Privacy policy

Yehuda Raanan publishes ShiftPT. This policy describes the ShiftPT server. ChatGPT, Auth0, Google, and Google Cloud also apply their own privacy terms.

Data used

• An Auth0 issuer and account identifier authenticate each caller.
• Google OAuth credentials authorize the exact spreadsheets.readonly scope.
• Roster names, employee numbers, sites, dates, and shift times are processed only to answer the current request.

Storage and retention

The ShiftPT server does not store roster cell values, names, assignments, generated calendar bytes, or Google access tokens. It stores encrypted Google refresh credentials and short-lived linking records in Google Cloud Firestore. A retained grant expires no later than 30 days after linking and is removed earlier after disconnect or revocation.

Operational logs can contain request times, endpoint paths, request identifiers, and error codes. They are designed to exclude credentials and roster values.

Processors and location

ShiftPT uses Auth0 for sign-in, Google OAuth and Sheets for authorized roster reads, Google Cloud for hosting and encrypted grant storage, and OpenAI or ChatGPT as the user interface. These providers can process data outside Israel under their own terms.

Choices

You can disconnect Google access, revoke it in your Google Account, or ask support to delete the retained ShiftPT grant. ShiftPT does not sell personal data or use roster data for advertising.