Privacy Policy

Effective: {EFFECTIVE_DATE}

Applies to: the Longshift iOS app, the website at longshift.com.au, and everything connected to them.

1. Who we are

Longshift is run by {LEGAL_ENTITY} (ABN {ABN}), in Australia. We're a small operation - when you email support@longshift.com.au, a person reads it.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Some small businesses are exempt from that Act. We don't rely on that exemption: we apply the APPs to Longshift regardless of whether we're legally required to, and this policy is written on that basis.

2. Two different sets of people

Longshift is a tool for sole traders and small trade businesses. So there are two groups whose information moves through it:

You - the Longshift user. You have an account with us, or you left an email on the waitlist before you had one. We decide what we collect from you and why. This policy governs that directly.
Your clients - the people you do work for. Their names, addresses, contact details, job notes, invoice amounts and, often, photographs of their property sit in Longshift. You decide what goes in. They do not have accounts with us. But we hold it, which means we have our own obligations to those people. Section 7 explains how that works - including what happens when one of your clients contacts us directly, and what happens when their details arrive by a forward, a photo, or an accounting connection rather than by you typing them.

3. What we collect from you, and why

This table is the collection notice.

What	Why	Where it comes from
Email address and password	To create and secure your account	You, at sign-up
A Google account, if you tap Google sign-in	An optional way to sign in	You, via Google. Email and password still work on their own
A waitlist email	So we can tell you while Longshift is being built	You, on the marketing page, before an account exists
Your business details - trading name, ABN, address, BSB/account number, PayID, hourly rates	They print on the invoices you send	You, in Settings
Job logs - dates, times, addresses, descriptions, notes, worker names	The core of the product: your work record	You, and the in-app timer
Clients and saved properties - names, addresses, emails, saved coordinates, price lists	So you don't retype them every job	You; or proposed from mail you forwarded, or from an accounting system you authorised. Proposals become workspace data only when you confirm them
Invoices - client, amount, date, status, invoice number	Invoicing and payment chasing	Generated from your job logs
Stamped photos of the job	Proof of work for your client	The in-app camera on your phone. We store these ourselves - see section 4
Location, when you allow Always or When In Use	To notice today's next job for a lock-screen Clock on ask, and to fill a job address and stamp it on a photo	Your device, after it asks your permission
Emails you forward to a Longshift-issued address	To propose clients, rates and letterhead from invoices you already sent	You forwarded them. They carry your clients' details
Replies to chase mail sent to a Longshift-issued address	To propose the next chase step, and to relay the reply to you	The person who replied - usually your client
Contacts, invoice line items and tax settings from Xero	To propose clients, rates, GST and a letterhead assist	Xero, on a one-time read you authorised. The import keeps no token
Invoices we copy into your Xero, and payments recorded in Xero against them, if you connect Xero as your ledger	To keep your books complete, and to read back payments so we stop chasing an invoice that has been paid	Our own invoice records, and Xero for the payments, through a standing connection that stores a credential until you revoke it
Email addresses you invite into your workspace	To let those people join it	You
Subscription and payment records	Billing, refunds, tax records	You and our payment processor
Support emails	To answer you	You
Crash and error reports	To find bugs that break the app	Automatically, and only when a crash-reporting key is set. Today that key is unset, so nothing is sent

We do not run advertising, sell or rent personal information, use third-party analytics or tracking pixels, build profiles, or make automated decisions about you that have a legal or similarly significant effect. There is no ad network anywhere in Longshift. We do not collect voice recordings.

Longshift stores a push token for each phone you sign in on, linked to you as a member of your workspace. We use it only to tell you about your own work, such as a day you are put on. The message names no client and no street. Google Firebase Cloud Messaging and Apple's push service carry the message to your phone.

The one message that can name a client is your morning summary. When it is written, its first sentence is sent to the phones you have signed in on, as the text of a notification, through Google Firebase Cloud Messaging and Apple's push service. That sentence can name a client and an amount owed. It is written from facts that hold no client email address, phone number or street address, and a sentence that holds an email address or a link is dropped before it is stored.

