Privacy Policy

Who we are

ShiftSignOut is a private social network for verified healthcare professionals. Contact: privacy@shiftsignout.app.

What we collect

• Verification details. Your legal name, credential, and where applicable a license or NPI number, work email, school and program. A photograph of your badge or student ID.
• Account details. Email address and a password, stored only as a salted PBKDF2-SHA256 hash — never in a readable form. Your username, display name, bio, specialty, region, state, years of experience and availability badges.
• What you post. Videos, lessons, comments, Lounge threads, job and shadowing listings, direct messages, and any media attached to them.
• Wellbeing entries. Burnout check-ins and shift ratings.
• Activity. XP, badges, streaks, challenge answers, saves and likes.
• Launch list, if you asked for it. If you entered an email address on our website to be told when the app launches, we store that address and nothing else — no name, no credential, no account. It is kept separately from member accounts, used only to send that announcement, never sold or shared, and removed on request at privacy@shiftsignout.app.
• Which link brought you, if it was tagged. Some links we share carry a label saying where they were posted, like ?ref=tiktok. When you arrive through one, we add one to that label's count for the day, and a cookie on this site remembers the label for 30 days. If you apply from the website in that time, the label is saved with your application. It is the label and nothing else: it tells us which places people hear about us from, and it is never shared or used for advertising.

What we deliberately do not collect

• No cross-site tracking, no advertising identifier, no third-party analytics, no data brokers. Nothing you do here is sold or shared for advertising.
• No location tracking. Region and state are chosen by you, never read from the device.
• No contacts, no health-app data, no background collection.

Anonymous areas are anonymous in the database

Confessions, shift ratings and burnout check-ins are stored with no author column at all. It is not that we hide the author from other members — there is nothing recorded to look up, by us or by anyone with access to the database. The consequence is that these cannot be deleted on request, because nothing links them to you.

Anonymous Lounge threads work differently: the author is recorded but never shown, which is what makes deleting your own anonymous post possible. Replies under an anonymous thread show a label scoped to that thread and no handle.

Community wellbeing figures are only ever shown in aggregate, and suppressed entirely below five responses so nobody can be identified from a thin slice.

Your badge photo

It is used solely to confirm your credential, visible only to a reviewer, and deleted once your case resolves. It is never shown to other members.

Who can see what

Your posts and profile are visible to other verified members. A private profile shows only your credential, specialty and availability; your name, bio and posts are visible to connections only. Direct messages require both people to accept. Blocking hides both accounts from each other in both directions.

Where it is held

Data is stored on servers in the United States (Render and Supabase). Media is served through time-limited signed links. Traffic is encrypted in transit.

Deleting your account

Settings → Delete account removes your profile, posts, messages and progress. Anonymous content survives, because nothing connects it to you — this is stated in the app before you confirm.

Your verification record is wiped at the same time: your legal name, license or certificate number, work email, employer and anything read from your badge. We keep that a verification took place, for which credential, and when; and a one-way fingerprint of the license number, which cannot be turned back into the number and exists only so the same license can be recognized if it is used to apply again.

There is one exception. If we remove an account for cause — a credential that was not the applicant's own, impersonation, or serious abuse — we keep that verification record in full, so that the same person cannot simply apply again.

Children

ShiftSignOut is for working healthcare professionals and health-professions students, and is not directed at children under 13.

Changes

Material changes will be announced in the app. Continuing to use it after a change means accepting the revised policy.