Privacy Policy
This policy explains how Overhear Ltd (“we”, “us”) collects and uses personal data in the Work Together Rotas mobile and web app. It is written for users in the United Kingdom and the European Economic Area.
Who is responsible
The data controller is Overhear Ltd, United Kingdom. For privacy questions or requests, email tomlpeel@gmail.com.
The data we collect
We collect only what is needed to run rotas for your organisation:
- Account: name, email address, and a password. Email and password are kept in Firebase Authentication (the password is not stored in plain text). We do not copy your email into the rota database. If you use Google or Sign in with Apple, we receive the name and email those services share with us. Apple may give us a private relay address instead of your real email.
- Organisation and rota data: organisation name, invite codes, membership and role, job titles, rota schedules, sign-ups, assigned dates, swap requests, away dates, and closed periods.
- Notifications: a device push token and platform (iOS or Android) so we can send swap and rota alerts. You can refuse notification permission on the device.
- Technical data: identifiers created by Firebase Authentication (user ID) and basic device storage used to keep you signed in and remember settings such as appearance.
We do not use advertising SDKs, do not sell personal data, and do not run third-party analytics in the app.
Why we use it
- To create and administer your account (contract / legitimate interests).
- To operate organisations, rotas, assignments and shift swaps (contract).
- To send optional push notifications about swaps and updates (consent via the system prompt).
- To keep the service secure and debug faults (legitimate interests).
Who we share it with
We use Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging and Hosting) to store and process this data. Rota data is stored in a European Firestore location. Google may process limited technical data outside the UK/EEA under its own terms and Standard Contractual Clauses.
If you sign in with Google or Apple, those companies process your sign-in under their privacy policies. Teammates in the same organisation can see your display name and the rota information you share with that organisation. We do not sell or rent your data.
How long we keep it
We keep account and organisation data for as long as the account exists. Push tokens are removed when they stop working or when you sign out where possible. If you ask us to delete your account, we delete or anonymise personal data within 30 days unless the law requires us to keep it.
Your rights
You can ask us to access, correct, or delete your personal data, or to restrict or object to certain processing. You can also request a copy of the data we hold. Email tomlpeel@gmail.com. You may complain to the UK Information Commissioner’s Office at ico.org.uk.
To delete your account, open Account in the app and tap Delete account, or use our account deletion page. You can also email tomlpeel@gmail.com. We will remove your login, profile and organisation memberships. Content other people still need (for example a published rota) may be retained in anonymised form.
Children
Work Together Rotas is intended for adults at work. It is not directed at children under 16 and we do not knowingly collect their data.
Security
Access to rota data is limited by signed-in accounts and Firestore security rules. No method of transmission is completely secure; please use a strong password and keep invite codes inside your organisation.
Changes
We may update this policy. The “last updated” date above will change when we do. Continued use of the app after an update means you accept the revised policy.