Once a night, to work out whether tomorrow's jobs will be rained on, our server sends Apple's WeatherKit weather service the place of each of those jobs, rounded to two decimal places of latitude and longitude (about a kilometre). It sends no client name and no street.

We do use models to propose - a structured job, a rule, an early warning, which client a forwarded invoice is for, what a client's reply to a chase means, the wording of an invoice line. A confirming tap of yours is the write. Nothing a model produces goes onto an invoice or out in a chase without that tap.

Giving us this information is voluntary, but the app can't do much without it - we can't invoice a client whose name we don't have.

4. Photos and location

This part is specific enough to spell out.

We store your stamped photos ourselves. Each photo is one compressed JPEG. Before it leaves your phone, Longshift burns the job address and the date and time into the pixels and strips the camera's EXIF. That stamp is part of the picture from then on - including on every copy you send, and including when we send the photo to a model to help structure the job. There is no second copy on the camera roll, and no full-resolution original kept behind the JPEG.
Those files live in Google Cloud Storage under your workspace, at workspaces/{workspace}/jobLogs/{log}/{photo}. They are workspace data. They are not on a 90-day timer. Deleting the job log, the workspace owner deleting their account, or the deletion 12 months after a subscription ends is what removes them - see the deletion page.
Video is not a current capture path. The iOS app does not record or attach video. An older web screen can still attach a video file; that is leftover, not the product, and we are not describing it as a feature here.
Location is opt-in, including when the app is closed. The iOS app asks for Always location and for banners so it can notice when you pull up at today's next job and show Clock on and the client name on the lock screen. Your phone asks; you can say no. Clock on on today's list still works. Precise Location must be on for that circle; if it is off, there is no circle and no banner.
A tap can still use When In Use. Filling a job address and stamping a photo still reads your position when you tap a control that needs it. We convert those coordinates into a street address using Google's Geocoding API. When you save a client's address, our server also sends that address to Google's Geocoding API to find its location.
We store the address, not a location trail. A job log holds the address text. Saved properties hold coordinates so the app can recognise "you're at the Smith job again". The phone notices one circle — today's next job that has a place. We do not keep a movement history.
Google Drive is not where photos live. If you connected Drive on the older web app, files that already landed in your Drive stay in your Google account. New photos do not go there.

5. Where your data lives

Your Longshift workspace is stored in Google Cloud Firestore in the australia-southeast1 region - Google's Sydney data centres. Everyday reads and writes of your job logs, clients and invoices stay in Australia.

Photos and inbound mail attachments are stored in Google Cloud Storage in the same Google Cloud project. The database is in Sydney; we do not claim a country for every object here beyond naming Google as the provider in section 6.

The iOS app, and the website while you still use it, keep an offline copy of recent workspace data on your own device so the product keeps working with no signal. See section 8.

Not everything stays onshore. Sign-in, payments, crash reporting, email, model inference and the parts of Google's platform that aren't the database are run by overseas companies and may store or route information outside Australia. The table in section 6 names each provider and the country involved. Under APP 8 we take reasonable steps to use providers with contractual privacy commitments, but once information is with a provider it's subject to that provider's own arrangements and, potentially, foreign law.

6. Who else touches your data

We use a small number of providers. We don't give any of them permission to use your data for their own purposes, including to train their models. That is about them, not about us - what we do with your data, including using it to improve Longshift, is in section 7 and in section 4 of the Terms of Service. Where Longshift sends your work to a model, we only use providers whose terms rule that training out.

