Privacy Policy

Who we are and what this covers

ShiftRounds is operator rounds software for water and wastewater treatment plants. Operators walk a route, record readings and status at each checkpoint, and report what they find. This policy covers the website at shiftrounds.com, the console at app.shiftrounds.com, and the ShiftRounds app for iPhone, iPad and Android.

Henry Labs LLC, a Texas limited liability company, provides ShiftRounds (“we,” “us”). Our mailing address is 311 Deerwood Dr, Trinity, TX 75862, and you can write to us at info@shiftrounds.com.

ShiftRounds is for utilities, not for individuals. A utility decides who it invites, what its routes record, and who sees what. For the records a utility keeps in ShiftRounds, the utility is in charge, and we handle them on its behalf. We’re in charge of account sign-ins, support email and this website. Where the two differ, this policy says so.

What we collect

Your account. Your name, email address and password, and the name of your utility. Our sign-in provider stores your password as a salted hash. Nobody at ShiftRounds can read it. You also confirm, when you sign up, that your utility is in the United States.

The people at a utility. Each person’s name, initials, role (owner, chief operator, supervisor, buyer, operator or user), the plants they work at, and their email address. An operator who doesn’t sign in, and uses only a shared device, has a name and initials and no email address. We also keep invitations that haven’t been accepted yet: the address, name, role and plants they were sent with.

PINs. A person can have a four-digit PIN to unlock a shared device. We store it only as a salted SHA-256 hash, never the PIN itself. People can’t read the hash. Only a shared device gets it, so it can check a PIN with no signal.

Shared devices. A device a utility enrolls, such as a control-room iPad: its name, its plants, when it was enrolled, and its platform and app version at the time.

Round records. These are the core of ShiftRounds, and they belong to the utility:

• readings, equipment status, leak checks, notes and initials;
• photos taken in the app on a round or with an issue;
• NFC tag serial numbers, and when a phone tapped each tag;
• skipped checkpoints and the reason given;
• issues, with their notes, who has them, and how they were closed.

Readings, tag taps and photos name the person who took them. Each also carries two times: when the operator took it, by the phone’s clock, and when it reached our server. We record how far the phone’s clock was from ours when it sent.

Photos. The app saves each photo again at a smaller size before it leaves the phone. That removes the camera’s own details from the file, location included. The time the photo was taken is kept in the database.

Plant setup. Plant names, time zones, areas, checkpoints, routes, schedules and limits, as a utility builds them.

The change log. Changes to setup and to who is in a utility (people, roles, plants, devices, routes, checkpoints, tags and alert settings), each with who made it and when.

Alert settings and email records. Each person’s choice of report emails and alerts. Email addresses a utility adds for people without an account, such as a utility director. A record of who was sent which report or alert, and when.

Push alert addresses. If you turn on alerts in the app, we store the push address your phone gives the app, with the phone’s platform and the app version, linked to you and your utility.

Billing. When your utility subscribes and pays by card, Stripe, our payment processor, collects the card details, the billing address and the billing contact’s name and email address directly, on Stripe’s own pages. Card numbers never reach our servers, and we can’t see them. We keep only what we need to run the subscription: Stripe’s ids for your utility and its subscription, how many plants it’s for, its status, whether your utility pays by card or by invoice, when its trial ends, and, once a trial or subscription has ended, when it ended and when the records are due to be deleted.

Messages to us. If you write to us, by email or with the contact form on this website, we get your name, email address and whatever you send, with your utility and the topic if you fill them in.

Request data. Like any web service, the companies that host ShiftRounds log standard request data: IP address, browser and operating system, the page asked for, and the time. We use it to keep the service working and secure. The website and the console also read the country each request comes from, to refuse requests from outside the United States.

App updates. The app asks Expo’s update service whether a newer version of its code is ready, at launch and from time to time while it’s open. That request carries the phone’s platform, the app’s version, and a random identifier made when the app was installed. If the app failed to start the last time, it also carries that error’s message. None of this names you, your utility or your plant.

Error reports. When the app or the console runs into an error, it sends a report to Sentry, the service we use to find and fix faults. A report says what went wrong and where in our code, the screen or page it happened on, the app’s version, and the kind of device and its operating system. It names your utility only by its id, a random code, so we can tell one utility’s problem from everyone’s. The app also tells Sentry each time it’s opened and whether it crashed, with its version, so we can see whether an update made things worse. Our servers report their own errors to Sentry too: what failed, in which part of the service, and the error’s own words, with any email address and any link’s query taken out. Those words can include the id of a utility or a record, never a password or a sign-in.

Timings. For about one screen in five, the app also sends Sentry how long it took: how long the app took to open, how long the screen took to show and whether it stuttered, and how long its requests to our servers took. A timing names a screen by its kind, such as “a checkpoint’s page”, never which one, and a request by its address up to the “?”. It never records what you tap or type. We use timings only to find what’s slow and make it faster.

A report or timing never carries your name, email address or IP address, a screenshot or recording of the screen, or anything your utility records: readings, notes, photos, or what you typed. Before a report leaves, ShiftRounds takes email addresses out of the error’s own words and cuts web addresses off at the “?”. This website’s pages send no error reports.

What stays on the phone

ShiftRounds works with no signal. To do that, the app keeps on the phone the routes for its plants, the last readings, the open issues, and every round walked on it. What you record is saved on the phone first and sent when there’s signal, sometimes hours later.

• Your sign-in is kept encrypted on the phone, with its key in the phone’s keychain.
• A shared device also keeps its roster: names, initials and PIN hashes, so it can check a PIN with no signal.
• Photos stay on the phone after they’re sent.
• Signing out doesn’t erase rounds already on the phone. Rounds not yet sent wait there until someone signs in.
• Signed out, the app shows practice routes. A round walked on them stays on the phone and is never sent to us.

The Face ID or fingerprint lock is optional. When it’s on, the match happens on the phone, through iOS. We never receive a face, a fingerprint or any other biometric data.

What we don’t collect

The app doesn’t ask for or collect your location. It doesn’t read your contacts or your photo library: photos come only from the app’s own camera screen. It reads an NFC tag only when you hold the phone to it, and reads nothing but the tag’s serial number and the ShiftRounds link written on it. We don’t collect government ID numbers, health information or advertising identifiers. Payment card details go to Stripe, never to us, as described above.

We don’t use a utility’s records to train machine-learning models.

Where it comes from

• From you: what you type, photograph and tap in ShiftRounds, and what you send us.
• From your utility: your name, email address, role and plants, when someone there invites you or adds you to the roster.
• From your phone or browser: request data, the update check and the error reports described above.
• From Stripe: whether a payment went through, and the subscription’s status.

We don’t buy personal information or add to it from data brokers or public sources.

How we use it

• To run ShiftRounds: sign-in, storing rounds, judging readings against the limits your utility set, building reports, and keeping issues.
• To send the emails and alerts your utility and you chose, described below.
• To bill for ShiftRounds: running your utility’s trial and subscription, and telling it about payments and when a trial or subscription ends.
• To keep it working: sending what phones saved offline, finding and fixing faults.
• To keep it secure: enforcing roles and plants, and looking into misuse.
• To answer you when you write to us.
• To meet the law: answering lawful requests and keeping records the law requires.

We don’t use a utility’s records for advertising, and we never show one utility’s records to another.

Who we share it with

We don’t sell personal information, and we don’t share it for advertising. We share it only as follows.

Companies that run parts of ShiftRounds for us. Each handles data only to provide its service to us:

• Supabase: the database, sign-in, photo storage and server functions, hosted in the United States (Amazon Web Services, US East).
• Vercel: hosts this website and the console, and measures visits to this website’s pages (see Cookies and tracking).
• Resend: sends our emails, from send.shiftrounds.com, billing emails included, and delivers a message from the contact form on this website to our mailbox. Round reports carry findings with their readings, names and up to eight photos, so those pass through Resend.
• Stripe: processes payments for subscriptions. Stripe collects card details itself and is in charge of the payment data it collects, under its own privacy policy.
• Expo: delivers app updates, and push alerts by way of Apple’s push notification service on iPhone and iPad, and Google’s Firebase Cloud Messaging on Android. An alert’s title and short text (a checkpoint, a plant, a finding and who found it) pass through Expo and through Apple or Google.
• Sentry: receives the error reports described above, from the app, the console and our servers, and the app’s timings, and keeps them for a limited time so we can find and fix faults and slow screens.
• Google Workspace: hosts our support mailbox, so it receives anything you send us.
• Apple: distributes the app on the App Store, and through TestFlight to people testing new versions. Apple may share with us crash reports from devices set to share them with app developers, and any feedback you send through TestFlight, under its own terms.
• Google Play: distributes the Android app, and new versions to people testing them. Google may share with us crash reports and app statistics from devices that send them, and any feedback you send through Google Play, under its own terms.
• Cloudflare: runs the DNS for shiftrounds.com. It holds no account or plant data.

ChemLevel, if your utility connects it. ChemLevel is chemical tank and chlorine cylinder tracking, a separate product that Henry Labs LLC also provides, with its own accounts. Nothing goes to it unless an owner or chief operator at your utility connects it with a code from your utility’s ChemLevel. Then the tank levels and chlorine cylinder weights your utility chose are sent to that ChemLevel as they reach ShiftRounds, each with when it was read, the name and initials of who read it, their email address if they have one, and the names of the round’s route, plant and checkpoint. ChemLevel keeps them as its own logs, under its own privacy policy. No other records are sent. Either product can disconnect it, and readings stop going when it does.

Within your utility. ShiftRounds is shared by the people at a utility. They see the records at their plants, including who took each reading and when. Your role decides what you see and can change. Report emails go to the people and addresses your utility set up, which may include people without an account.

Legal and corporate. We disclose information when valid legal process requires it, or to protect the rights or safety of our customers, the public or us. Where the law lets us, we tell the utility first. If Henry Labs LLC merges, is acquired or sells ShiftRounds, information may pass to the new owner, and this policy keeps applying to it.

Cookies and tracking

This website sets no cookies. The console sets only the cookies that keep you signed in. The app keeps its sign-in on the phone, as described above. Stripe’s payment and billing pages, opened from the console, are Stripe’s own and set Stripe’s cookies, under its privacy policy.

Visits to this website. We count visits to this website’s pages with Vercel Web Analytics, and measure how fast they load with Vercel Speed Insights. For each page view they record the page’s address, with anything after a “?” removed before it’s sent; the page you came from; your browser, operating system and kind of device; and the country, region and city the request came from, worked out from its IP address. Speed Insights also records your connection type and how long the page took to load. When someone clicks Start a free trial, Web Analytics also counts the click, with which of the page’s trial buttons it was and the page it was on, and it counts a click on an App Store or Google Play link the same way, with which store and the page. Neither uses cookies. Web Analytics counts a visitor with a code made from the request, which resets every day, so a visit can’t be followed from one day to the next. The measurements aren’t tied to your IP address or to you. Vercel keeps them under its own privacy notice.

Neither runs in the console, on a report or tag link, or in the app. ShiftRounds has no other analytics, and no advertising, tracking or session-recording tools anywhere. Error reports from the app and the console go to Sentry, as described above; they set no cookies and follow no one from site to site. The website’s fonts and these two measuring scripts come from our own server. Our emails don’t track opens or clicks. If any of this changes, we’ll update this policy first.

Because we don’t track you across sites, there’s nothing for a “Do Not Track” or Global Privacy Control signal to turn off. We honor those signals by not doing what they’re meant to stop.

Emails and alerts

ShiftRounds sends only emails about using it. We send no marketing email. The emails are:

• confirming your email address when you sign up, and resetting a password;
• invitations to join a utility;
• round reports, and a daily digest if you choose one;
• alerts for leaks, critical findings and overdue rounds;
• billing emails: to your utility’s owners and chief operators, a trial ending or ended and warnings before a utility’s records are deleted; and from Stripe, to your billing contact, receipts, invoices and a payment that didn’t go through;
• a test email, when you ask for one.

You choose your report emails and alerts under Notifications in the console. Chief operators and supervisors always get leak and critical alerts by email, on purpose: someone responsible must hear about them. Someone a utility adds by email address alone, without an account, can ask to stop the emails by replying to one.

Push alerts reach a phone only after you turn them on in the app and allow them on the phone. We delete a phone’s push address when you turn alerts off, sign out on that phone, are removed from a utility or delete your account, and when Apple or Google tells us the address no longer works.

How findings are worked out

ShiftRounds marks a reading as a finding by comparing it with the limits your utility set, and a meter’s change with the change it expected. That’s arithmetic, not artificial intelligence. Nothing in ShiftRounds profiles people or makes decisions about them.

