This Privacy Policy explains how Handoff Shifts LLC("Handoff Shifts," "we," "us") handles information when you use the Handoff Shifts mobile app, website, and related services (the "Service"). Handoff Shifts is a workplace operations platform that employers (restaurant operators and their organizations) provide to their employees. This policy is written for both: the employers who administer accounts and the employees who use the Service day-to-day.

1. Our role and your employer's role

Handoff Shifts is provided to employers under a separate agreement with each employer. When you use the Service as an employee, your employer decides what features are enabled, what information is entered about you, and how long records are kept. Your employer is the "data controller" for that information, and Handoff Shifts acts as their "processor" — we handle data on their instructions.

If you have questions about why specific information was entered about you, how long it is retained, or want a copy or deletion, the fastest path is usually to ask your employer first. You can also write to us at privacy@handoffshifts.com and we will route your request appropriately.

The exception is information you give us directly rather than through an employer — when you visit our website, try the demo, or contact us about the Service. For that information Handoff Shifts is the controller, and requests about it come straight to us.

2. Information we collect

Account information

When your employer adds you to the Service, we receive your name, email address, and role, and — if you or your employer provide one — a phone number we use to contact you about your work, such as shift coordination. When you sign in, our authentication provider (Clerk) collects a password or sign-in code, optional multi-factor authentication factors, and (if you provide one) a profile photo. Clerk also records sign-in events for security purposes.

Work and operational information

Depending on which features your employer uses, the Service stores information about your work, including: position assignments, schedules, completed checklists, training records and certifications, recognition and coaching notes, writeups, shift notes, food and warehouse orders, and related operational records.

Content you create

The Service includes features for posting shift notes, sending team chat messages, completing checklists, filling in forms, and uploading photos (for example, store-item images or checklist evidence). We store this content so it can be displayed to authorized members of your workplace. If your role has the AI assistant, we also store your conversations with it so you can return to them.

Information about restaurant guests

Some workplaces use the Service to record a follow-up with a guest, for example after an order was wrong. An employee may enter the guest's name and the contact details the guest gave (phone number, email address, or mailing address) so the restaurant can make it right. Your employer decides whether to use this feature and is the controller of those records. They are visible to authorized members of that workplace and are not sent to the AI features described in Section 4.

Device and notification information

If you install our mobile app and grant notification permission, your device provides us with a push notification token from Apple Push Notification service (APNs) or Google's Firebase Cloud Messaging (FCM). We use this token only to deliver the notifications you have opted into. We do not collect your contacts or location.

Cookies and session information

The Service uses cookies and similar storage to keep you signed in and to remember your preferences. Authentication cookies are set by Clerk; we do not use third-party advertising cookies or web tracking pixels.

Usage and performance information

We use Vercel's first-party analytics and performance tools (Vercel Web Analytics and Speed Insights) to understand aggregate usage and to monitor the performance of the Service. These tools collect limited, privacy-preserving information such as page views, referring pages, general device and browser type, and page-load and performance timings. They are cookieless, do not track you across other apps or websites, and are not used for advertising.

We also record first-party usage information that is linked to your account, so we can see how the Service is actually used and where it gets in your way. This covers:

Session and device information — whether you are using the iOS app, the Android app, an installed web app, or a browser; your device type, operating system and version, browser and version, app version, screen size, display language, and time zone. This is determined from the standard information your device sends with each request. We do not fingerprint your device and we do not read any hardware identifier.
Screens you open— which screen, when, and how long you spent on it. We store the screen's general address (for example /boh/temp-logs), not the contents of what you were looking at.
Certain in-app actions — for example completing a checklist, submitting a temperature log, logging waste, uploading a schedule, issuing a writeup, sending recognition, or completing a project task, along with how long the task took. We record that the action happened and a small amount of non-identifying context such as which house or daypart it belonged to. We do not copy the contents of the record you created into this usage data.

This information is stored in our own database. It is not sent to an advertising network, an analytics vendor, or any third-party tracking service, and it is not used to track you across other apps or websites. It is used to operate and improve the Service — to see which workflows are slow or get abandoned, which devices we need to support well, and to help diagnose problems you report. It is accessible to Handoff Shifts platform staff. Sessions started while our staff are viewing the app on your employer's behalf are excluded, so support activity is never recorded as yours.

