The short version
Your employer can see when you started and finished work, and where you were while you were working. Nothing about your location is recorded once you check out.
If your employer switches it on, the app asks your own phone’s camera for one photograph at the moment you check in. If they use a kiosk tablet, it takes one photograph of whoever is standing in front of it at the moment of a scan.
Who is responsible for what
Your employer decides what is collected and why. In data-protection terms they are the controller. Shifticker stores and processes it on their instruction, as the processor. That means a request about your own records starts with your employer, not with us, although we will help them answer it.
Your employer is also responsible for telling you that this system is in use and for having a lawful basis to use it where you work.
What we collect
Everything below is a category the system genuinely stores. Nothing is collected that is not listed here.
Your account
- Name and email address.
- A password, stored only as a bcrypt hash. Neither we nor your employer can read it.
- Phone number and preferred language, if you provide them.
- Your role in the organization, whether your membership is active, and an employee code if your employer uses one.
Every check-in and check-out
- The time it happened and which site it was at.
- How it was recorded: the app inside a geofence, a kiosk tablet, or a manual correction entered by a manager.
- An identifier for the device that submitted it, the platform, and the app version.
- The written reason a manager gave, when they correct a record by hand, and which manager did it.
Location at the moment you scan
- Latitude and longitude, and how accurate the reading was.
- How far you were from the site, and whether that fell inside the geofence your employer configured.
If your phone cannot get a position, the scan is still recorded, without one. Your employer can choose to refuse check-ins from outside the geofence, or to accept them and flag them.
Location while a shift is open
- Position samples taken while you are checked in, each with the accuracy of the reading and, where your device reports it, your speed of travel.
- The distance from the site for each sample, and whether it was inside the geofence.
This starts when you check in and stops when you check out. The server refuses location data when no shift is open, so it is enforced by the system and not only by the app on your phone.
Whether location was available
Separately from where you were, the system records events about the availability of location during a shift:
- Leaving the geofence, and returning to it.
- Location permission being switched off, and switched back on.
A “location turned off” event records only that the trail is incomplete, and flags the shift for your manager to look at. It does not record where you were during the gap, because nothing was collected then.
Photographs at check-in
Your employer can switch on a photograph at check-in. Where they have, the Shifticker app asks your own phone’s camera for a photograph at the moment you check in, so the record shows who actually scanned.
- One still image per check-in. There is no video, no continuous capture, and nothing is recorded between scans.
- The image is stored with that check-in and can be seen by your employer’s owner, admins and managers.
- We do not run face recognition on it. It is never matched against any other photograph, no biometric template is ever computed from it, and it is not used to identify you anywhere else. A person looks at it, or nobody does.
- It is kept for your organization’s retention window, 30 days by default, and then deleted. That is shorter than attendance records; see the retention table below.
Where your employer uses a kiosk tablet at the entrance, the tablet’s own camera takes a photograph at the moment a badge is scanned, and everything above applies to that image in the same way. A kiosk is a paid feature your employer chooses to use. The code it shows changes every few seconds, and the photograph is taken only at the moment a badge is scanned.
Your schedule, and how your shifts compared to it
- The shifts you were rostered for, and at which site.
- Differences the system found between that roster and what happened: a late start, a missed shift, an early finish, or hours below the roster, together with the size of the difference in minutes.
These comparisons are made automatically, every few minutes, and they send a message to your managers and to you. They are a prompt for a person to look into something, not a decision about you. Nothing about your pay, your hours or your employment is decided by this system without a person involved.
Messages sent to you
Your email address is used for invitations, password resets and messages about your organization's plan. Alerts are never emailed: they arrive as a notification on your phone and, for managers, in the dashboard. You can switch each type of alert off individually in your settings.
Technical and security records
- An audit entry each time an owner, admin or manager changes something, recording who did it, what changed, and the IP address they did it from.
- A notification token for your device, if you allow notifications, so alerts can reach you.
- Password reset links, stored hashed so that a copy of our database does not hand anyone a working link.
What we never do
- We do not track your location outside an open shift.
- We do not record audio or video at any time.
- We do not run face recognition, and we store no biometric data.
- We do not read your messages, contacts, photos or other apps.
- We do not use tracking cookies. Signing in stores a token in your browser’s local storage and nothing else.
- We do not sell personal data, and we do not use it for advertising.
Who can see it
| Role | What they can see |
|---|---|
| Employee | Their own attendance, their own shifts, and their own schedule. Nobody else’s. |
| Viewer | Everything a manager sees, and can change nothing. |
| Manager | The whole organization’s attendance, location trails, issues and reports, and can correct records. |
| Admin | All of the above, plus people, sites, rosters and settings. |
| Owner | All of the above, plus billing. |
| Shifticker staff | Only what is needed to run and support the service, and only on your employer’s request or to fix a fault. |
No customer can see another customer’s data. Every request is scoped to one organization and checked against your role.
Where it is stored, and who else touches it
Records, including check-in photographs, are held on servers run by our hosting provider. Email is sent through an email delivery provider, which handles the address and the content of the messages we send you and nothing else. These are our sub-processors. We do not sell your data or share it with anyone else, and we will name any new sub-processor here before it handles your data.
How long it is kept
| What | Default | Who controls it |
|---|---|---|
| Location samples during shifts | 90 days, then deleted automatically every night | Your employer, anywhere from 1 day to 10 years |
| Check-in photographs | 30 days, then deleted automatically every night | Your employer, anywhere from 1 day to 10 years |
| Attendance records and issues | While your employer keeps their account, since these are working-time records | Your employer |
| Audit log | While your employer keeps their account | Fixed, so the record cannot be edited away |
| Your account details | Until the account is deleted, then removed within 30 days | You and your employer |
| Password reset links | One hour, and one use | Fixed |
Your rights
You can ask for a copy of your data, ask for a correction, ask for deletion, or object to how it is used. Because your employer decides what is collected, start with them. If they do not resolve it, write to us at noreply@shifticker.com and we will help. You may also complain to the data protection authority where you live.
You can delete your account yourself, without asking anyone: Settings > Delete account in the app, or Settings on the web. That removes your name, email, phone number, password and every signed-in device at once, and frees the email address for a new account. How it works, and what stays, is described at shifticker.com/delete-account.
Some records cannot be deleted on request while your employment continues, because working-time records are kept for legal reasons. Your employer can explain which ones apply to you. Deleting your account does not delete those records; it removes your details from them.
Security
- Passwords are stored hashed with bcrypt, and reset links are stored hashed too.
- Every request is checked against your role and your organization before any record is returned.
- Kiosk codes are signed and change every few seconds, so a photograph of one is useless moments later.
- Traffic is encrypted in transit.
Changes and contact
If we start collecting something not listed above, this page changes first and your employer is told. Questions: noreply@shifticker.com. Our terms are at Terms of service.