measuring our own marketing. You can object to processing based on legitimate interests at any time (see Section 11).

4. On-device processing

Core ShiftWallet functionality (clock in and out, hour tracking, pay calculation with differentials such as night, overtime and holiday pay, tax and take-home estimates, paycheck verification math, roster reading from files and photos with on-device text recognition, and reports) is performed on your device. The results are saved with your work data and backed up as described in Section 1. For records synced by older versions of the App that did not include a pay breakdown, our servers may compute the same breakdown from the synced shift and job data. While a Live Activity is running, a Cloud Function also advances the earnings shown on your Lock Screen, as described in Section 1.

5. AI features (ShiftWallet Pro)

ShiftWallet offers AI-assisted features that you choose to use. The App asks for your consent before the first use:

• AI paycheck scanner: sends the paycheck image you select (or the text the App extracts on your device from a PDF) to read amounts, line items, employer details and the employee name printed on it.
• AI roster reading: sends the roster photo you select, the name you tell the App to look for on it, if any, and today's date, so the shifts can be read from it. You check them in a preview before anything is saved.
• AI paycheck analysis and chat: sends the structured context needed to explain a difference or answer your question: the job name, country, rates and pay rules, the shifts in that pay period with their times and amounts, the amounts received and calculated, the scanned paycheck values, your recent chat messages and your question.

ShiftWallet's secure AI relay. These requests always go from the App to our relay (a Google Cloud Function called aiProxy, in the United States), which checks that you are signed in to your ShiftWallet account (anonymous or not), uses Firebase App Check to verify that the request comes from the genuine App, applies a daily fair-use limit, and forwards the request to OpenAI using our own OpenAI account. If you have ShiftWallet Pro without a signed-in account, the App also sends the relay the App Store-signed record of your Pro purchase so the relay can apply the Pro limit. The relay only checks that record and does not store it. You do not need an API key. The relay does not store the paycheck, the roster photo, the prompt or the answer. It keeps a usage counter per user ID and day (date, number of requests and last update) to apply a daily fair-use limit, and short technical logs (user ID, model, time and errors) for security and troubleshooting, without the content of your requests.

OpenAI's role. OpenAI, L.L.C. processes these requests on our behalf as our service provider under its API business terms, and does not receive your name, email or ShiftWallet user ID from us. Keep in mind that a paycheck or roster image can itself contain your name, your employer, colleagues' names and other personal details. Under OpenAI's API data policy, API content is not used to train OpenAI's models and may be kept for up to 30 days to detect abuse before it is deleted, unless OpenAI is legally required to keep it longer. See the OpenAI Privacy Policy.

No personal API keys. Earlier versions let you enter your own OpenAI API key. ShiftWallet 2.2 removes that option: the AI features only use our relay, and the App deletes any key that was stored in the iOS Keychain on your device. It was never sent to our servers.

The results of a verification (for example the amounts and the difference) are saved with your work data as described in Section 1. The AI features are optional, and you can read how they work in Settings > AI Features.

6. Third-party services

ShiftWallet uses the following service providers, which process data on our behalf:

• Firebase and Google Cloud (Google): Authentication, Firestore (backup and sync), Cloud Functions (AI relay, Live Activity updates, pay calculation for older records, Sign in with Apple token revocation and account deletion), Analytics, Crashlytics, Remote Config, App Check and Cloud Messaging. Google Sign-In if you choose it. See the Firebase Privacy Policy.
• OpenAI: AI paycheck scanning, roster reading, analysis and chat through our relay, as described in Section 5. See the OpenAI Privacy Policy.
• RevenueCat: purchase validation, subscription management and paywall delivery. RevenueCat processes purchase and technical data on our behalf. See the RevenueCat Privacy Policy and Data Processing Addendum.
• Apple: Sign in with Apple (authentication), StoreKit (in-app purchases), AdServices (Apple Ads attribution) and Apple Push Notification service (Live Activities and notifications). See the Apple Privacy Policy.

We do not sell, rent or share your personal data with any other third parties.

7. Data retention

Your work data is retained for as long as your account (anonymous or signed-in) exists. If you delete your account (Settings > Delete Account), your authentication and work data is permanently removed from our servers within 30 days. Local data on your device, including planned shifts and the German payslip details, is deleted immediately upon account deletion.

If you use the App without creating an account, your data stays linked to an anonymous account. You can erase it from our servers at any time with Settings > Clear Local Data, which removes your data from this device and from its cloud backup. If you delete the App without creating an account, you may lose access to that backup, so create an account if you want to keep it.

The AI relay does not keep the content of your requests. Its daily usage counters are deleted with your account, and its technical logs are kept for a limited period for security and troubleshooting. Analytics data is kept for the retention period configured in Google Analytics (no longer than 14 months for event-level data). It is stored under the pseudonymous app identifier, not under your name or email, and it is not removed automatically when you delete your account. Deleting your account removes the copy of that identifier saved on your account record in Firestore. Crash reports are kept by Crashlytics for a limited period.

Purchase records are handled separately from work and authentication data. Deleting a ShiftWallet account does not cancel an Apple subscription or automatically delete the purchase records used to restore access. To request deletion of purchase-related or analytics data held by us or our processors, contact jan@digitalnafta.com. We will assess the request and any applicable retention obligations.

8. Account deletion

You can delete your account at any time by going to Settings > Delete Account within the App while signed in. This action will:

• Permanently delete your authentication credentials and revoke your Sign in with Apple token
• Remove all your work data (jobs, shifts and their change history, paychecks, earnings, days off, trips, settings) and your account record, including any cancellation survey comments, from Firebase Firestore
• Remove your AI usage counters
• Delete all locally stored data on your device

This action is irreversible. We keep a minimal deletion record (user ID, date, a masked email and the number of records deleted) to prove the deletion was done.

9. Data security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS/SSL) for all data communications
• Encryption at rest for data stored in Firebase
• Firebase Security Rules that ensure users can only access their own data
• An AI relay that requires a signed-in session, verifies Firebase App Check, and keeps our OpenAI key in Google Secret Manager, never on your device
• On-device storage using SwiftData with iOS data protection

10. Children's privacy

ShiftWallet is not designed for or directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information promptly.

11. Your rights (GDPR and CCPA)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your data (or use the in-app Delete Account feature)
• Portability: request your data in a machine-readable format
• Objection: object to certain processing of your data, including analytics
• Opt-out of sale: we do not sell your personal data. There is nothing to opt out of.

To exercise any of these rights, contact us at jan@digitalnafta.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

12. International data transfers

Your data may be processed in countries outside your country of residence through our use of Firebase and Google Cloud (including the AI relay in the United States). Google maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses where applicable.

OpenAI processes AI requests in the United States. RevenueCat may process purchase and technical data outside your country, including in the United States, and its Data Processing Addendum describes the safeguards applicable to these transfers.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy within the App and updating the "Last updated" date. Your continued use of the App after changes constitutes acceptance of the revised policy.

14. Contact us

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: jan@digitalnafta.com
• Company: Digital Nafta Portal FZCO
• Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE