Two different relationships
For your own account — the email you sign in with, your plan, your payments — Puppy Shifts decides what is held and why. We are the controller of that, in the language of data protection law.
For everything about the people who work for you, your business decides and we act on your instructions. Their names, their availability, what they asked to work, when they were away — you chose to collect it, and we hold it for you. If you work for one of our customers and want to know what is held about you, ask your employer: they can show you, correct it and erase it themselves, and we cannot lawfully hand it to somebody we cannot identify.
What is actually stored
Nothing here is a category we might one day collect. It is the list of what the software writes down.
- Your business: its name, its locations, the shifts it runs, how many people each needs, and the scheduling rules you chose.
- The people who work there: the name you enter, their start date (which decides who wins a shift two people asked for), any caps on their hours or shifts, the roles and teams you gave them, and — if you use the birthday bonus — a month and a day, deliberately with no year.
- How they sign in: a PIN, stored only as a salted hash. Nothing anywhere stores a PIN we could read, including us.
- What they tell you: when they can work, which shifts they would prefer and in what order, how many hours they want, time off they asked for, and shifts they offered to give away or could not work.
- What happened: the schedules you built and published, who worked what, and any hours you imported.
- Money, only if you use it: pay rates with the dates they took effect, what a schedule cost, and daily takings if you enter them. These are behind a separate step inside the app, so a manager sees them only after asking to.
- Email addresses, entered by the person themselves: an employee can add their own address on their own phone to be told when a schedule is published. Their manager sees whether it is switched on, and not what it is.
- A record of what was done: who changed what and when, so that "the software changed my schedule" is a question with an answer.
Reasons people give, and why they are handled differently
Time off can be marked as sickness, and a request or a call-out can carry a sentence explaining it. Together that can amount to information about someone’s health, which is the most sensitive thing this software holds.
So it is not treated like the rest. The words somebody wrote never travel in a list and are never on a screen next to everybody else’s: a manager sees that a note exists, and opening one is a deliberate act that is recorded. Whether an absence is sickness or holiday stays visible, because they are paid differently and a schedule has to know.
If you are a business using this: you still need your own lawful basis for holding it, and asking for medical detail in a free-text box is usually a bad idea. The box exists for "back Tuesday", not for a diagnosis.
Who else touches it
The suppliers needed to run the service. There is no advertising network in this list, and there is no data broker in it.
- Clerk — sign-in for managers. Holds your email address and password; never sees your team’s data.
- Stripe — payments. Card details go straight to Stripe and never reach our servers.
- Resend — email delivery. Sees the address a message goes to and what it says.
- Render — hosting and the database, in the United States. Everything above lives there.
Cookies
Three, and this is all of them.
- One that keeps you signed in.
- A token your browser keeps so your team does not type a PIN on every screen.
- ps_ref, which records how you first arrived — the campaign in the link you clicked, and the site that linked to you, as a bare hostname. It is set only if you arrive from a link that says something; type the address in and there is no cookie at all. It lasts a month, it holds no identifier of any kind, it is never read by anybody else, and its only use is telling us which of the places we advertise actually brings businesses that use this.
How long it is kept, and how to get rid of it
While your account is open, your data stays — a schedule is only useful against the ones before it.
You can erase an individual at any time. That clears their name everywhere it appears, including the copy written onto past schedules, and deletes their PIN and anything they typed. What survives is the shift record itself, under a meaningless identifier, because a business cannot erase somebody out of last year’s wage bill and still balance it — and the record of who did what stays too, renamed rather than deleted, because an erasure request must not become a way to quietly destroy an audit trail.
You can also export everything and close the account, which removes it.
How it is kept apart
Every table in the database is fenced by the business it belongs to, at the database level rather than in application code — a query that forgets to filter returns nothing rather than somebody else’s roster. PINs are hashed. Anything about pay is behind a separate step in the app. Traffic is encrypted in transit.
We are a small operation and we would rather say that plainly than imply a security department. If you find a problem, write to hello@puppyshifts.com and we will take it seriously.
Your rights
Depending on where you are, you can ask for a copy of what is held about you, have it corrected, have it deleted, or object to how it is used. If you run a business here, write to hello@puppyshifts.com. If you work for one of our customers, ask your employer first — they hold the account and can do all of it themselves, faster than we can.
Children
This service is sold to businesses, not to individuals, and it is not meant for children to sign up to. A business may well schedule people under 18, which is normal in hospitality and retail; making sure that is lawful where you are, including the rules about hours and rest for young workers, is part of running the business and not something this software checks for you.
Changes, and who to ask
We will change this page when the software changes, and the date at the top says when the current version started. Anything at all: hello@puppyshifts.com.
You already have most of the information needed to build next week.
It is in texts, conversations, notes and memory, and every week somebody has to turn all of it into one schedule. Puppy gives it somewhere useful to go.
From $12 a month billed yearly, or $19 monthly. Your whole team included.