Last updated: October 4, 2026
Digital Nafta Portal FZCO ("we", "us", or "our") operates the ShiftWallet mobile application (the "App"). This Privacy Policy explains how we collect, use, and protect your information when you use our App. It applies to ShiftWallet 2.2 and later.
Company: Digital Nafta Portal FZCO
Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE
License: IFZA/DIEZ License 78656
Contact: jan@digitalnafta.com
In short: pay calculations run on your device. Your work data is backed up to our cloud on Google Firebase, even if you never create an account. If you use the AI features, the paycheck or roster photo you choose, and for a paycheck the shifts of that pay period, are sent to OpenAI through our secure relay, which does not store them. OpenAI may keep them for up to 30 days to detect abuse and does not use them to train its models. If you import your roster from a calendar, the App reads the calendars you pick on your device and does not upload them. We use analytics and crash reports to improve the App. We do not show ads and we do not sell your data.
When you open the App for the first time, it creates an anonymous account with Firebase Authentication. This account is a random user ID with no name or email, and it lets the App back up your data before you sign in. If you create an account, we collect your email address, the identifier of your sign-in provider and, if you type one or your Apple ID or Google account provides it, your name. When you sign in, your anonymous account is linked to your new account so your data carries over. We do not store your passwords directly. If you use Sign in with Apple, we also keep the token Apple issues so we can revoke it when you delete your account.
The App lets you log jobs, shifts, hours, earnings, and paycheck details. This data is stored on your device using SwiftData and is backed up and synced to Firebase Firestore under your user ID, whether you use an anonymous account or a signed-in account. It includes:
Some things stay on your device only and are not synced: the planned shifts you import from a roster (until you log them as worked shifts), and the payslip details you enter for the German take-home estimate (tax class, children, church membership, state and age group).
The on-device database is also included in your device backups (iCloud or computer), which Apple stores and protects under your Apple Account.
While a shift is running with a Live Activity on your Lock Screen, the App stores a push token for that Live Activity together with the shift start time, your earnings so far, the earnings rate, the currency and the break status in Firestore. A Cloud Function uses them to advance the earnings shown on your Lock Screen through Apple Push Notification service. This record is removed when the shift ends.
ShiftWallet offers an optional geofencing feature that can remind you to clock in or out when you arrive at or leave a workplace you added, or clock you in and out automatically if you turn that on for the job. Location is read with iOS Core Location and is only used when you explicitly grant permission. If you have granted location permission, the App also records the location where you clock in, whether you use the clock-in button or an automatic clock in. The workplace location you set and these clock-in locations are saved with your work data and synced to Firestore like the rest of it. When you export a proof of hours, clock-in places are only included if you switch that option on (it is off by default), and the file goes only where you choose to share it. You can revoke location access at any time in your device Settings. We do not share location data with third parties.
The App accesses your iOS Calendar through EventKit for two optional features, and only with your explicit permission:
We do not store or upload your calendar entries. Only the shifts you import or log become part of your work data.
ShiftWallet uses RevenueCat to validate purchases, restore access, and display subscription offers. We send RevenueCat your purchase receipts or transaction information, product identifiers, subscription, trial and entitlement status, and a pseudonymous app user identifier. This identifier is a random value stored on your device. It may persist after sign-out or reinstallation, and it is the same identifier we use for analytics and attach to App Store purchases (as the purchase account token). RevenueCat also processes technical information such as app and operating-system versions and the offers you view in the App. We do not send your shift records, paycheck or roster images, or Apple Account password to RevenueCat. Apple processes payments, and we do not receive your full payment-card details.
We use Google Analytics for Firebase to understand how the App is used and to fix problems in the user journey. Analytics events are associated with the pseudonymous app user identifier described above and with identifiers that Firebase generates for your app installation and the identifier for vendor (IDFV) that iOS assigns to our apps on your device, not with your name or email. They include in-app actions (for example creating a job, logging a shift with its duration and its minutes of night work, overtime and breaks, verifying a paycheck, viewing an offer, or buying), your onboarding answers, approximate settings such as app language, work country, currency, Pro status and broad ranges of hourly rate or paycheck difference, purchase details (product, price, and transaction ID), and technical data such as app version, device model, and an approximate location that Google derives from your IP address. We do not send your hourly rate, earnings, paycheck amounts, paycheck contents, or notes to Google Analytics, only broad ranges.
If you installed the App from an Apple Ads campaign, the App asks Apple's AdServices framework for the campaign details (campaign, ad group, keyword, and click date) and records them in analytics so we can measure our own advertising. Purchase events recorded in Google Analytics may be imported into Google Ads as conversions so we can measure our own campaigns. The App never asks for permission to track you, so your device's advertising identifier (IDFA) is not available to us. We do not show ads and we do not track you across other companies' apps and websites.
We use Firebase Crashlytics to collect crash logs and diagnostic data. This helps us identify and fix bugs. Crash reports may include device model, OS version, app state, and stack traces. We do not attach your user ID, name, or email to crash reports.
The App uses Firebase Remote Config to receive default labor rules by country, Firebase App Check to confirm that requests to our servers come from the genuine App, and Firebase Cloud Messaging for push notifications. These services process technical identifiers generated for your app installation and basic device and app information.
Our Cloud Functions also write short operational logs when your synced records are processed (for example your user ID, the record ID, the gross pay of a finished shift, or the result of a paycheck verification). They are used only for troubleshooting and are kept for a limited period (30 days by default in Google Cloud Logging).