Keeping and deleting

We keep a utility’s records while it uses ShiftRounds. They’re its operating records, so nobody leaving deletes them. A utility that wants to close its account and have its records deleted can write to us at info@shiftrounds.com.

When a trial or subscription ends. If a utility’s trial ends without a subscription, or its subscription ends, it becomes read-only: its people can still read everything, and nothing new is saved. Thirty days later, the utility is deleted with all its records and photos, as when the last person in it deletes their account. We email its owners and chief operators before that date. Subscribing before then keeps everything.

Deleting your account. You can delete your own account at any time: in the app, under More, then Delete my account, or in the console at Your account. It takes effect at once.

• Your sign-in goes: your email address, password and sessions.
• You come off every utility you were in. Your PIN, push addresses and alert settings go, and your email address comes out of the change log and the email records.
• Your name and initials stay on the utility’s records, so its reports still say who took each reading.
• If nobody else is in your utility (no other person, and no shared device still in use), the utility goes with your account, with all its records and photos.
• If others still use it, and you’re the last owner or chief operator who can sign in, you’ll be asked to make someone else an owner or chief operator first.

Leaving a utility. When a utility removes you, you lose access to it at once. Your sign-in stays yours, and your name and initials stay on its records.

What may remain. Our sign-in provider’s own security log, and our email provider’s sending log, may keep your email address for their own retention periods. Request logs are kept by our hosting providers for a limited time. Support email, and messages from the contact form, are kept while they’re useful for helping you. Stripe keeps its records of your utility’s payments and invoices for as long as its own policy and the law on financial records require. Readings already sent to your utility’s ChemLevel stay there, under ChemLevel’s policy.

Security

Every connection to ShiftRounds uses HTTPS. The database itself decides who may read each record, by utility, plant and role, so a mistake in an app can’t show one utility’s records to another. Readings, taps and the change log can’t be edited once stored; a correction is a new entry. Our Security page has the details.

If we learn of a breach affecting your information, we’ll tell your utility’s owners and chief operators without undue delay, and anyone else the law says we must tell. We’ll say what happened, what was involved, what we’re doing and what you can do.

No system is perfectly secure. Keep your password to yourself, keep a passcode on every phone that walks rounds, and tell us at info@shiftrounds.com if you think an account has been misused.

United States only

ShiftRounds is offered only to utilities in the United States, and sign-up asks you to confirm that yours is. The website and the console refuse requests from outside the country. A utility’s records are stored and processed in the United States.

Your privacy rights

Depending on your state, you may have the right to know what personal information we collect and how we use it, to get a copy, to correct it, to delete it, and to opt out of its sale, of sharing for targeted advertising, and of profiling. You also have the right not to be treated differently for using these rights.

We don’t sell personal information or share it for targeted advertising, and we haven’t since ShiftRounds began. We don’t profile people. The kinds of information we collect are identifiers (such as names and email addresses), customer records, commercial information (your utility’s subscription), professional information (role and plants), internet activity (request data), and photos taken on rounds. We collect them from the sources and for the purposes above, and share them only with the companies listed above.

Much of what we hold belongs to a utility. Requests about its records generally go through the utility, and we’ll help it answer. Requests about your own account or your messages to us can come straight to us.

To make a request, write to info@shiftrounds.com. We’ll check it’s you by matching what you send against our records. An authorized agent can ask for you with proof that you authorized them. If we turn down a request, you can appeal by replying, and we’ll answer in writing within the time your state’s law allows.

Children

ShiftRounds is workplace software for utilities and isn’t directed to children. It isn’t meant for anyone under 18, and we don’t knowingly collect personal information from children. If you think a child has given us personal information, write to info@shiftrounds.com and we’ll delete it.

Changes to this policy

We’ll update this policy as ShiftRounds or the law changes, and change the date at the top. If a change materially affects how we handle personal information, we’ll tell utilities by email or in ShiftRounds before it takes effect. Using ShiftRounds after a change takes effect means you accept the updated policy.

Contact us

Questions, requests or complaints about privacy go to info@shiftrounds.com, or by mail to Henry Labs LLC, 311 Deerwood Dr, Trinity, TX 75862. They reach the people who build and run ShiftRounds.