We built WhosWorking with privacy first. Here's exactly what we collect, why, and how we protect it.
WhosWorking ("we", "our", or "us") is a professional shift-management and team-connectivity application developed by NurseTechTools. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the WhosWorking mobile app ("App").
This policy applies to all users of the WhosWorking iOS and Android applications. By creating an account or using the App, you agree to the practices described in this policy.
We collect only the minimum data required to provide the App's functionality. Here is a complete breakdown:
| Data Type | Purpose | Linked to Identity | Used for Tracking |
|---|---|---|---|
| First & Last Name | Display in profile and network | Yes | No |
| Email Address | Authentication, password reset, OTP | Yes | No |
| Job Role / Title | Displayed on user profile | Yes | No |
| Work Site(s) & Address | Commute calculation, schedule context | Yes | No |
| Profile Photo | Avatar displayed to connected coworkers | Yes | No |
| User ID (UUID) | Internal account identifier | Yes | No |
| Avatar Color Preference | UI personalization | Yes | No |
| Data Type | Purpose |
|---|---|
| Shift dates, types, start/end times | Personal schedule calendar, schedule comparison with coworkers |
| Personal notes on calendar dates | Private reminders — visible only to you, never shared |
| Group events (title, date, attendees) | Team coordination events shared with selected coworkers |
| Data Type | Purpose |
|---|---|
| Direct messages (text) | Communication between connected coworkers |
| Photos and videos sent in chat | Media sharing in direct messages |
| Connection relationships (friends list) | Determines who can view schedules and send messages |
| Connection request history | Pending, accepted, blocked status tracking |
| Data Type | Purpose | Stored Server-Side |
|---|---|---|
| Push Notification Token (APNs) | Delivering push notifications to your device | Yes |
| Current GPS Location | Real-time commute calculation and weather forecast | No — transient only |
| App settings & preferences | Dark mode, time format, temperature unit | Yes |
We use your data exclusively to operate and improve the App. We do not use your data for advertising, profiling, or any purpose unrelated to the App's core functionality.
Your email and password are used to create, secure, and manage your account. Email is used for password reset OTP delivery and essential account notifications only.
Shift data is stored to display your personal calendar, enable schedule comparison with connected coworkers, and power shift-alert subscriptions.
Messages and media are stored to deliver conversations between mutually connected users and maintain chat history within the App.
Your device push token is used solely to deliver in-app notifications (new messages, connection requests, shift alerts). It is never shared with advertisers.
Location coordinates are sent in real-time to calculate commute time (Apple Maps) and retrieve weather forecasts (Open-Meteo). Location is never stored on our servers.
We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:
When you connect with a coworker, the following profile information becomes visible to them: your name, job role, work site, profile photo, and shift schedule. You control your connections — you can remove or block anyone at any time, which immediately revokes their access to your data.
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, file storage, real-time | All user data (stored securely on AWS infrastructure) |
| Apple (APNs) | Push notification delivery | Push token + notification payload only |
| Open-Meteo | Weather forecast API | Approximate location coordinates only (no account info) |
| Apple Maps / Core Location | Commute routing | Origin/destination coordinates only |
We may disclose your information if required by law, court order, or governmental authority, or if necessary to protect the rights, property, or safety of our users or the public.
The App requests the following iOS permissions. Each is optional — the App remains functional even if you decline.
Used for: Real-time drive-time calculation to your saved work site (Commute tab) and local weather forecast (Weather tab).
Not used for: Background tracking, location history, advertising, or any server-side storage.
If denied: Commute and Weather tabs display a prompt to enable location. All other features work normally.
Used for: Alerts for new messages, connection requests, accepted requests, and shift schedule changes from coworkers you follow.
If denied: All features work normally. You simply won't receive push alerts when the app is in the background.
Used for: Selecting a profile photo from your camera roll, and attaching images to direct messages.
When accessed: Only when you explicitly tap the upload or attach button. Never accessed in the background.
If denied: You cannot upload a profile photo or send images in chat. All other features work normally.
Used for: Taking and sending photos within direct message conversations.
When accessed: Only when you tap the camera button inside an active chat. Never accessed otherwise.
If denied: You cannot take photos to send in chat. All other features including image attachment from library work normally.
The App integrates the following third-party services. Each has its own privacy policy:
| Service | Role | Privacy Policy |
|---|---|---|
| Supabase | Backend infrastructure — authentication, PostgreSQL database, realtime broadcast, and object storage. Hosted on AWS (us-east-1). GDPR compliant, SOC 2 Type II certified. | supabase.com/privacy |
| Expo / React Native | Cross-platform mobile framework and push notification infrastructure (Expo Push Notification Service relays to APNs). | expo.dev/privacy |
| Open-Meteo | Free, open-source weather forecast API. Receives only approximate location coordinates to return weather data. No account info transmitted. | open-meteo.com/terms |
| Apple Maps / MapKit | Used for commute routing and drive-time estimation. Subject to Apple's privacy framework. | apple.com/legal/privacy |
We do not integrate any advertising SDKs, social media SDKs, or behavioral analytics services.
| Data Type | Retention Period |
|---|---|
| Account & profile data | Until you delete your account |
| Shift schedule data | Until you delete individual entries or your account |
| Direct messages | Until you or the recipient deletes the conversation |
| Profile photos & chat media | Until you replace your avatar or delete the conversation |
| Push notification tokens | Cleared immediately when you log out |
| Location data | Not retained — used transiently per request only |
| Backup / server logs | Up to 30 days, then automatically purged |
We implement industry-standard security measures to protect your personal information:
While we use commercially reasonable security measures, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and keep your device secure.
Depending on your location, you may have the following rights regarding your personal data:
You can view all your personal data directly within the App at any time (Profile tab).
You can update your name, role, work site, profile photo, and other details at any time from the Profile tab.
You can permanently delete your account and all associated data directly in the App: Profile tab → scroll to bottom → "Delete Account". No external request needed. All data is purged within 24 hours.
You can disable push notifications in Profile → App Settings at any time. You can remove connections to restrict what data is shared with specific users.
To request a copy of your personal data in a structured format, contact us at the email below.
If you are located in the European Economic Area (EEA), United Kingdom, or California, you have additional rights under GDPR, UK GDPR, or CCPA respectively. To exercise any rights not available directly in the App, please contact us.
WhosWorking is designed for adult working professionals and is not directed at children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children.
If you believe a child has provided us with personal data, please contact us immediately and we will delete the information promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. When we make material changes, we will:
Continued use of the App after changes take effect constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:
NurseTechTools
We respond to all privacy inquiries within 72 hours.
privacy@whosworking.nursetechtools.comFor general support inquiries, contact: support@whosworking.nursetechtools.com