Our website, the demo, and contact requests

You do not need an account to visit handoffshifts.com, and this is what we keep when you do:

Contact requests — when you send the contact form we store the name, restaurant, and email address you enter, along with the phone number and message if you choose to add them. We use these to reply to you and to set up your store if you go ahead.
The demo — to open a demo store we ask for an email address and confirm it with a one-time code. The demo store is filled with invented people and records, and it is deleted about a day after it is created. We keep counts of which parts of the demo were used, not a recording of what you did.
Page views — our website counts the pages that are viewed using our own counter. It sets no cookie and stores no IP address. To count visitors it keeps a one-way code that changes every day, so a visit cannot be linked from one day to the next.

With a contact request, a demo sign-up, or a page view we also record the page that referred you and any campaign tags in the link, your browser and device type, and an approximate location — city, region, and country — which our hosting provider estimates from your IP address. For contact requests and demo sign-ups we keep a one-way code derived from the IP address, which we use to limit abuse; we do not keep the address itself. None of this is combined with advertising data or shared with an advertising or analytics company.

Categories of personal information (California)

Under California law, the categories of personal information we process are: identifiers (name, email, phone number, account ID, push token); approximate location (city, region, and country, for website visitors, demo sign-ups, and contact requests only); professional or employment-related information (role, schedules, assignments, training and certification records, recognition and coaching notes, writeups, shift notes, orders, and related operational records); visual information (profile photo and photos you upload); internet or other electronic activity (aggregate, cookieless usage and performance data, plus the account-linked session, screen, and in-app action records described in Section 2); and authentication data (sign-in credentials and security events held by our provider). We collect these to provide and secure the Service for you and your employer as described in Section 4. We do not collect sensitive personal information to infer characteristics about you, we do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. Information we do not collect

To be explicit, because the major app stores ask:

The app does not collect your precise or coarse location: it never asks for GPS and does not work out where you are from your network. The only location we record is the approximate city of a visitor to our public website, described in Section 2.
We do not stream, record, or monitor your camera or microphone in the background. Where a feature lets you add a photo, you may either choose an existing file or take a new photo through your device's standard system camera prompt — we receive only the image you choose to submit.
We do not collect payment, credit-card, or other financial information from employees. An employer's subscription is paid through Stripe (Section 5), and card details go to Stripe, not to us.
We do not collect health, medical, biometric, or sensitive demographic information.
We do not use third-party advertising networks or cross-app behavioral tracking. Aside from the first-party analytics described above — Vercel's cookieless tools and our own in-house usage records, both of which stay with us — we do not use advertising or behavioral-tracking SDKs (such as Google Analytics, Meta, Mixpanel, Segment, Amplitude, or PostHog).
We do not sell your information. We do not share information for cross-context behavioral advertising.

4. How we use information

To provide the Service to you and your employer — display schedules, deliver notifications, run checklists, and so on.
To send transactional emails (sign-in codes, password resets, notification alerts your employer configures).
To answer questions for your employer's managers and to produce summaries, using the AI features described below.
To reply to people who contact us, to run the demo, and to understand how our website is found.
To secure the Service — detect abuse, troubleshoot errors, and protect accounts.
To comply with legal obligations and enforce our terms.

AI features and what they read

Some features of the Service are powered by an AI model, Claude, which we reach through the API of its maker, Anthropic. When one of these features runs, the information it needs is sent to Anthropic to produce the result. Specifically:

The assistant— managers and the roles above them can ask the assistant questions about their own store and have it propose changes to the store's settings, which a person then approves. To answer, it looks up that store's records — for example checklist completion, temperature logs, waste, schedules, time punches, training progress, recognition, form submissions, shift notes, infractions, write-ups, and coaching notes — and sends the relevant records to Anthropic along with the question. These records name individual employees, including employees under 18, and can include disciplinary records.
Waste summaries — each day we generate a summary of the past seven days of waste for each store, and each week an emailed version of it, from totals by item, day, and time of day, together with the written explanations staff attached to entries.
Photos and documents — when a manager gives the assistant a photo or document to read, such as a paper checklist while setting up a store, the image is sent to Anthropic.
Directory search— when someone searches the store's list of vendors and service contacts by describing a problem, that list is sent with the description.
Translation — when a store wants a Spanish version, the wording of its checklists and tasks is translated using the same service.