ShiftWallet can access your camera, photo library, or files for these optional purposes:
Access is only granted with your explicit permission and only the image or file you select is used. We do not browse, copy, or upload other images or files.
Clock reminders and payday reminders are scheduled on your device as local notifications. The actions ShiftWallet offers to Siri and the Shortcuts app (for example clocking in or out, the total of your pay period, or logging hours by voice) run on your device. Apple handles the speech recognition and passes the App only the text. If you start an action from an NFC tag, that is an automation you set up in the Shortcuts app, and ShiftWallet does not read the tag.
If you contact support from the App, your email app opens a message with the app version, iOS version, and device model filled in. We receive it only if you choose to send it, and we keep it to answer you.
ShiftWallet does not collect or access:
We use the information we collect to:
We process your data to provide the service you ask for (contract), and for our legitimate interest in keeping the App secure, measuring and improving it, and measuring our own marketing. You can object to processing based on legitimate interests at any time (see Section 11).
Core ShiftWallet functionality (clock in and out, hour tracking, pay calculation with differentials such as night, overtime and holiday pay, tax and take-home estimates, paycheck verification math, roster reading from files and photos with on-device text recognition, and reports) is performed on your device. The results are saved with your work data and backed up as described in Section 1. For records synced by older versions of the App that did not include a pay breakdown, our servers may compute the same breakdown from the synced shift and job data. While a Live Activity is running, a Cloud Function also advances the earnings shown on your Lock Screen, as described in Section 1.
ShiftWallet offers AI-assisted features that you choose to use. The App asks for your consent before the first use:
ShiftWallet's secure AI relay. These requests always go from the App to our relay (a Google Cloud Function called aiProxy, in the United States), which checks that you are signed in to your ShiftWallet account (anonymous or not), uses Firebase App Check to verify that the request comes from the genuine App, applies a daily fair-use limit, and forwards the request to OpenAI using our own OpenAI account. If you have ShiftWallet Pro without a signed-in account, the App also sends the relay the App Store-signed record of your Pro purchase so the relay can apply the Pro limit. The relay only checks that record and does not store it. You do not need an API key. The relay does not store the paycheck, the roster photo, the prompt, or the answer. It keeps a usage counter per user ID and day (date, number of requests, and last update) to apply a daily fair-use limit, and short technical logs (user ID, model, time, and errors) for security and troubleshooting, without the content of your requests.
OpenAI's role. OpenAI, L.L.C. processes these requests on our behalf as our service provider under its API business terms, and does not receive your name, email, or ShiftWallet user ID from us. Keep in mind that a paycheck or roster image can itself contain your name, your employer, colleagues' names, and other personal details. Under OpenAI's API data policy, API content is not used to train OpenAI's models and may be kept for up to 30 days to detect abuse before it is deleted, unless OpenAI is legally required to keep it longer. See the OpenAI Privacy Policy.
No personal API keys. Earlier versions let you enter your own OpenAI API key. ShiftWallet 2.2 removes that option: the AI features only use our relay, and the App deletes any key that was stored in the iOS Keychain on your device. It was never sent to our servers.
The results of a verification (for example the amounts and the difference) are saved with your work data as described in Section 1. The AI features are optional, and you can read how they work in Settings > AI Features.
ShiftWallet uses the following service providers, which process data on our behalf:
We do not sell, rent, or share your personal data with any other third parties.
Your work data is retained for as long as your account (anonymous or signed-in) exists. If you delete your account (Settings > Delete Account), your authentication and work data is permanently removed from our servers within 30 days. Local data on your device, including planned shifts and the German payslip details, is deleted immediately upon account deletion.
If you use the App without creating an account, your data stays linked to an anonymous account. You can erase it from our servers at any time with Settings > Clear Local Data, which removes your data from this device and from its cloud backup. If you delete the App without creating an account, you may lose access to that backup, so create an account if you want to keep it.
The AI relay does not keep the content of your requests. Its daily usage counters are deleted with your account, and its technical logs are kept for a limited period for security and troubleshooting. Analytics data is kept for the retention period configured in Google Analytics (no longer than 14 months for event-level data) and is tied to the pseudonymous app identifier, not to your account, so it is not removed automatically when you delete your account. Crash reports are kept by Crashlytics for a limited period.
Purchase records are handled separately from work and authentication data. Deleting a ShiftWallet account does not cancel an Apple subscription or automatically delete the purchase records used to restore access. To request deletion of purchase-related or analytics data held by us or our processors, contact jan@digitalnafta.com. We will assess the request and any applicable retention obligations.
You can delete your account at any time by going to Settings > Delete Account within the App while signed in. This action will:
This action is irreversible. We keep a minimal deletion record (user ID, date, a masked email, and the number of records deleted) to prove the deletion was done.
We implement industry-standard security measures to protect your data, including:
ShiftWallet is not designed for or directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information promptly.
Depending on your jurisdiction, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at jan@digitalnafta.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
Your data may be processed in countries outside your country of residence through our use of Firebase and Google Cloud (including the AI relay in the United States). Google maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses where applicable.
OpenAI processes AI requests in the United States. RevenueCat may process purchase and technical data outside your country, including in the United States, and its Data Processing Addendum describes the safeguards applicable to these transfers.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy within the App and updating the "Last updated" date. Your continued use of the App after changes constitutes acceptance of the revised policy.
If you have questions or concerns about this Privacy Policy, please contact us:
Email: jan@digitalnafta.com
Company: Digital Nafta Portal FZCO
Address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE