Privacy Policy

Account information — Your email address and an encrypted password for authentication.

Location settings — Facility names, keywords, hourly rates, overtime rules, call compensation rates, rate schedules, and shift lengths that you enter.

Calendar data — If you connect a calendar, your read-only iCal subscription link is stored encrypted in your account settings. Our servers use it to fetch your calendar when your dashboard loads and once a day to send shift reminders you've turned on. From each event we read only its title and start/end times — never descriptions, locations, attendees, or contacts. Events that don't match one of your work keywords are ignored and immediately discarded; they are never saved or shown. One exception: if few or none of your events match a keyword while you're connecting your calendar, we show you (and only you) the names of shift-length events that repeat in your calendar, so you can pick the right keyword. Those names aren't saved. Matched work shifts (title, date, times, hours, location, and pay) are saved to your account so we can track pay and paychecks. They stay saved after your calendar stops showing them (some scheduling systems only publish the last few weeks), so your past months stay complete. If a shift is changed or removed in your calendar, your dashboard follows the calendar; our saved copy is kept but no longer shown, until you delete your saved shifts in Settings or delete your account. If you link a second calendar to track the hours you actually work, every event on it counts as time on site: we keep its times, and any title without one of your work keywords is replaced with "On site" before it's shown. We don't connect to Google or other calendar accounts directly today; if we add that, it will be read-only and this policy will be updated before it launches.

Dashboard preferences — Settings such as burnout thresholds, tax rate estimates, income goals, and display preferences.

Manual shift data — If you choose manual entry mode, the dates, hours, and location assignments for shifts you log are stored so your dashboard can display them.

Basic usage events — We log first-party events (such as which pages you visit and which features you use) to understand how the product is being used and improve the experience. Each event also records a rough region (state or province) and device type, taken from your connection — never your exact location or IP address. These events stay in our database, are never shared with any third party, and are not used for advertising or profiling.

On-site check-ins — If you use them, we save when you arrive at and leave a work site (and which site), to compare the hours you worked with your schedule. Automatic check-ins come from location automations you set up on your own phone; the app itself never reads your device's location.

Accountant records — Deposits, call-backs and income you enter in the Accountant tab are saved to your account so they're the same on all your devices.

Goals — If you set a goal (such as paying off student loans), we save its name, amount, how you're funding it and any amount you've already paid. It's only used to show your progress, and it's deleted when you remove the goal or delete your account. We never connect to your loan or bank accounts.

Support notes — We may keep brief internal notes about issues or conversations with you, so we can help you faster. Only Rebel's admin can see them, and they're deleted with your account.

Support messages — If you message us from Help in the app, your messages, our replies, the topic you pick and (if you leave it checked) the diagnostic info shown under the message box are saved to your account so we can help you. Our replies are also emailed to you. Ask us anytime to delete them.

No Social Security numbers or government IDs

No bank account or credit card information

No protected health information (PHI)

No calendar account passwords or credentials

No GPS tracking or device fingerprinting (check-ins only record arriving at or leaving a work site, if you set them up)

Encrypted passwords — Your password is securely hashed and never stored in plain text.

Encrypted connections — All data between your browser and our servers is encrypted in transit.

Data isolation — Your data is completely isolated. No other user can see or access your information.

No tracking — We do not track you across the web, build advertising profiles, or share your information with marketers. We collect only what's needed to run the app.

Supabase — Database and authentication provider.

Vercel — Application hosting provider.

Resend — Email delivery provider. Sends the app's emails (such as setup reminders, notifications you've turned on, and replies to your messages), so it receives your email address and the content of those emails.

Calendar providers — If you connect a calendar, your provider (e.g. Google, Apple, Outlook) serves your event data when your dashboard loads. We fetch events through your read-only iCal subscription link — we never have your calendar account password and cannot add, change, or delete anything on your calendar.