Privacy Policy — Shifty

This Privacy Policy explains how THOMAS W M PTY LTD (ACN 701 107 262) ("Shifty", "we", "us", or "our") collects, uses, and protects your information when you use the Shifty mobile application (the "App").

We are based in Victoria, Australia and handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you use the App from outside Australia, your information may be handled as described here.

By using the App, you agree to this Privacy Policy.

1. Who we are

• App name: Shifty
• Operator: THOMAS W M PTY LTD (ACN 701 107 262)
• Contact: contact@shiftyapp.org

2. Information we collect

a) Information you provide

• Account details: your name, email address, and password when you create an account.
• Shift and schedule data: the shifts, appointments, notes, and calendar settings you enter to receive recommendations.

b) Information collected automatically

• Location data: if you grant permission, we use your device's location to show nearby partner venues ("Shifty Partners") on the in-app map. You can decline or revoke this at any time in your device settings; the map still works without it.
• Device and usage information: basic technical information necessary for the App to function (e.g. device type, operating system version).

c) Information we do NOT collect

• We do not currently sell your personal information.
• We do not collect payment card details directly. If and when subscriptions are offered, payments are processed by Apple through the App Store; we never see your full card details.

3. How your information is stored

• Account and shift data: your account details (name, email) and the shifts you enter are stored securely in our cloud database, hosted by Supabase, and linked to your account so they are available across your devices. A copy is also cached on your device so the App works offline; locally-cached data is cleared when you sign out or delete the App.
• Calendar settings and preferences are stored locally on your device.
• App content (exercise/nutrition videos, tips, and partner listings) is downloaded from a content feed we host; this download does not send us your personal information.
• Overseas storage: our infrastructure providers (Supabase and Vercel) may store or process data on servers located outside Australia. Where personal information is transferred overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

4. How we use your information

We use your information to:

• create and manage your account;
• generate your personalised shift and wellbeing recommendations;
• show nearby partner venues and enable your member card / discount redemption;
• send you notifications you have enabled (e.g. daily recommendation reminders);
• operate, maintain, and improve the App;
• comply with legal obligations.

We do not use your information for third-party advertising.

5. Notifications

If you enable notifications, we schedule local reminders on your device based on your shifts and settings. These are generated on your device. You can turn notifications off at any time in the App or your device settings.

6. Health & wellbeing information

Shifty provides general wellbeing and circadian guidance based on published research. The shift, sleep, and lifestyle information you enter is used only to generate your recommendations. Shifty is not a medical device and does not provide medical advice (see our Terms of Service). We do not knowingly collect sensitive health records.

7. Sharing your information

We only share information in limited circumstances:

• Service providers who help us operate the App (e.g. Apple for app distribution and, in future, payments; our content/hosting providers; and, once introduced, an authentication/database provider). These providers process information on our behalf.
• Partner venues (Shifty Partners): when you show your member card to redeem a discount, the partner sees what is displayed on your card (e.g. your name, membership status, and your shift-worker category/role as shown on the card). We do not send partners your account data, shifts, or location history.
• Legal reasons: if required by law, regulation, or valid legal process.
• Business transfers: if the App or business is sold or merged, information may transfer as part of that transaction.

8. Third-party services

The App uses the following third parties, each with their own privacy practices:

• Apple — App Store distribution, and (future) In-App Purchases. See Apple's Privacy Policy.
• Apple Maps (MapKit) — to display the partner map.
• Bunny Stream — to stream exercise and nutrition videos.
• Vercel — to serve the App's content feed.
• Supabase — authentication/database provider.

We recommend reviewing the privacy policies of these providers.

9. Data retention

We keep your information for as long as your account is active or as needed to provide the App. You can delete your account at any time (see Section 10), after which we delete or de-identify your personal information unless we are required to retain it by law.

10. Your rights and choices

Depending on your location, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your account and associated data;
• withdraw consent (e.g. turn off location or notifications);
• complain to a privacy regulator (in Australia, the Office of the Australian Information Commissioner — OAIC).

To exercise any of these, contact us at contact@shiftyapp.org. Because much of your data is stored on your device, deleting the App also removes locally-stored data from that device.

11. Children

Shifty is intended for users aged 16 and over. We do not knowingly collect personal information from children under this age. If you believe a child has provided us information, contact us and we will delete it.

12. Security

We take reasonable steps to protect your information. Data is transmitted over encrypted connections, and access to your account and shift data is protected by database security rules so that only you can access your own records. Your password is handled by our authentication provider (Supabase) and stored only in securely hashed form; we never have access to your plaintext password. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential. Shifty is subject to Australia's Notifiable Data Breaches scheme in the event of an eligible data breach.

13. International users

We are based in Australia. If you access the App from the European Union, United Kingdom, or elsewhere, you acknowledge your information may be processed in Australia and by our service providers.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where appropriate, notify you in the App. Continued use of the App after changes means you accept the updated policy.

15. Contact us

Questions about this Privacy Policy or your information:

THOMAS W M PTY LTD
Email: contact@shiftyapp.org