Privacy policy

What Shifted collects, why, who can see it, and what you control. Written to be read.

Who we are

Shifted is a shift-tracking app for youth hockey, built and operated by its founders in California. This policy covers the Shifted app and the website at shiftedsports.com. When we say "we", we mean the Shifted team; when we say "you", we mean the adult using the app or the site.

What we collect

Your account

An email address, a password, and an optional display name. Passwords are handled by our authentication provider and are never stored in plain text.

Athletes

The name or nickname you enter, an optional birth year, and, when an athlete is on a roster, a position and jersey number. We don't ask for a child's birthdate, school, address, phone number or email address, and the app is designed not to need them.

Teams

Team name, colors, logo, home rink, age division and level, the organization it belongs to, and the settings you choose for the team directory and roster sharing. Opponent teams and players you add are stored as the text you type.

Games and tracking

Opponents, dates, rinks, scores and game events; the shifts you time and the actions you tap; and any notes you add. Tracking sessions are saved on your device first so the app works with no signal, and they sync to your account when you're back online.

The website

If you request beta access, we keep the email address you give us, the role you pick, and the technical details that arrive with the request: country, browser, and the page you came from. If you write to support, we keep your message, your email address, and your name if you give it. The website sets no cookies and runs no analytics.

Technical data

Our hosting providers keep standard server logs, including IP addresses and request times, for security and reliability. The app records basic error and sync information so we can fix problems.

How we use it

• To run Shifted: accounts, syncing, and the sharing features you choose to use.
• To reply to you: beta invitations, support, and notices about the service.
• To keep the service safe and working.
• To understand how Shifted is used, in aggregate, so we can improve it.

We don't use your information for advertising, and we don't sell it or share it for cross-context behavioral advertising.

Who can see what inside Shifted

Your athletes and games are private to your account by default. Visibility changes only when you take an action:

• Inviting another guardian connects a second adult to the same athlete.
• Joining a team makes roster details visible to that team's owner and staff, according to the roles they hold.
• Sharing a game link lets people who open it follow the score, period and play-by-play with a free account. Player statistics are hidden from viewers unless the scorekeeper turns them on for that game.
• Listing a team in the directory shows the team's name and details to other Shifted users. Roster sharing is a separate, opt-in setting that lets a team you exchange with see names and numbers.

Providers we rely on

Shifted runs on services that process data on our behalf and under our instructions: Supabase for the database, authentication and file storage; Cloudflare for the website, its security, and the beta-request and support records; Resend for the email we send; Expo for building the app; and Apple for distributing the iOS beta. We don't give any of them the right to use your information for their own purposes.

Children

Shifted accounts are for adults: parents, guardians, coaches and team staff. We don't knowingly let children under 13 create accounts, and we don't collect information from children directly. Adults enter information about the athletes they are responsible for, and we keep that information to the minimum the app needs. If you believe a child has created an account, tell us on the support page and we'll delete it.

How long we keep it, and how to delete it

We keep your information while your account is active. Athletes you archive keep their history so they can be restored. To delete your account and everything in it, ask us on the support page from the email address on the account; we complete deletions within 30 days, and copies in routine backups are removed as those backups cycle out. Beta requests are kept until we've either invited you or you ask us to remove them.

Security

Everything travels over HTTPS. The database enforces access rules per row, so an account can only read what it's allowed to see. Passwords are never stored in plain text, and data saved on your device for offline use sits under your device's own protection. No system is perfectly secure; if you find a problem, please tell us.

Your rights

Whoever you are, you can ask us for a copy of your information, ask us to correct it, or ask us to delete it. California residents also have the rights described in the California Consumer Privacy Act: to know what personal information we collect and how we use it, to delete it, to correct it, to receive it in a portable form, and not to be treated differently for exercising those rights. We don't sell or share personal information, so there is nothing to opt out of, and browser signals such as Global Privacy Control need no action from us. To make a request, use the support page; we verify requests through the email address on your account, and an authorized agent may act for you with your written permission.

Where the data lives

Shifted is operated from the United States and its data is stored there. If you use Shifted from somewhere else, your information is processed in the United States.

Changes to this policy

When we change this policy we'll post the new version here with a new effective date, and for material changes we'll tell you in the app or by email.

Contact

Questions, requests and concerns go through the support page. A real person reads them.