WorkHalo ("we," "our," "us") is a workforce scheduling service for businesses. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. We've tried to write it in plain language — if anything is unclear, email us at devin@workhalo.app.
1. Who We Are
WorkHalo provides scheduling, shift management, time-off, and shift-swap tools to small and mid-sized businesses through a web app and mobile app. Our customers are businesses; the people who use the app are managers and employees of those businesses.
2. Information We Collect
Information you give us
- Account information. Email address, name, and (if you choose) phone number when an account is created for you.
- Authentication. A securely hashed password (we never see or store your plaintext password). If you enable Face ID or Touch ID on your device, that biometric data stays on your device — it never leaves.
- Schedule and work information. Your shifts, availability, time-off requests, and shift-swap requests.
- Communications. If you contact us for support, we keep a record of that communication.
Information we collect automatically
- Device information. Device type, operating system version, app version. Used to diagnose crashes and ensure compatibility.
- Push notification token. A device-specific identifier we use to deliver schedule and shift notifications. We do not use it for advertising.
- Crash and performance data. When the app crashes or experiences an error, we receive a diagnostic report through Sentry. These reports include device type, OS version, and a stack trace, but we do not include your name, email, or schedule contents.
- Audit log. When you take significant actions in the app (creating an employee, publishing a schedule, approving a swap), we record that action with a timestamp so your business can audit who did what.
Information we do NOT collect
- We do not track your activity across other apps or websites.
- We do not collect data for advertising purposes.
- We do not sell your personal information to anyone, ever.
- We do not access your contacts, photos, microphone, or camera.
3. How We Use Your Information
We use the information we collect to:
- Operate the WorkHalo service — log you in, show your schedule, deliver notifications, process shift swaps and time-off requests.
- Communicate with you about your account, service updates, security notices, and customer support.
- Diagnose technical problems and improve the app's stability and performance.
- Meet legal and tax obligations, prevent fraud, and enforce our Terms of Service.
4. Who We Share Information With
We share information only when one of the following applies:
With your business. Your employer or business owner has access to your work-related data — schedule, availability, time-off requests, clock-in records — because they are the WorkHalo customer. This is the core function of the service. We do not share your work data with anyone outside your business.
With service providers we depend on. We use a small number of third-party services to operate WorkHalo, each handling a specific function:
- Railway — hosts our servers and database
- Resend — delivers email notifications (e.g., shift-published emails, password resets)
- Twilio — delivers the one text message sent when a business adds you to its team schedule
- Expo Push / Apple Push Notification service / Firebase Cloud Messaging — delivers push notifications to your phone
- Sentry — captures crash reports and performance data
- Open-Meteo — provides weather forecasts shown on the schedule (anonymous, no personal data sent)
- Stripe — processes payment from businesses that subscribe to WorkHalo (we never see your business's card details)
Each of these providers has its own privacy practices. We share only the minimum information needed for them to perform their function, and we have agreements with them to handle data appropriately.
If required by law. If we receive a valid legal request (subpoena, court order), we may disclose information to comply. We will resist overbroad requests where we can, and notify affected users if legally permitted.
In the event of a business transfer. If WorkHalo is acquired or merges with another company, your information may transfer to the new owner — but the new owner must continue to honor the protections in this Privacy Policy.
5. How Long We Keep Your Information
We keep your information for as long as your account is active. If your business deletes you as an employee, or if you delete your own account, we remove your personal information within 30 days, except:
- Audit log entries and historical schedules may be retained for your business's records (typically 1-7 years depending on local labor law).
- Information we are legally required to keep (e.g., for tax, accounting, or fraud-prevention reasons).
- Anonymized, aggregated data that no longer identifies you (e.g., usage statistics).
6. Your Choices and Rights
Delete your account. You can delete your account from inside the app (Settings → Delete Account on mobile, or contact your manager on web). Account deletion is permanent and removes your personal information from our active systems within 30 days.
Access or correct your information. You can update your name, email, and other profile details in the app. To request a copy of your data or correction of inaccurate information, email devin@workhalo.app and we'll respond within 30 days.
Manage push notifications. You can disable push notifications in your device's Settings, or per-category in the app's Settings → Notifications.
California residents (CCPA). If you live in California, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, and the right not to be discriminated against for exercising those rights. We do not sell personal information. To exercise these rights, email us.
European residents (GDPR). If you live in the European Union, the United Kingdom, or another GDPR-protected jurisdiction, you have rights including access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint with a supervisory authority. To exercise these rights, email us.
7. Children's Privacy
WorkHalo is designed for businesses and their employees, who are typically 16 years or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it.
8. Security
We take security seriously. We use industry-standard encryption in transit (TLS/HTTPS) and at rest (encrypted database), bcrypt for password hashing, JWTs with short expiration for authentication, and follow the principle of least privilege for access to production systems. No system is perfectly secure, but we make a serious effort to protect your data.
If we ever experience a security breach that affects your information, we will notify you within a reasonable time, in accordance with applicable law.
9. International Users
WorkHalo is operated from the United States. Our servers are located in the United States. If you use WorkHalo from outside the United States, you understand that your information will be transferred to and stored in the United States, which may have different data-protection laws than your country.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and post a notice in the app. The "Last updated" date at the top of this page tells you when this version took effect.
11. SMS / Text Messaging
When a business adds you to its team schedule in WorkHalo, the manager may enter your mobile number and, after confirming that you agreed, have WorkHalo send you one text message. It tells you which business added you and where to get the WorkHalo app. We use Twilio as our messaging provider: Twilio delivers the message and does not use your number for its own purposes. We do not share, sell, or rent mobile phone numbers to third parties for marketing or promotional purposes. WorkHalo sends no other texts to it. The number is kept on your employee record, where the managers of the business that added you can see it, and may be used to sign you in to the app.
Message frequency: one message per team invitation. We do not send marketing texts.
Message and data rates may apply. Reply STOP at any time to opt out of WorkHalo texts; reply HELP for help.
12. How to Contact Us
For questions, concerns, or requests about this Privacy Policy or your data, contact:
WorkHalo
Email: devin@workhalo.app
Web: https://workhalo.app
This Privacy Policy is provided in good faith and reflects our current data practices. It is not a substitute for legal advice; consult a qualified attorney for questions about your specific situation.