Privacy Policy

CoveredShift is shift-coverage software for Direct Support Professional (DSP) agencies and group homes. Agencies use it to post shifts, let staff pick them up, and approve coverage. Your agency is the controller of the workforce data it puts into CoveredShift; we process it to run the service.

• Account data — name, email, role, and the agency and location(s) you belong to.
• Shift and coverage data — shifts, pickups, drops, approvals, and schedules your agency manages in the app.
• Staff records your agency enters — for example experience level or hire date, entered by your agency to run scheduling.
• Notification preferences — how you asked to be contacted (e.g. a phone number for SMS), if you provide one.

We do not ask for, and you should not enter, clinical or medical record data. CoveredShift schedules staff; it does not store care records.

We rely on a small number of infrastructure providers to run the service:

• Hosting: Vercel (today)
• Database & authentication: Supabase (today)
• Transactional email: Resend

Each agency's data is isolated at the database level with row-level security; within an agency, staff only see the location(s) they are assigned to.

• Essential cookies (always on): session cookies that keep you signed in. The product cannot work without them, so they cannot be switched off.
• Optional analytics cookies (only with your consent): we do not use analytics cookies today. If we add product analytics in the future, they will stay off unless you accept them in the cookie banner.

Your theme choice (light/dark) and your cookie decision are stored in your browser's local storage — they are functional settings and are never sent to us.

• Ask your agency administrator to correct or remove your account data.
• Contact us directly for access or deletion requests.
• Decline optional cookies in the banner (essential session cookies remain, or you cannot stay signed in).

Privacy questions or requests: privacy@coveredshift.org