Provider	What they do	Where	What they see
Google - Cloud Firestore	Stores your workspace data	Data at rest in Australia (`australia-southeast1`)	Everything you store in Longshift
Google - Cloud Storage	Stores stamped job photos and inbound mail attachments	Google Cloud, same project as the database	The photo files and the inbound attachments
Google - Firebase Authentication	Runs sign-in; sends your password-reset emails; optional Google sign-in	Google infrastructure, may be outside Australia	Your email address, password hash, sign-in times; if you tap Google, that Google account
Google - Firebase Hosting, Maps Geocoding, Google Fonts	Serves the site; finds the location of a client's address and turns coordinates into an address; serves the font on these legal pages	Global	Your IP address on page load; coordinates you submit for geocoding, and a client's address, sent from our server to find its location
Apple - WeatherKit	Gives the rain forecast for tomorrow's jobs, so the app can warn you the evening before	Apple's infrastructure	The place of each of tomorrow's jobs, rounded to two decimal places of latitude and longitude (about a kilometre), and the day asked about. No client name, no street, no job or workspace id
Stripe	Takes subscription payments	United States and globally; contracted in Australia through Stripe Payments Australia Pty Ltd	Your name, email, billing details. Card numbers go straight to Stripe - we never see or store them
Anthropic	Runs the model calls that propose structure - a job debrief, a rule, an early warning, an on-site quote's wording, an invoice line's wording, your morning digest, the short reason under an item on your Today screen, a client's next visit from your clock-ons - and turns what you say to Longshift into an action for you to confirm	United States	The text we send for that job, and the stamped photos of the job. That includes the address and time burned into the picture. For the short reason under an item on your Today screen, only the facts that item is about: never contact details or photos, and for a crew member never money. For a client's next visit, only that client's name and the days and times you clocked on for them in the last eight weeks: never photos, debriefs or addresses. We only use Anthropic under terms that forbid training on that content
TypeSafe	Runs Jev, a small model that picks from short lists our code has already built - which client a forwarded invoice is for, what kind of paper it is, what a client's reply to a chase means, which known client a job is for, which catalogue row matches a typed material, which of a client's extras presets an extra recorded on a visit is, whether a client's messages should go by email or from your own phone, and which items your Today screen shows and in what order	United States	Text only, never photos. The text of papers you forward for import, with bank-account numbers removed. A client's reply to a chase, with names, phone numbers, addresses, links and bank details removed. Your debrief text, the material names you type, and your clients' names with a sent job's address and agreed work, so it can pick which of them a job is for. The words of an extra recorded on a visit and the names of that client's extras presets, never their prices. A client's name, email, phone and the notes you keep about them, so it can propose how that client's messages reach them; never the client's address. For your Today screen, the day's jobs, invoices and visits as our code lists them, and the words of debriefs and client replies, with contact details removed; a crew member's Today is sent with no money at all. We only use TypeSafe under terms that forbid training on that content. TypeSafe keeps none of that text: zero data retention is on for our account
Resend	Sends transactional email - invoices, chase mail, waitlist confirmation, account notices - and receives mail sent to Longshift-issued addresses	United States	Email addresses and the contents of those messages, including attachments on inbound mail
Sentry	Collects crash reports so we can fix bugs	United States	Error messages, stack traces, app and device version. Not deliberately your business data - but an error message can incidentally include a value that caused it. Nothing is sent unless a crash-reporting key is set. Today that key is unset
{MAILBOX_PROVIDER}	Hosts our support@longshift.com.au inbox	{MAILBOX_PROVIDER_COUNTRY}	Anything you put in a support email
Xero (one-time import)	On your authorisation, a one-time read of contacts, invoice line items and tax settings	Xero's infrastructure	Whatever that organisation holds in those categories, for the duration of the pull. The import keeps no access token and no refresh token. Re-importing costs a fresh sign-in
Xero (ledger connection, only if you connect it)	After you read what it does and authorise it: writes a copy of each invoice you send into your Xero as an approved invoice, may create a contact for your client, and payments recorded against the invoices we copied are read back. Xero does not email your client	Xero's infrastructure	The invoice's number, dates, client, lines, GST and total, and the client's name and email if a contact is created. Connecting stores a credential: we keep your Xero access and refresh tokens, encrypted, on our servers until you revoke the connection. You can revoke at any time; we then delete the credential, release the connection in Xero, and read and write nothing more

People you send job logs and invoices to. This is a disclosure you make rather than one we make, but you should know it happens:

Chase emails and invoice PDFs go through Resend to the address you nominated.
If you use the share button, the job log and its photos go through your phone's native share sheet to whichever app and person you pick - WhatsApp, Messages, email, whatever you choose.

