ShiftMate Privacy Policy

Effective Date: May 21, 2026  |  Last Updated: October 16, 2026  |  Developer: Celix Apps

1. Introduction

This Privacy Policy ("Policy") describes how Celix Apps ("we," "our," or "us") handles information in connection with the ShiftMate mobile application ("App") available on the Apple App Store. By downloading, installing, or using the App, you acknowledge that you have read, understood, and agree to be bound by this Policy.

If you do not agree with any part of this Policy, you must immediately stop using the App.

This Policy applies solely to the ShiftMate application and does not apply to any third-party services, websites, or applications that may be linked to or integrated with the App, including but not limited to Apple Inc., iCloud, HealthKit, or the App Store. We expressly disclaim any responsibility for the privacy practices of such third parties.

2. Information We Collect and How It Is Stored

2.1 Shift, Schedule, and Profile Data

You may enter shift schedules, work patterns, notes, and related calendar information into the App. The App also stores a user profile containing your display name, country, and language preferences. This data:

• Is stored locally on your device by default.
• Is optionally synced to your personal iCloud account if you enable iCloud Sync. When synced, data is stored in a private CloudKit container associated exclusively with your Apple ID. We do not have access to, and cannot retrieve, your iCloud data.
• Is never transmitted to our servers or any third-party server operated by us.
• Is shared on-device with the ShiftMate Widget and Live Activity extensions via a secure App Group container (group.com.celix.shiftmate). This sharing occurs entirely on your device and does not involve any network transmission.

You are solely responsible for the accuracy, completeness, and legality of the shift data you enter into the App.

2.2 Health Data (HealthKit)

With your explicit permission, the App may request access to health-related data through Apple's HealthKit framework, limited to sleep analysis (read-only). The App never writes any data to Apple Health. Regarding this data:

• It is accessed solely to display personalized insights within the App (the fatigue score).
• It is processed entirely on your device and is never transmitted to our servers or any external server.
• It is never shared with third parties, advertisers, or data brokers.
• You may revoke HealthKit access at any time through iOS Settings → Privacy & Security → Health → ShiftMate.
• We do not store, retain, or cache HealthKit data outside of what is temporarily held in device memory for display purposes.

We do not use HealthKit data for advertising, marketing, or any purpose other than the in-app features you explicitly enable.

2.3 Diagnostic and Usage Logs

The App uses Apple's unified logging system (OSLog) to record anonymous diagnostic events (e.g., "shift added," "alarm scheduled") for the purpose of debugging and improving app stability. These logs:

• Are stored only in your device's local system log.
• Are never transmitted to our servers or any external analytics platform.
• Do not contain personal identifiers, health data, or shift content.
• May be included in a diagnostic report if you voluntarily submit feedback through Apple's crash reporting mechanism, in which case Apple's privacy policy governs that submission.

The App also uses Apple's MetricKit framework to collect on-device performance diagnostics (CPU usage, memory consumption, app launch duration). MetricKit data is processed by Apple on your device. If you have enabled "Share Analytics" in iOS Settings, aggregated and anonymized diagnostic reports may be made available to us through App Store Connect in accordance with Apple's privacy policy. We do not receive raw or individually identifiable MetricKit data.

We do not integrate any third-party analytics SDK (such as Firebase, Mixpanel, Amplitude, or similar). No behavioral tracking or user profiling is performed.

2.4 Calendar Data (EventKit)

With your explicit permission, the App may sync your shift schedules to your device's native Calendar application using Apple's EventKit framework. If you enable the Calendar Sync feature:

• The App requests Full Calendar Access solely to create, update, and remove shift events in the calendar(s) you select.
• We do not read, access, or process any calendar events that were not created by ShiftMate.
• Calendar events are written to the iOS Calendar database on your device. If your calendar account is configured to sync externally (e.g., iCloud Calendar, Google Calendar), that sync is governed by the respective service's privacy policy and is outside our control.
• Calendar data is never transmitted to our servers.
• You may revoke Calendar access at any time through iOS Settings → Privacy & Security → Calendars → ShiftMate. Revoking access will stop future syncing but will not remove previously created calendar events.

