Privacy

What we store

• Schedules — the names, dates, times, and optional locations/notes in the spreadsheets you upload, kept on our server so share links and calendar files work.
• Employee emails— if your spreadsheet has an email column, those addresses are stored with the schedule and used for exactly one thing: sending each person their own schedule when the schedule owner clicks “Send schedules out”. Delivery goes through Brevo, our email provider. No marketing, no lists, and deleting the schedule deletes the addresses.
• Accounts — your email address and a hashed password (we never store the password itself), plus the teams and schedules you save.

No analytics, no ad trackers, no third-party scripts. The only cookie is the session cookie that keeps you signed in.

How long we keep it

• Anonymous uploads auto-delete after 120 days, and the uploader can delete all links instantly from the results screen.
• Team schedules stay until you replace or delete them — deleting a schedule, a team, or your account removes the data immediately.

AI-assisted reading of unusual spreadsheets

Almost all spreadsheets are read entirely on our own server. If yours can't be read automatically, we may send a small sample of it (up to 30 rows, cells truncated) to OpenAI's API to detect the layout— which column holds names, where the dates are. The AI never generates your schedule data; our server extracts it locally using the detected layout. OpenAI's API does not use this data to train models. When this happens, the upload is clearly marked as AI-assisted.

Security

• All traffic is encrypted (HTTPS with HSTS).
• Schedule links use unguessable 16-character IDs.
• Passwords are hashed with scrypt; sessions use httpOnly signed cookies.
• Data files and the database are readable only by the app's own isolated, non-root process.

Questions or deletion requests

Email schedules@shiftstitch.netand we'll take care of it.