Privacy Policy

1. Data we collect

AfterDuty does not collect, store, process or transmit personal data to the developer or to any third-party servers. Specifically, the App has:

• No account creation
• No email collection
• No analytics or tracking
• No advertising identifiers
• No third-party SDKs
• No way for us to read your data (the only server we run holds roster links you choose to create, and only as encrypted data, see section 3)

2. Data stored on your device

The App stores the following on your device, using Apple’s native iOS storage frameworks: shift schedules, jobs and custom shift types, notes and day markers, rotation patterns, wellbeing check-ins you choose to log (how a shift went, with optional tags), shift alarm settings, and app preferences. The developer has no access to this data.

If you use the Apple Watch app, AfterDuty copies the upcoming part of your rota (shifts, times, job codes, notes and the time of your next alarm) from your iPhone to your Apple Watch, using Apple’s own connection between the two devices. It stays on those two devices and the developer cannot access it.

Widgets read the same data from your device to show your upcoming shifts. If you delete the App, its data may be removed unless it is included in your device or iCloud backups.

3. iCloud sync, backup and sharing

If iCloud is enabled on your device, AfterDuty can use Apple’s CloudKit to back up and sync your rota across your own devices. This data is stored in your private iCloud account and is governed by Apple’s terms. The developer cannot read it.

If you choose to share your rota with friends or colleagues, AfterDuty creates a private link. Your device encrypts the shared rota (your shifts, shift types and the display name you choose, but not your notes) before it leaves your phone, and uploads only the encrypted data to a small service on afterduty.party, run on Cloudflare. The key that unlocks it exists only inside the link and on your device. It is never sent to us, so we cannot read your rota.

Anyone who has the full link can view that rota, in the App or in a web browser, so share it only with people you trust. You can stop sharing at any time from the App, which deletes the uploaded data and makes the link stop working. A shared rota that is not updated for 120 days is deleted automatically. The service stores no names, emails or accounts. To limit abuse, a salted, one-way hash of your IP address is kept for up to a few hours and then deleted. Rotas that others share with you are saved on your device so you can open them again without the link.

The name you choose is also written into the link itself (for example afterduty.party/r/…?n=Ana), together with your app’s language, so chat apps can show a preview such as “Ana’s roster”. Unlike the roster, the name is not encrypted: the apps that carry the link can see it, and so can our servers when the link is opened, although they do not store it. Leave the name blank to keep it out of the link.

If a friend sends you a roster link before you have AfterDuty, the website copies that link to your clipboard when you tap the App Store button, so the app can open it after you install. Once, when you finish setting up, the app checks whether your clipboard holds an AfterDuty roster link. It reads the clipboard only for that, ignores anything else on it, and neither keeps nor sends what else is there. iOS asks for your permission before the app can read it.

4. Calendar access

Calendar access is optional and only requested when you turn on a feature that needs it:

• Full access lets AfterDuty display events from the calendars you select alongside your shifts and in widgets. Selected event details may be cached on your device so widgets can show them; AfterDuty never edits those events.
• Write-only access lets AfterDuty export your shifts and notes to a calendar you choose.

Calendar data never leaves your device through AfterDuty. You can change these permissions at any time in iOS Settings.

5. Notifications and alarms

Reminders (for example before a shift, or when next month’s rota is still empty) are scheduled locally on your device. No notification content is sent to our servers.

Shift alarms (AfterDuty Pro) use Apple’s alarm system. They are set on your device from your rota, after you give permission, and nothing about them is sent to our servers.

6. Purchases and subscriptions

AfterDuty Pro is sold through the App Store using Apple’s StoreKit. Payments and subscription status are handled entirely by Apple; the developer does not receive your payment or billing details. Subscriptions renew automatically unless cancelled in your Apple ID settings.

Your use of Apple services is governed by Apple’s Privacy Policy: www.apple.com/legal/privacy/

7. This website

afterduty.party sets no cookies and loads no advertising trackers, with one exception described in the next paragraph. To understand how many people visit and which pages they read, it uses Cloudflare Web Analytics, a privacy-focused tool that does not use cookies or similar storage on your device and does not follow you across other websites. We only see aggregate figures, such as page views, country, device type and the site that sent you here, never a profile of an individual visitor. When you tap an App Store button, the site also adds one to a daily count for that page and campaign label (for example, which ad sent you); the count holds no IP address, cookie or identifier. The site also stores your language choice in your browser’s local storage so we can show you the right language next time; this never leaves your device.

Pages that visitors reach from our ads on Facebook and Instagram (the landing pages for nurses) offer a choice in a banner: the Meta pixel. If you press Accept, Meta’s pixel loads in your browser and sets cookies, so that Meta can tell us which ads led to a visit and to a tap on the App Store button. Meta receives your IP address, browser details and these events. Meta’s own use of that data is described in Meta’s privacy policy. If you press Decline, or do nothing, the pixel is not loaded and nothing is sent to Meta. Your choice is stored in your browser’s local storage. To change it, clear this site’s data in your browser settings and the banner will ask again. The App itself contains no Meta code.

The site is hosted by Cloudflare, which processes technical data such as IP addresses to deliver the pages and protect the site from abuse, in line with Cloudflare’s privacy policy. We do not receive or keep logs of individual visitors; the only statistics we see are the aggregate figures from Cloudflare Web Analytics described above.

Shared roster pages (afterduty.party/r/…) load the encrypted roster from our service and decrypt it in your browser; the key stays in the link and is never sent to us. When you tap the App Store button on one of these pages, the page copies its link to your clipboard so the app can open it after you install.

8. Data sharing

We do not share, sell, rent or disclose personal information to anyone.

9. Your rights (GDPR and other laws)

If you are in the European Economic Area, the United Kingdom or another jurisdiction with data protection laws: because the developer does not process your personal data, there is no developer-held data to access, correct, erase or port. You stay in control of your data through your device and your iCloud account. Data processed by Apple or Cloudflare is governed by their privacy policies and applicable law.

You also have the right to lodge a complaint with your data protection authority. In Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD).

10. Children

AfterDuty does not knowingly collect personal data from anyone, including children under 13 (or the equivalent minimum age in your jurisdiction).

11. Security

Your data stays on your device and in your own iCloud, protected by the security features of iOS and your Apple Account. Rotas you share by link are encrypted on your device with a key we never receive, so the data we hold is unreadable to us.

12. Changes to this policy

We may update this policy from time to time. Changes are reflected by the “Last updated” date on this page. Continued use of the App after changes means you accept the updated policy.

13. Contact

Questions about this policy? Contact João Reis at app@afterduty.party.