Privacy Policy for ShiftWake Lite

This Privacy Policy explains what data the ShiftWake Lite mobile application (the "App") processes, for what purpose and for how long. It applies only to ShiftWake Lite; the full ShiftWake app has its own policy. It is designed to comply with the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the USA.

If you do not agree with this policy, please do not use the App.

The short version

• The App does not require an account, an e-mail address or a name.
• Your alarms, cycle, single-day changes and time off are stored only on your phone. We do not send them to our servers and we do not back them up.
• We send our server only your phone's identifier, of which the server keeps just an encrypted fingerprint, and the number of alarms on the phone. They are used for the 14 free days, for an anonymous total of alarms and for a record that you accepted our terms.
• The App shows no ads, does not use the advertising ID or Google Analytics, and does not sell personal data.
• Payments are handled by Google Play. We have no access to your card details.

1. What data we process

The following data is processed when you use the App:

• Data on your phone: Alarms, alarm times, your cycle, single-day changes, time off, notes on days and App settings. They are stored only on your phone and are not sent anywhere. The App automatically deletes calendar records older than one year.
• Phone fingerprint: The App sends our server the identifier that Android assigned to the App on your phone (ANDROID_ID). The server computes an encrypted fingerprint from it (HMAC-SHA256 with a secret key) and stores only that – it does not store the identifier itself. Together with the fingerprint, the server records the start date of the free period, the number of alarms on the phone and the time of the last report. Neither the phone nor the identifier can be derived back from the fingerprint. With the fingerprint, the server also records that you accepted the Terms and Conditions and acknowledged the Privacy Policy – their versions and the time of confirmation.
• Number of alarms: When it changes, and at least every 7 days, the App sends just a number – how many alarms you have on your phone. Times, names or other alarm details are not sent. The numbers from all phones make up an anonymous total of alarms set in the App.
• Crash diagnostics (Crashlytics): If the App crashes, Firebase Crashlytics sends an error report, the device model, the system version and a random installation identifier.
• App authenticity check: Firebase App Check with Google Play Integrity verifies that requests to our server come from the genuine App from Google Play.
• Payments: You buy the subscription through Google Play. The App only asks Google Play whether you have an active subscription. We do not collect and have no access to your payment card details.
• List of holidays: Once a month the App checks whether the published list of public holidays has changed and downloads it if needed. It sends no data about you or your alarms.

Phone permissions:

• Notifications, exact alarms and full-screen display: so that the alarm rings on time even on a locked phone.
• Do Not Disturb access: so that the alarm rings even when Do Not Disturb is on.
• Music on your phone: only if you choose your own song as the alarm sound. The song stays on your phone and is not uploaded anywhere.

2. How we use data and the legal basis

We use data solely for the following purposes, relying on the stated legal bases under the GDPR:

• Running alarms, the calendar and time off on your phone: Performance of a contract.
• Free period (phone fingerprint and start date, so that the 14 free days cannot be obtained again by reinstalling the App): Legitimate interest.
• Checking the subscription with Google Play: Performance of a contract.
• Anonymous total of alarms (how many alarms are set in the App; a phone that has not reported for 15 days is left out of the total): Legitimate interest (statistics on the use of the App).
• Crash diagnostics (Crashlytics): Legitimate interest (App stability).
• Protection against abuse (checking that requests come from the genuine App from Google Play): Legitimate interest.
• Record of acceptance of the terms (version of the Terms and Conditions and of the Privacy Policy and time of confirmation, so that we can prove which rules you agreed to): Legitimate interest (proof of the conclusion of the contract and defence of legal claims).

3. Who we share data with

We do not sell personal data to any third party for marketing or any other purpose. We only use reliable service providers who run the technical side of the App:

• Google LLC / Google Ireland Limited (Firebase services): Cloud Functions and Cloud Firestore (the server for the free period and the total of alarms, data centre in Warsaw, Poland), Cloud Storage (list of holidays), Firebase App Check with Google Play Integrity (App authenticity) and Crashlytics (crash diagnostics).
• Google Play: Subscriptions and payments.

4. International data transfers

The phone fingerprint and the number of alarms are stored in a data centre in the European Union. Crash diagnostics and the App authenticity check are provided by Google, which may also process data outside the European Union (including the USA). Such transfers are protected by appropriate safeguards, including the Standard Contractual Clauses (SCC) approved by the European Commission.

5. Data retention

We keep data only as long as necessary:

• Data on your phone: Until you uninstall the App or delete the data yourself. The App automatically deletes calendar records older than one year.
• Phone fingerprint with the free-period start date, the number of alarms and the record of acceptance of the terms: 4 years from the phone's last report, then deleted automatically.
• Crash diagnostics: Usually no longer than 90 days.

6. Your rights (GDPR and global rights)

Depending on where you live, you have the right to:

• Access and portability: All data about your alarms is right there in the App.
• Erasure: You delete the data on your phone by uninstalling the App or clearing its data in your phone settings. The fingerprint on the server is not linked to your name or e-mail and we cannot attribute it to a specific person (Art. 11 GDPR); it is deleted automatically 4 years after the last report. During that time we also keep the free-period record to prevent the free period from being obtained repeatedly.
• Objection: You can object to processing based on legitimate interest by e-mail at the address below.
• Right to lodge a complaint: If you believe your privacy rights have been violated, you may lodge a complaint with the data protection authority in your country of residence.

7. Additional rights for California residents (CCPA)

In accordance with the CCPA, we expressly state that we do not sell your personal information ("Do Not Sell My Personal Information"). You can exercise your rights by contacting us by e-mail.

8. Children's privacy (COPPA / GDPR-K)

The App is an alarm for work shifts and is not intended for persons under 16. We do not knowingly collect personal data from children under 16.

9. Changes to this policy

We may update this policy from time to time. We will inform you of important changes in the App or by updating the "Last updated" date at the top of this document.

10. Contact us

If you have any questions or requests regarding this policy, contact us:

• By email: info@shiftwake.com
• Operator:
  Registra SK s. r. o.
  Registered office: Predmier 280, 013 51 Predmier, Slovak Republic
  Company ID (IČO): 55376886
  Tax ID (DIČ): 2121961072
  VAT ID (IČ DPH): SK2121961072
  Registered in the Commercial Register of the District Court Žilina, Section: Sro, Insert No. 81819/L