The recipient keeps their copy, and neither we nor you can recall it afterwards.

Optional leftovers, your account, your call:

Google Drive - if you connected it on the older web app, job-log files that already went into your Drive stay there. Longshift used the drive.file scope, meaning it can only see files it created itself. New photos do not upload to Drive. You can disconnect at any time. Every core part of Longshift works with no Google account connected.

We may also disclose information if the law requires it (a court order, a regulator, a police request we're obliged to answer), or to protect someone's safety.

7. Your clients' information

Your clients' details arrive in Longshift in more than one way: you type them, you forward a document that carries them, you photograph their property, or you connect an accounting system that already has them. However they arrive, you decide what Longshift holds about them. But we hold it, and having elected to apply the APPs we owe those people obligations directly. Both things are true at once, so here's how it works in practice.

Your side:

You decide what client information goes into Longshift, how it's used, and how long it stays - including which forwards you send us and which proposals you confirm.
You are responsible for having the right to collect it, for telling your clients how you handle their information, and for meeting your own privacy obligations to them.

Our side:

We use it to run Longshift for you, and to improve Longshift itself. Testing, measuring and fixing the product means checking it against real work rather than invented examples - so while we hold your data we may use it that way too. Section 4 of the Terms of Service sets out that permission and its four limits, and it runs only while we hold the data: what survives a deletion is counts and measurements of how the product performed, never a client's details. We don't market to your clients, we don't mine or resell your client list, and what we learn goes into Longshift and into nothing else. The one thing this does not reach is the rate band: what a trade charges for a kind of work, in a place, as a reciprocal opt-in count. You see the band only if you contribute to it. It does not exist until a floor of contributing workspaces is met. It carries prices only - never a client identity, never a job, never a name.
If you forward mail that is not only your own invoices, we may receive messages about people who are neither you nor your clients. We do not use that mail to run Longshift. It is deleted with the inbound attachments, on the same ~90-day timetable in section 9. The product copy beside the forwarding address asks you to forward your own invoices - the ones you sent.
If one of your clients asks us for access to, or correction of, their information, we deal with that request ourselves - we don't simply send them away. We'll ordinarily need to work with you first, because you hold the context and we have to be reasonably satisfied about who's asking, and we'll tell you the request has come in. We'll respond within 30 days. If we refuse, in whole or in part - for example because we can't verify identity, or because an exception in the APPs applies - we'll say so in writing, with reasons, and explain how to complain.
If one of your clients asks us to delete their information, we'll consider it and work it out with you. Often we can't simply erase it: you may have a legal reason to keep it, like a five-year tax record or a live dispute. We'll explain the outcome to them either way.
When you delete a client, a job log or your whole workspace, that data goes. See the deletion page.

8. On your own device

Longshift doesn't use tracking cookies. It keeps on your device only what it can't work without:

your sign-in session;
an offline cache of your recent workspace data, so the app works with no signal - on the iOS app, and in the browser if you still use the website;
an autosaved draft of a job log you've started but not saved, kept per workspace;
the state of a running timer, so it survives a reload;
photos waiting to upload, kept on the device from the shutter until they drain to Cloud Storage;
if you connected Google Drive on the older web app: the access token Google issued, plus the OAuth client ID.

Two things worth knowing. Signing out of Longshift ends your session but does not clear the rest of this - an unsaved draft stays until you save or discard it, and a leftover Drive token stays until it expires or you tap Disconnect. Clearing the website's site data, or deleting the iOS app, removes the device copy without affecting anything on the server. On a shared or borrowed device, sign out and remove the app or clear the site data.

