Your schedule is personal.

Here is how the native iPhone app and the Shiftpup web beta handle your information.

iPhone app: on-device recognition

The native iPhone app recognizes selected schedule photos using Apple Vision on your device. It does not send your photos to OpenAI or the website scanner. Job profiles, reviewed shifts and smaller source-photo previews are saved in the app’s local storage, which is excluded from device backups. Use the app’s deletion controls to remove local data; deleting local data does not remove events you already saved to Calendar or files you shared.

The app requests write-only Calendar permission to save reviewed events to your default calendar. Your calendar provider may synchronize those events according to your calendar settings. Exported calendar files are shared only through the destinations you choose. The app does not provide account-based schedule synchronization.

Optional iPhone purchases and subscription checks use Apple StoreKit. Apple handles purchase and payment information; Shiftpup checks verified transactions on the device to determine Pro access. The website’s cloud-scanning and optional-account practices below describe the web tool separately.

Website: photos and the free scanner

Choosing a photo prepares a smaller copy in your browser and removes its original file metadata. When you select Scan my schedule and consent, that image, your entered roster name, week and workplace time zone are sent through our Cloudflare Worker to OpenAI for interpretation.

Shiftpup does not save uploaded images or extracted schedules to a server database, analytics or application logs. Drafts stay in this open browser page and are lost when you close or reload it. The sample and manual editor do not call OpenAI. Crop out coworker details you do not need to share.

We ask OpenAI not to store the response by setting store:false. This is not a promise of zero retention: OpenAI may retain API data for abuse monitoring under its data policies. Cloudflare handles network requests under its service policies.

Usage controls

To keep scanning affordable, we use Cloudflare Turnstile and short-lived request counters. We derive a one-way keyed hash from your network IP address for scanner quotas; the quota store does not retain your raw IP. Daily quota data expires through cleanup. Turnstile and hosting providers process technical connection data needed to deliver and protect the service.

Optional accounts

If accounts are enabled, we store your chosen handle, public passkey information and sign-in records in Cloudflare D1. Your private passkey stays with your device or password manager. Secure cookies hold an account session and a short-lived authentication challenge. Handles are not verified names or email addresses.

Accounts do not sync schedules or grant paid features in this beta. You can delete an account from its page after verifying your passkey again. Expired sessions and challenges are cleaned up. No email or password recovery is available.

Calendar files

A downloaded ICS file contains the shifts you reviewed. You control where you save, import or share it. Sending it by email or adding it to a shared calendar gives that provider or calendar members access to its contents. A downloaded file does not synchronize with an employer roster.

Analytics and advertising

This build includes no third-party advertising, session replay, or marketing analytics. We do not sell schedule data.

Questions

Service operator: Bryton Zoz / Shiftpup. For a privacy question, use Shiftpup support. Please do not post private schedules in public issues.