Privacy notice

Last updated: 17 October 2026

1. Who runs StaffOP

StaffOP is run by an individual in Estonia as a free, non-commercial hobby project. There is no company behind it, and it makes no money. To ask about your information, or anything else, write to privacy@staffop.com.

2. Who is responsible for what

Each business decides what it puts into StaffOP about its people, and is responsible for it. We store that information and process it for the business, and for nothing of our own. The little we keep for ourselves is listed separately, in section 4.

3. What a business keeps in StaffOP

About everyone on a team (staff, managers and admins):

Your name and the username you sign in with. Your password is stored only as a one-way hash, so nobody can read it, including us.
Your role (employee, manager or admin) and your language.
Your shifts, availability, time-off and leave requests (with any reason or note on them), shift swaps, leave allowance and contracted hours, your hourly pay rate and its history if an admin enters one, whether you've opted out of the 48-hour average week, and your shifts in saved schedule templates.
A change log of who changed what and when, such as a shift edited or leave approved, the notices in your in-app inbox, and your notification settings.
Your sign-in sessions, so you stay signed in. Join links, sign-in links and private calendar links are stored only as hashes.

About someone added but not yet joined: the name and role the admin typed. About the business: its name and settings, such as its time zone, working days, public holidays and pay rules.

StaffOP never asks staff for an email address, and stores no phone numbers, home addresses, or card or bank details. For sickness, the dates are usually enough: please don't write medical details in it.

4. What we keep for ourselves

The owner's recovery email, only as a keyed hash. We can recognise the address when the owner types it at "Forgot password", but we can't read it back from the hash, so it gives us no way to email anyone. The address just typed is held in memory only while the reset email is being sent (usually a few seconds, and never more than an hour, with retries), and is never written down. One email goes to each owner account with that address.
IP addresses are used only in memory, briefly, to slow down repeated attempts such as wrong passwords. They are never stored or logged.
A technical log of errors and events. It names accounts and businesses by ID number only, never by name, email address or IP address. We keep it for no longer than 30 days, copies in backups included.
Records of reset emails. Resend, which sends them (section 6), keeps a record of each one, including the address and the email itself, and we can read these records. Resend keeps them for as long as its own terms provide, and closing a business doesn't delete them.

We keep these to run the owner's account and keep StaffOP secure, which is our legitimate interest (GDPR Article 6(1)(f)). You can object at any time by writing to us. We don't sell anything, show adverts or send marketing.

5. Cookies and your browser

StaffOP sets one cookie, refreshToken, to keep you signed in. Page scripts can't read it, and your browser sends it only to StaffOP's sign-in service. It lasts 7 days, renewed each time you use StaffOP, and never more than 30 days after you sign in. It goes when you sign out.

The app also saves a few things in your browser's own storage, on your device:

auth_token: a short-lived sign-in pass, which the app sends with each request so we know it's you. Removed when you sign out.
theme_preference: whether you chose light or dark mode.
sp-onboarding-dismissed: that you hid the getting-started checklist.
pwa_install_dismissed: that you said no to installing StaffOP as an app.
sp_draft_…: a time-off request you haven't sent yet. Removed when you send it or close the tab.

Your browser also keeps a copy of StaffOP's own files so it opens faster; that copy holds none of your data. There are no analytics, advertising or tracking cookies, and nothing loads from other sites: the fonts and icons come from StaffOP itself. None of this needs your consent, because it's needed for the service or remembers a choice you made. Blocking the cookie stops you signing in, and clearing your browser's data signs you out and resets these settings.

While you're signed in, the tab remembers the last 30 things it did: the pages you opened, the requests it made to StaffOP and any errors, with their times, and never what you typed or what a page showed. That list lives in the tab's memory only, so that a bug report you choose to send can include it (section 6). It goes nowhere otherwise, and it's gone when you sign out or close the tab.

6. Who processes it

Hetzner Online GmbH, in Germany, hosts StaffOP, its data and its backups.
Resend sends the owner's password reset email, the only email StaffOP sends. It receives the address the owner has just typed and the email itself, and keeps its delivery records (section 4) in the United States under the EU–US Data Privacy Framework.
GitHub, Inc., in the United States, receives the bug reports people choose to send from the app's "Report a bug" button: the person's own words, the page they were on, their role, the app's version, their browser and screen size, the time, the ids of their account and business (not their name or username) and, unless they untick it, the last 30 things the tab did (section 5). Nothing is sent until they press Send, and the dialog shows everything that goes. GitHub keeps each report as an issue in a private repository only we can read, under the EU–US Data Privacy Framework.
Our email providers receive and store the email you send us. They may process it in the United States, under the EU–US Data Privacy Framework.

Nobody else receives anything. No analytics or monitoring service receives any data today.

7. How long it's kept

While you're on a team: for as long as you're a member and the business uses StaffOP. The change log stays as long as the business does.
After an admin removes you: your personal details go after 90 days, and you then show as "Former employee". Your shift and leave records are kept for 6 years after removal, for the business's pay records, then deleted.
Inbox notices: 90 days.
Sign-in: a session lasts at most 30 days, and its record goes within 30 days after it ends. A join link stops working after 7 days, and a sign-in link after 1 hour.
The owner's recovery email hash: until the owner replaces it or closes the business.
Bug reports at GitHub: until the bug is fixed or the report closed, and at most 12 months; we delete them then.
Records of reset emails at Resend: as long as Resend's own terms provide.
Closing the business: the owner can close it in Business settings at any time. Everything about it is deleted at once, including its people's accounts and the owner's recovery email hash, and everyone is signed out. Some copies remain for a while: the technical log (which uses ID numbers only) and backups, which go within 30 days; any bug reports at GitHub, as above; and Resend's records of any reset emails sent to the owner (section 4).

8. Your rights

If you work for a business that uses StaffOP, ask your employer first: it controls its staff's information and decides what's kept. You can change your own name, password and availability in your Profile.

You can also write to privacy@staffop.com to ask for a copy of your information, or to have it corrected or deleted. For information your employer put in, we'll pass your request on and help them answer it. You can complain to Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.

9. Breaches and changes

We don't email anyone about breaches or changes: if something goes wrong with your information, or this notice changes, we'll announce it in StaffOP and on this page. The terms of service cover how StaffOP may be used.