Privacy

Account: your email address, your name if you give it, how you sign in (Google, Apple, email and password, or an email link) and your sign-in history. Passwords are handled by our sign-in provider.

Workplace membership: which workplaces you belong to and whether you are an admin or an employee. Your workplace roster entry can hold your name, email, phone number, role, availability, preferences, notes and settings such as whether coworkers see your phone or email. Admins may add details such as your start date, birthday, credentials or pay rate; employees do not see another person's pay rate, admin notes or credentials.

Profile picture: if you add one, from your camera or photo library in the app or from a file on the web. Before upload, the app or your browser crops it to the square you pick, shrinks it to at most 512 pixels and saves it again, which removes the photo's location and other details stored in the file. We keep it in private storage. People in your workplaces see it through links that expire; it is never at a public address. Admins can also add a roster photo for someone on their roster.

Phone number: your mobile number is kept on your roster entry, added by you or your admin. It is used for text messages from your workplace, such as reminders you turn on and confirmations of requests you send. Coworkers see it only while phone sharing is on.

Schedules: shifts, rotations, call, swaps, open shift claims and the history of changes to them. Admins can see an activity log of who changed what and when.

Time off: your requests, their dates and status, the reason you pick and any note you choose to add. People on a roster can also send a request through a workplace request link without an account, using the email or mobile number on the roster.

Time clock: if your workplace uses it, each clock in, clock out and break with its time, optional notes and timesheet approvals. When an admin turns on the location check and you choose to share your location, the time clock reads your device location at each punch and stores it rounded to three decimal places (roughly 100 meters) with the distance from the workplace.

Workplace tools: shift checklists and notes, paid time off balances, onboarding documents your workplace uploads and your acknowledgements of them (with a typed name when a document asks for one). In residency programs, logged work hours and the signature you draw when you sign them; you can also save your signature to reuse it.

Devices: if you turn on notifications in a web browser, we store that browser's push subscription. If you turn on notifications in the iPhone app, we store the device token Apple gives your phone, with the workplace it is for. We use it only to deliver Schedultary notifications through Apple. It is removed when you sign out of the app or turn notifications off. We also remove it when Apple reports that it no longer works.

App lock: in the app you can require Face ID, Touch ID, your fingerprint or face on Android, or your passcode to open Schedultary. Your phone does that check itself and tells the app only whether it passed. Your face, fingerprint and passcode never leave your phone and are never sent to Schedultary. The app keeps your sign-in session in your phone's secure storage (the iPhone Keychain or the Android Keystore).

Contacts: the app can add coworkers who share their contact details to your phone's contacts, one card at a time after you review it. The app does not read your contacts or send them to us.

Calendar feeds: each person has a private calendar link. Anyone who has the link can read the schedule it carries, so share it only with calendar apps you use.

Sign-ups and limits: beta and site access requests (email and name) and short-lived counters used to limit repeated attempts. Those counters store hashed values, never an email, phone number or address.

Supabase stores the database, files and accounts and handles sign-in, including sign-in emails. Vercel hosts the website and the API and processes each request, including your IP address, to deliver it.

Resend sends our email, such as request confirmations, reminders and schedule messages. Bird sends text messages when you give a mobile number: time-off request confirmations and, if you turn them on, shift reminders. Message frequency varies. Reply STOP to opt out or HELP for help.

Google and Apple handle sign-in when you choose them and send us only the account details you approve. Browser notifications are delivered by your browser's push service and iPhone notifications by Apple Push Notification service.

Some admin tools use an AI model. When an admin imports a schedule from a file, asks the rules or workplace assistant a question, builds a schedule with AI or reads business hours from a website, the content needed for that task is sent to Anthropic's Claude models. If Claude is not available, it is sent to xAI or through Vercel AI Gateway instead. Imported files and assistant questions can include names on the roster. AI schedule builds send a numbered summary of shifts and limits without names or contact details.

Schedultary shows no ads and uses no advertising or analytics trackers. Cookies and browser storage keep you signed in, remember your selected workplace and keep a local copy of your schedule for faster loading.

We keep your account until you delete it. Workplace records stay with the workplace while it uses Schedultary. To delete a workplace you administer, email hello@schedultary.com.

In the iPhone app, open Account (the person icon at the top of your schedule) and tap Delete Account. In the Android app, open the Profile tab (residents) or the More tab (staff), then Account, then Delete Account. On the web, open Profile settings and use Delete Account at the bottom of the page. You can also email hello@schedultary.com from the address on your account and we will delete it.

Deleting your account removes your sign-in, your workplace memberships, your browser notification subscriptions, your iPhone notification tokens, your notification settings, your profile picture, your saved signature and your site and beta access requests. In each workplace you leave, your roster entry is detached from your account: your calendar link stops working, reminders by email and text stop, your notes and the notes on your requests are cleared, pending time-off and program requests and open swap requests are withdrawn and contact sharing is turned off.

Your workplace keeps its own records about your work, such as past schedules, time clock punches, timesheets, paid time off, acknowledgements and its activity log, because it may need them for payroll and compliance. Those records no longer point to your account. Your roster entry also keeps the name and contact details your workplace entered for you; ask your workplace admin to change or remove them.

If you administer a workplace and nobody else has joined it, the workplace is deleted with your account, including its roster, schedules and files. If other people belong to a workplace where you are the only admin, make another member an admin before deleting your account.

If you signed in with Apple, you can also stop using Apple sign-in with Schedultary in your Apple Account settings.

Schedultary is built for workplaces and is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, email hello@schedultary.com and we will delete it.

Questions or requests about your data: hello@schedultary.com.