Privacy policy

Last updated: 29 October 2026

JustShift is a team rota and shift scheduling service operated by Jabe Peake. This policy explains how the service handles personal information, including information used by the optional Google Calendar connection. Contact jabe@thepeakes.com about privacy, access or deletion requests.

Information we process and why

We process account details such as your name, email address and protected password information, together with team membership, rota assignments, availability, shift requests and information entered by you or your team administrators. We use this information to provide accounts, organise schedules, control team access and deliver requested notifications and schedule emails. Email messages can include text provided by your administrator.

Leave, sickness and notes entered into a rota may contain sensitive information. Only enter information needed for scheduling. Your team administrator manages the schedule and team access; contact them about corrections to team records.

Google Calendar: access and use

Connecting Google Calendar is optional and requires your permission through Google. JustShift requests https://www.googleapis.com/auth/calendar.app.created, which allows creation of secondary calendars and management of events on app-created calendars. We use it to create a My Shifts calendar and synchronise your eligible, revealed work, overtime and on-call shifts. We do not request access to your primary calendar or use the connection to read your personal plans.

Events sent to Google contain your team name, shift status, start and end times, and a short description identifying the sync. Leave, sickness, availability and internal shift notes are excluded. Google processes calendar information under its own privacy policy. Any calendar sharing settings you apply in Google also affect who can see those events.

Google Calendar: storage and protection

We store an encrypted refresh token so background synchronisation can continue without repeated sign-in. Short-lived access tokens are used to call Google’s API. We store the app-created calendar ID, event IDs, links to rota occurrences, event times, change fingerprints and sync status to maintain the connection and avoid duplicate events. The encryption key is configured separately from the database. Access to the service is controlled through authenticated accounts and team permissions.

Google data sharing and Limited Use

Google user data is used only to provide and maintain the calendar connection described here. We do not sell it, use it for advertising, or use it to train artificial intelligence or machine learning models. JustShift’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google connection data is not made available to other team members through JustShift. Access by people is limited to what is necessary for authorised support, security, legal obligations or operating the integration. Service providers supporting hosting and operation may process information for those purposes. JustShift is hosted using Amazon Web Services; email delivery also involves the configured email service provider. We may disclose information where legally required.

Disconnecting, retention and deletion

You can disconnect under Google Calendar in your JustShift account. Disconnecting removes the stored refresh token and stops automatic updates. You can first choose to remove tracked shift events, including historical ones; otherwise those events and the calendar remain in Google. You can also revoke access through your Google Account’s third-party connections settings.

Disconnecting does not itself delete your JustShift account, rota records or stored sync metadata. Completed synced events are retained as calendar history unless removed. Account and rota data are retained while needed to provide the service and administer the team. Contact us to request deletion of your account, remaining Google connection metadata or other personal data. We will explain any information that must be retained for legal or security reasons; backup copies may remain until their normal replacement.

Your choices and requests

You can ask to access, correct or delete your personal information, and raise concerns about its use, by emailing us. Depending on applicable law, you may also have rights to restriction, objection, portability and to complain to your data protection authority. Where processing depends on consent, you can withdraw it, including by disconnecting Google Calendar. We may need to verify your identity before acting on a request.

Cookies and technical information

If you use the AI scheduling assistant, your instructions and relevant scheduling information used by that feature are processed through OpenAI’s API. Avoid including unnecessary personal or sensitive information in requests. The Google Calendar connection does not supply Google API data to the AI assistant.

JustShift uses session and security cookies to keep you signed in, protect forms and remember application choices. Hosting and application logs may contain technical information such as IP addresses, request details and errors, used to operate, troubleshoot and secure the service.

Changes and contact

We update this page when our practices change and show the revision date above. Questions or requests: Jabe Peake, jabe@thepeakes.com.