2.5 Subscription and Payment Data

The App offers optional Pro subscriptions processed entirely through Apple's in-app purchase system (StoreKit). Regarding payment data:

• We do not collect, process, store, or have access to your payment card details, billing address, or Apple ID credentials.
• Subscription status (active/inactive) may be verified locally via StoreKit receipts.
• All billing, refunds, and subscription management are governed exclusively by Apple's Terms of Service and Apple's privacy policy.
• You may manage or cancel your subscription at any time through iOS Settings → [Your Name] → Subscriptions.

2.6 Backup and Export Data

The App may allow you to create local backups or export your shift data. Exported files:

• Are stored in a location you choose (e.g., Files app, iCloud Drive).
• Are your sole responsibility once exported.
• Are not transmitted to us.

Backups include your shifts, alarms, settings and, if you created one, your sleep profile (see 2.7). They never contain HealthKit data.

2.7 Sleep Profile and Sleep Plan

The Sleep Plan suggests sleep times around your upcoming shifts. To calculate it, you may enter a sleep profile (for example preparation time, commute times and the amount of sleep you need). Regarding this data:

• The sleep profile is stored only on your device; it is not synced to iCloud and is never transmitted to our servers.
• The Sleep Plan is calculated on your device from your shift times and your sleep profile. It does not use HealthKit data.
• It is included only in a backup file that you create yourself, and it is deleted when you use "Delete My Account" or uninstall the App.
• Sleep suggestions are general information and are not medical advice.

2.8 Notifications and Alarms

With your permission, the App schedules local notifications for shift alarms, shift reminders and optional sleep reminders (bedtime, caffeine and safe drive home). On iOS 26 and later, shift alarms may be scheduled as system alarms through Apple's AlarmKit framework, again only with your permission. All alarms and reminders are scheduled on your device; their content is not sent to us or to any third party. You may change these permissions at any time in iOS Settings.

3. Data We Do NOT Collect

To be unambiguous, we do not collect:

• Your name, email address, phone number, or any contact information (unless you contact us voluntarily).
• Government-issued identification numbers.
• Precise GPS location history.
• Browsing history or cross-app tracking data.
• Device identifiers for advertising purposes (IDFA, IDFV for advertising).
• Biometric data.
• Financial or banking information.
• Social media profile data.
• Any data from children under the age of 13.

4. How We Use Your Information

We use information within the App solely to:

• Provide core app functionality (shift scheduling, alarm notifications, earnings calculation, health insights).
• Sync your data across your own devices via your personal iCloud account (if enabled).
• Display relevant in-app notifications and alarms on your device.
• Sync shift events to your device's Calendar app (if you enable Calendar Sync).
• Fetch public holiday data for your country from a public holiday API to display in the shift calendar.
• Check for available App Store updates using Apple's public lookup API.
• Diagnose crashes or bugs through on-device logs.

We do not use your information for:

• Advertising or marketing to you.
• Selling, renting, or licensing data to third parties.
• Profiling, scoring, or automated decision-making with legal or significant effects.
• Training machine learning models on your personal data.

5. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise share your personal data with any third parties, except in the following limited circumstances:

5.1 Apple Inc.

Certain features of the App rely on Apple platform services (iCloud, HealthKit, StoreKit, notifications). Your use of these features is subject to Apple's Privacy Policy (available at apple.com/legal/privacy). We have no control over and assume no responsibility for Apple's data practices.

5.2 Legal Requirements

We may disclose information if we reasonably believe disclosure is required by applicable law, regulation, legal process, or governmental request. To the extent permitted by law, we will attempt to notify you of such requirements.

5.3 Protection of Rights

We may disclose information to enforce our Terms of Service, protect our rights or property, or protect the safety of our users or others, where permitted by applicable law.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

6. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• Local encryption: Data stored on your device is protected by iOS device encryption.
• iCloud encryption: Data synced via CloudKit benefits from Apple's encryption in transit and at rest.
• No server-side storage: Because we do not operate servers that receive your personal data, server-side breaches of your personal data by us are structurally impossible.

7. Data Retention

7.1 Local Data

Data you store in the App remains on your device until you delete it within the App or uninstall the App. We do not control the retention of data stored on your device.

7.2 iCloud Data

If iCloud Sync is enabled, data in your private CloudKit container is subject to Apple's iCloud storage and retention policies. Deleting your iCloud account or disabling iCloud Sync may result in data loss. We are not responsible for data loss caused by Apple's iCloud service.