Longshift's widgets show today's jobs on your Home Screen and Lock Screen. To do that, Longshift copies today's job list (the client, the time, the street and whether each job is done) into storage shared by Longshift and its widgets on your phone. The copy never leaves your phone, and it is deleted when you sign out and when you delete your account. A Home Screen widget may show a street while your phone is unlocked; Lock Screen widgets show client name and time only.

9. How long we keep things

Data	Kept
Your workspace data (jobs, clients, invoices, settings, stamped photos)	While your account is open
After your subscription ends	You can still see everything, but you can't make or send invoices. Read-only 30 days after it ends. Deleted 12 months after it ends - we email you before we do it
After you delete your account in the app	A seven-day hold, then deleted in our next daily pass. Signing back in during the hold cancels it. See the deletion page for what is kept
Inbound mail attachments (forwards and chase replies)	~90 days, then deleted. The parsed or classified result is kept as workspace data
A chase reply we could not send that day because the send budget was spent	The message body is kept 90 days, then redacted. A stub of the record remains so the send is not lost and not invented later
Waitlist email	Until you unsubscribe or ask us to delete it. Unsubscribing stops mail and leaves a stub so we do not add you again
Backup copies, where we hold them	Expire automatically; the longest-lived copy is deleted within {BACKUP_RETENTION}
Billing and payment records	5 years, because Australian tax law requires it
Support emails	Up to 12 months, unless you ask us to delete the thread sooner
Crash reports	A short rolling window on Sentry's plan - and only if a reporting key is set

We don't promise to be your archive. Australian tax law makes you keep your business records for five years, so export your invoices and keep your own copies.

10. Keeping it safe

Everything travels over HTTPS. Access to your workspace is enforced server-side by Firestore security rules, which are covered by an automated test suite - a signed-in user can only read and write their own workspace, and that's checked on every change we ship. Passwords are handled by Firebase Authentication and never stored by us in a readable form. Access to production is limited to the people who run Longshift, using multi-factor authentication.

No system is perfectly secure, and we won't pretend otherwise.

11. If something goes wrong

If we have reasonable grounds to suspect a data breach that's likely to cause serious harm, we'll assess it within 30 days, notify the people affected as soon as practicable, and notify the Office of the Australian Information Commissioner (OAIC).

To be straight with you about the legal basis: the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act binds the entities the Act covers. As a small business we may not be one of them, and we haven't opted in under section 6EA of the Act. So rather than claim a scheme we may not be bound by, we're committing here to do what it requires anyway - assess, notify you, notify the OAIC. If the scheme does apply to us, or comes to apply to us, we'll comply with it as law.

Either way we'll tell you, because you'd want to know and you may have your own obligations to your clients.

12. Seeing, fixing and deleting your data

Access. Almost everything we hold about you is visible in the app. For anything else, email support@longshift.com.au and we'll tell you what we hold. We'll respond within 30 days. It's free unless a request is unusually large or repetitive, in which case we'll tell you the cost before doing it. If we refuse a request we'll give you reasons in writing.
Correction. Edit it in the app, or ask us.
A copy. Ask and we'll send you a machine-readable export of your workspace.
Deletion. See the deletion page.
Waitlist. Every waitlist mail includes a working unsubscribe. That stops further mail. To erase the address itself, email support@longshift.com.au.

We may need to confirm it's really you before acting - usually by replying from the email address on the account, or from the waitlist address.

13. Children

Longshift is a tool for running a business. It isn't designed or intended for anyone under 18, and we don't knowingly create accounts for them.

14. Changes to this policy

If we change something that matters, we'll email you and post the new version at longshift.com.au before it takes effect. The effective date at the top always tells you which version you're reading.

15. Contact and complaints

Email support@longshift.com.au. Tell us what happened and we'll come back to you within 30 days.

If you're not satisfied with how we've handled a privacy complaint, you can take it to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992.

Privacy | Terms | Delete data