Privacy Policy
Last updated 14 August 2026.
Who we are
ShiftSignOut is a private social network for verified healthcare professionals. Contact: privacy@shiftsignout.app.
What we collect
- Verification details. Your legal name, credential, and where applicable a license or NPI number, work email, school and programme. A photograph of your badge or student ID.
- Account details. Email address and a password, stored only as a salted PBKDF2-SHA256 hash — never in a readable form. Your username, display name, bio, specialty, region, state, years of experience and availability badges.
- What you post. Videos, lessons, comments, Lounge threads, job and shadowing listings, direct messages, and any media attached to them.
- Wellbeing entries. Burnout check-ins and shift ratings.
- Activity. XP, badges, streaks, challenge answers, saves and likes.
- Launch list, if you asked for it. If you entered an email address on our website to be told when the app launches, we store that address and nothing else — no name, no credential, no account. It is kept separately from member accounts, used only to send that announcement, never sold or shared, and removed on request at privacy@shiftsignout.app.
What we deliberately do not collect
- No tracking, no advertising identifier, no third-party analytics, no data brokers. Nothing you do here is sold or shared for advertising.
- No location tracking. Region and state are chosen by you, never read from the device.
- No contacts, no health-app data, no background collection.
Anonymous areas are anonymous in the database
Confessions, shift ratings and burnout check-ins are stored with no author column at all. It is not that we hide the author from other members — there is nothing recorded to look up, by us or by anyone with access to the database. The consequence is that these cannot be deleted on request, because nothing links them to you.
Anonymous Lounge threads work differently: the author is recorded but never shown, which is what makes deleting your own anonymous post possible. Replies under an anonymous thread show a label scoped to that thread and no handle.
Community wellbeing figures are only ever shown in aggregate, and suppressed entirely below five responses so nobody can be identified from a thin slice.
Your badge photo
It is used solely to confirm your credential, visible only to a reviewer, and deleted once your case resolves. It is never shown to other members.
Who can see what
Your posts and profile are visible to other verified members. A private profile shows only your credential, specialty and availability; your name, bio and posts are visible to connections only. Direct messages require both people to accept. Blocking hides both accounts from each other in both directions.
Where it is held
Data is stored on servers in the United States (Render and Supabase). Media is served through time-limited signed links. Traffic is encrypted in transit.
Deleting your account
Settings → Delete account removes your profile, posts, messages and progress. Anonymous content survives, because nothing connects it to you — this is stated in the app before you confirm.
Children
ShiftSignOut is for working healthcare professionals and health-professions students, and is not directed at children under 13.
Changes
Material changes will be announced in the app. Continuing to use it after a change means accepting the revised policy.