7.3 Account Deletion

If you use the "Delete Account" feature within the App, locally stored data and iCloud-synced data associated with the App will be deleted. However:

• We cannot guarantee deletion of data cached by iOS or iCloud infrastructure outside our control.
• Residual data in system logs may persist until the operating system purges them automatically.
• Backup copies you have manually created (e.g., exported files) are not deleted and remain your responsibility.

8. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

8.1 Right of Access

You may request confirmation of whether we hold any personal data about you. Given our architecture (no server-side personal data storage), we typically hold only voluntary contact data you have sent us (e.g., support emails).

8.2 Right to Rectification

You may correct inaccurate personal data we hold about you.

8.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of personal data we hold. To delete all app data, use the "Delete Account" function within the App. For data held in iCloud, manage it through your Apple ID settings.

8.4 Right to Data Portability

You may export your shift data using the App's export functionality.

8.5 Right to Withdraw Consent

You may withdraw any permission you have granted (Health, Calendar, Notifications, Alarms) at any time through iOS Settings without affecting prior use.

8.6 Right to Restrict Processing

You may contact us to request restriction of any processing of personal data we hold directly.

8.7 Right to Object

You may object to any processing of your personal data we carry out on the basis of legitimate interests.

8.8 KVKK Rights (Türkiye)

If you are located in Türkiye, you have additional rights under the Law on Protection of Personal Data No. 6698 (KVKK), including the right to apply to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at kvkk.gov.tr if you believe your rights have been violated.

8.9 GDPR Rights (European Economic Area)

If you are located in the EEA, you may lodge a complaint with your local data protection supervisory authority.

To exercise your rights, contact us at: support.shiftmate@icloud.com. We will respond to verifiable requests within 30 days. We may need to verify your identity before fulfilling a request.

9. Children's Privacy

The App is not directed to children under the age of 13 (or 16 in certain jurisdictions under GDPR). We do not knowingly collect personal data from children under these ages. If we become aware that we have inadvertently received personal data from a child under the applicable age threshold, we will delete such data promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support.shiftmate@icloud.com.

10. Third-Party Services

The App integrates with the following services. Each is governed by its own privacy policy, over which we have no control and for which we assume no responsibility:

Service	Purpose	Data Sent	Privacy Policy
Apple iCloud / CloudKit	Optional data sync	None (private container, Apple-managed)	apple.com/legal/privacy
Apple HealthKit	Sleep insights (read-only)	None (on-device only)	apple.com/legal/privacy
Apple StoreKit / App Store	Subscription processing	None (Apple-managed)	apple.com/legal/privacy
Apple Push Notification Service	Silent change notifications for optional iCloud sync	None (Apple-managed)	apple.com/legal/privacy
Apple AlarmKit (iOS 26 and later)	System alarms for your shifts	None (on-device only)	apple.com/legal/privacy
Apple EventKit	Optional calendar sync	None (on-device only)	apple.com/legal/privacy
Apple MetricKit	On-device performance diagnostics	Aggregated/anonymized (via Apple, opt-in)	apple.com/legal/privacy
Nager.Date Public Holiday API	Fetch official public holidays	Country code and year (no personal data)	nager.at/privacy-policy
Apple iTunes Lookup API	Check for App Store updates	App bundle identifier (no personal data)	apple.com/legal/privacy

We do not integrate any third-party advertising networks, social media SDKs, or cross-app tracking libraries.

11. Disclaimer of Warranties

THE APP IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, OR NON-INFRINGEMENT.

We do not warrant that:

• The App will be uninterrupted, error-free, or free of viruses or other harmful components.
• The App will accurately calculate earnings, schedules, or health metrics for any specific legal, financial, medical, or employment purpose.
• Data stored in the App will not be lost due to device failure, software bugs, or iOS updates.
• Notifications and alarms will be delivered at the exact scheduled time in all device and system conditions.

