Shift Diary Privacy Policy

Last updated: 13 September 2026

Shift Diary is a time and attendance app published by Diary SA. This policy explains what information the app collects, why we collect it, and how we look after it. By using Shift Diary, you agree to the terms set out here.

This policy covers the Shift Diary app only.

1. Information We Collect

1.1 Employee information

Captured by the account holder when they add an employee:

• Name and surname – so a clock record belongs to a person. Initials, if entered, are shown on that employee's avatar in the app.
• Employee number – the account holder's own reference for that person.
• NFC tag identifier – the code on the tag issued to that employee, so a tap can be matched to them.

1.2 Account and clock station information

• Business name – identifies the account.
• Email address – used by the account holder to sign in, and to contact you.
• Clock station name – the name you give a gate, site or device.
• Clock station phone number – the number of the device at that station, used to sign that station in to the account.

1.3 Clock records

• Date and time of every clock-in and clock-out.
• Clock station the record was made at.
• Clock method – whether the record came from an NFC tag or was entered manually.
• Location – the GPS position of the device at the moment of the clock event, to confirm where the shift started and ended.

2. What We Do Not Collect

Shift Diary does not ask for, and does not store:

• Identity numbers or passport numbers.
• Home addresses.
• UIF, PAYE or other tax numbers.
• Bank account or payment details for employees.
• Employee phone numbers. (A phone number is only held for a clock station device, so that station can sign in.)

Location is recorded at the moment of a clock event only. Shift Diary does not follow anyone's movements between clock-ins, and it does not track employees' own phones.

3. How We Use Your Information

We use this information only to run the service:

• Recording employee working hours accurately.
• Showing the account holder who is on duty, absent or finished for the day.
• Confirming where a clock event took place.
• Producing attendance history, analytics and exports for the account holder.
• Supporting the app and fixing problems that are reported to us.

We do not use your information for advertising, and we do not profile employees for any purpose of our own.

4. Data Protection & Security

• Encryption – records are encrypted in transit and at rest on Google Cloud Firestore.
• Access control – only authorised Diary SA personnel can access account data, and only where it is needed to run or support the service.
• Separation – a device signed in as a clock station can record clock events and show the current day's clocking at that station. It cannot view past records, employee history or account settings.
• Regular review – we review our security measures routinely.

Despite these measures, no method of electronic storage is completely secure. We encourage account holders to protect their sign-in details and to keep clock station devices in a safe place.

5. Data Sharing

We do not sell, trade or rent your information to anybody. Information is shared only:

• With the account holder – the employer whose account the records belong to.
• With our cloud hosting provider – account data is stored on Google Cloud Firestore, which hosts and backs it up on our behalf. No account data is stored on Diary SA's own premises or devices.
• With legal authorities – where we are required to do so by law.

6. Data Retention

Clock records are kept for as long as the account exists, so that the account holder can go back over their own history. If an account is not paid for a month it falls back to the free tier: the records are not deleted, they are simply not visible beyond the last 14 days until the account is active again.

An account holder can void an individual clock record — for example an accidental double tap — so that it no longer counts. Voiding is reversible: the record is retained and can be restored, so the history stays complete.

An account holder may ask us to delete an employee's records or to close and delete the account entirely, subject to any legal obligation to retain them.

7. Age Restriction

Shift Diary is intended only for users aged 18 and above, as it is designed for business use involving employee management. If you believe a minor has provided us with personal information, please contact us immediately.

8. Your Rights

Under South Africa's Protection of Personal Information Act (POPIA), and equivalent laws elsewhere, you may have the right to:

• Access, correct or delete your personal information.
• Object to or restrict how it is processed.
• Request a copy of your information in a portable form.
• Complain to the Information Regulator.

Employees should raise these requests with their employer, who holds the account. Account holders can contact us directly at info@diarysa.co.za.

9. Responsibilities of the Account Holder

The employer who holds the account decides which employees are added and why. They are responsible for telling their staff that their attendance and clock location are being recorded, and for having a lawful basis for doing so. Diary SA processes this information on the account holder's behalf.

10. Changes to This Privacy Policy

We may update this policy from time to time. Any changes will be communicated through the app or on this website. Continued use of Shift Diary after an update constitutes acceptance of the new terms.

11. Contact Us

If you have any questions about this policy, please contact us at:

Diary SA Support
Email: info@diarysa.co.za
WhatsApp: 068 174 3083

Thank you for using Shift Diary.