Privacy Policy

What we collect

When you create a DebtShift account, we collect:

• Account info — Your name and email address
• Role — Whether you're registering as a worker or employer
• Shifts — The shifts you post or claim, including location, date, and rate
• Call-out history — When and why you call out of a shift (for workers)
• Session data — Minimal technical data needed to keep you logged in securely

How we protect your data

Your data is protected in multiple layers:

• Encryption in transit — All data is transmitted over HTTPS (TLS 1.2+). Nobody can intercept your information as it travels between your device and our servers.
• Encryption at rest — All stored data is encrypted on our servers. Your password is never stored in plain text — we use bcrypt with a per-user salt.
• Session security — Sessions are stored in encrypted, Postgres-backed storage. Session cookies are HTTP-only and secure by default.
• Access controls — Only the services that need your data have access to it. We follow the principle of least privilege.

How we use your data

We use your information only to:

• Run the DebtShift platform — matching workers with shifts, notifying employers of call-outs, tracking completed work
• Keep your account secure and prevent unauthorized access
• Communicate with you about your account (login-related emails, shift updates)
• Improve the service (anonymous usage analytics only)

We never sell your data. We don't run ads. We don't share your personal information with third parties for marketing purposes.

Data retention

We keep your account data for as long as your account is active. If you delete your account, we delete your personal information within 30 days. Shift history that has been anonymized (no personal identifiers) may be retained for service improvement purposes.

Cookies

DebtShift uses one essential cookie to keep you logged in. That's it. No advertising trackers, no cross-site tracking, no third-party analytics cookies.

Your rights

You have the right to:

• Access the personal data we hold about you
• Delete your account and all associated data at any time
• Export your data (contact us and we'll help)
• Ask questions about how we handle your information

To exercise any of these rights, email privacy@debtshift.com.

Changes to this policy

If we make material changes to how we handle your data, we'll update this page and, if the change is significant, notify you by email.