You assume all risk associated with the use of the App and any reliance on its output.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL CELIX APPS, ITS DEVELOPERS, OFFICERS, OR AFFILIATES BE LIABLE FOR ANY:

• Indirect, incidental, special, consequential, or punitive damages.
• Loss of profits, revenue, data, goodwill, or other intangible losses.
• Damages resulting from unauthorized access to your device or data.
• Damages resulting from interruption or cessation of service.
• Damages resulting from bugs, viruses, or errors in the App.
• Damages resulting from your reliance on information provided by the App (including earnings estimates, schedule projections, or health insights).

THIS LIMITATION APPLIES REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE) AND EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

In jurisdictions that do not allow the exclusion or limitation of liability for consequential or incidental damages, our liability is limited to the maximum extent permitted by law.

13. Indemnification

You agree to defend, indemnify, and hold harmless Celix Apps and its developers from and against any claims, damages, obligations, losses, liabilities, costs, or debt arising from: (a) your use of the App; (b) your violation of this Policy; (c) your violation of any third-party right, including any privacy or intellectual property right; or (d) any data you input into the App.

14. Changes to This Policy

We reserve the right to update this Policy at any time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this document.
• Post the revised Policy at the same URL.
• Where required by law or where reasonably practicable, provide additional notice through the App.

Your continued use of the App after the effective date of a revised Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the App. We encourage you to review this Policy periodically.

15. Governing Law and Dispute Resolution

This Policy and any disputes arising out of or relating to it shall be governed by and construed in accordance with the laws of the Republic of Türkiye, without regard to its conflict of law provisions.

Any dispute shall first be attempted to be resolved through good-faith negotiation. If unresolved within 30 days, disputes shall be subject to the exclusive jurisdiction of Istanbul courts and enforcement offices.

Users located in other jurisdictions may also have rights under local law that are not affected by this clause.

16. Regional Privacy Notices

16.1 European Union & European Economic Area — GDPR

If you are located in the EU or EEA, the General Data Protection Regulation (GDPR) applies to our processing of your personal data.

Data Controller: Celix Apps is the data controller for any personal data you voluntarily provide to us (e.g., support emails). For data stored on your device or in your personal iCloud account, Apple Inc. acts as a separate data controller under its own privacy policy.

Lawful Basis for Processing:

• Consent — When you grant permissions for HealthKit, Calendar, Notifications, or Alarms, processing is based on your explicit consent. You may withdraw consent at any time via iOS Settings.
• Legitimate Interests — On-device diagnostic logging (OSLog) is based on our legitimate interest in maintaining app stability. This does not override your fundamental rights.
• Contract — Processing necessary to deliver the core features you requested when you downloaded the App.

Data Transfers: We do not transfer your personal data outside your device or your personal iCloud account. iCloud data transfers are governed by Apple's Data Processing Addendum and Standard Contractual Clauses where applicable.

Supervisory Authority: You have the right to lodge a complaint with the data protection authority in your EU/EEA member state. A full list of authorities is available at edpb.europa.eu.

16.2 United Kingdom — UK GDPR

If you are located in the United Kingdom, the UK GDPR and Data Protection Act 2018 apply. Your rights and our obligations mirror those described in the EU GDPR section above. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

16.3 California, United States — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we hold. Use the "Delete Account" feature in the App or contact us.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell, share, or otherwise disclose your personal information to third parties for cross-context behavioral advertising. No opt-out is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact us at support.shiftmate@icloud.com. We will respond within 45 days as required by law.

16.4 Brazil — LGPD

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018) applies. You have the following rights regarding your personal data:

• Confirmation of the existence of processing and access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Data portability to another service provider.
• Deletion of personal data processed with your consent.
• Information about third parties with whom data is shared.
• Information about the possibility of denying consent and the consequences thereof.
• Revocation of consent at any time.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

16.5 Canada — PIPEDA

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws apply. You have the right to access personal information we hold about you and to challenge its accuracy. You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

16.6 Australia — Privacy Act

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply. You may request access to or correction of your personal information, and you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16.7 TÜRKİYE — KVKK

If you are located in Türkiye, the Law on Protection of Personal Data No. 6698 (KVKK) applies. You have the right to apply to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) at kvkk.gov.tr if you believe your rights have been violated.

16.8 Other Jurisdictions

Regardless of your location, you may contact us at support.shiftmate@icloud.com to exercise any privacy rights afforded to you under your local law. We will make reasonable efforts to respond in accordance with applicable requirements.

17. Contact