The assistant reads records from the asker's own store only, and it shows infractions, write-ups, and coaching notes only for people the asker is already allowed to see in the app. It is not given the email addresses, phone numbers, or sign-in details on employees' profiles, or the guest contact details described in Section 2. Notes and other text that people typed are sent as they were written.

Anthropic processes this information on our behalf, to return a result to us. We use Anthropic's commercial API, under terms that do not allow it to train its models on what we send. AI output is information for your employer's managers to read. The Service does not use AI to make decisions about an individual employee, such as hiring, pay, discipline, or termination; people at your employer make those.

5. Service providers

We rely on a small set of third-party services to operate the platform. Each receives only the data needed for its specific function:

Clerk — user authentication, sign-in security, and identity management.
Neon — managed PostgreSQL database (hosted on Amazon Web Services). Stores the operational records described above.
Vercel — application hosting, file storage (Vercel Blob) for uploaded images, and cookieless first-party usage analytics and performance monitoring (Web Analytics and Speed Insights).
Resend — sending transactional email (sign-in codes, notification digests).
Anthropic — the AI features described in Section 4. Receives the question or task and the store records needed to answer it.
Stripe — subscription billing for employers. When an employer adds a payment method the card details go directly to Stripe. We never receive the full card number; we see the card brand, its last four digits and expiry date, the billing email address, and the invoice history.
Cloudflare — domain name service for our sites, and the automated-traffic check (Turnstile) that our sign-in provider may run when you sign in or create an account. The check receives your IP address and basic information about your browser.
Proton — our company email. Receives messages you send to our email addresses and our replies.
Firebase Cloud Messaging (Google) — push notification delivery to Android devices. Receives the FCM token and the notification payload only.
Apple Push Notification service — push notification delivery to iOS devices. Receives the APNs token and the notification payload only.

These providers are contractually required to use information only as instructed by us. We do not authorize them to sell information or use it for their own marketing.

6. Children and minors

Handoff Shifts is a workplace tool, not a consumer app, and it is not directed to children under 13. We do not knowingly accept registrations or collect information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a worker under 13 has been added to the Service, contact us at privacy@handoffshifts.com and we will remove the account and associated information.

We recognize that some employees are minors aged 13 to 17, since federal and state child-labor laws allow some workers as young as 14 to be employed in restaurant settings with restrictions. Where applicable law requires parental or guardian consent before a minor's personal information is collected, the employer is responsible for obtaining and documenting that consent before adding the minor to the Service. A parent or guardian may contact us at privacy@handoffshifts.com to request access to or deletion of a minor's information on the Service.

7. Data retention

We retain personal information for as long as your account is active and for a reasonable period afterward to support your employer's record-keeping and to satisfy legal, tax, audit, and dispute-resolution obligations. Push notification tokens are deleted when they become invalid or when you uninstall the app. Aggregated and de-identified information may be retained for longer to support analytics about the Service itself.

The usage information described in Section 2 is deleted on a rolling schedule: records of screens you opened are kept for 180 days, records of in-app actions for 365 days, and session and device records for 400 days.

8. Your rights

You can ask us to access, correct, delete, or export your personal information by writing to privacy@handoffshifts.com. Because Handoff Shifts holds most employee information on behalf of an employer, we will forward applicable requests to your employer and follow their instructions consistent with law. We do not sell personal information or share it for cross-context behavioral advertising.

If you are a California resident, you have the right to know the categories and specific pieces of personal information we hold about you, to request deletion or correction, to request a portable copy, and to designate an authorized agent to make a request on your behalf. We do not sell or share personal information, so there is nothing to opt out of, and we will not discriminate or retaliate against you for exercising any of these rights. We will take reasonable steps to verify your identity before fulfilling a request and will respond within the timeframe required by applicable law.

9. Security

We protect information using industry-standard practices: HTTPS for all network traffic, encrypted database backups, scoped access controls, and security review of third-party providers. No system is perfectly secure, but if we become aware of a breach that affects you, we will notify your employer and, where required, you directly.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, for significant changes, notify you through the Service or by email.

11. Contact us

For any privacy question, request, or concern, write to us at privacy@handoffshifts.com.