osh-privacy

Privacy Policy — Osh

Effective date: 2026-05-22
Last updated: 2026-05-22

This Privacy Policy explains how Osh (“we”, “our”, or “us”) collects, uses, stores, and protects your personal information when you use the Osh mobile application (the “App”). By using the App, you agree to the practices described in this policy.

1. Who We Are

Osh is a personal shift-tracking application that helps workers log their hours, calculate their earnings, and share leaderboard-style progress with friends and colleagues. The App is operated as an independent product.

For privacy inquiries, contact us at: contact@carasso.vip

2. Information We Collect

2.1 Information You Provide Directly

Data	Purpose
Email address	Account creation and authentication
Display name	Shown on your profile and to friends/group members
Avatar emoji	Shown on your profile and leaderboard
Monthly earnings goal	Displayed only to you on your personal dashboard
Job profiles (name, hourly rate, overtime rules)	Used to calculate your shift earnings

2.2 Information Generated by Your Use of the App

Data	Purpose
Shift records (start time, end time, duration, breaks, earnings)	Core app functionality — tracking your work
Monthly aggregated stats (total earnings, hours, shift count)	Personal dashboard and group leaderboard
Current shift status (“on shift”, “paused”, “off”)	Shown to accepted friends and group members in real time
Friend relationships (who you have connected with)	Social features
Group membership	Leaderboard features
Last-seen timestamp	Used internally to maintain account activity

2.3 Device Information

Data	Purpose
Expo/FCM/APNs push token	Delivering push notifications to your device

2.4 Information We Do NOT Collect

Your physical location (GPS or IP-based)
Your device contacts
Payment card or banking information (the App tracks earnings as numbers you enter; it does not process payments)
Photos or camera content (Phase 1 — this may change if AI paystub scanning is added in a future version; this policy will be updated before that feature launches)
Browsing history or activity outside the App

3. How We Use Your Information

We use the information we collect solely to operate and improve the App:

Providing the service — displaying your shifts, earnings, and progress.
Calculations — computing earnings based on the hourly rates and overtime rules you configure.
Social features — showing your shift status and monthly totals to friends and group members you have explicitly connected with.
Push notifications — alerting you to friend activity (friend requests, group updates) if you have enabled notifications.
Account security — verifying your identity when you sign in.
Service improvement — understanding how features are used so we can make them better. We do not use third-party analytics SDKs.

If you are located in the European Economic Area (EEA), our legal bases for processing your personal data are:

Contract performance — processing is necessary to provide the shift-tracking service you have signed up for.
Legitimate interests — limited processing (such as displaying your shift status to friends you have approved) that you can reasonably expect when using a social shift-tracking app.
Consent — for push notifications, which you can withdraw at any time in your device settings.

5. Third-Party Services

We use the following third-party services to operate the App. By using Osh, your data is also subject to their respective privacy policies.

Firebase (Google LLC)

The App uses two Firebase services operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA):

Firebase Authentication — manages your email/password sign-in. Your email address is stored by Firebase Auth to identify your account. Firebase Auth is GDPR-compliant and offers a Data Processing Agreement.
Firebase Firestore — our cloud database. Your shift records, job profiles, earnings aggregates, friend relationships, and group data are stored in Firestore. Data is encrypted in transit (TLS) and at rest. Access is governed by server-side Firestore Security Rules that ensure only you (and, where you have chosen, your friends and group members) can access your data.

Google’s privacy policy is available at https://policies.google.com/privacy.
Google’s Firebase Data Processing and Security Terms are available at https://firebase.google.com/terms/data-processing-terms.

Expo (Expo Inc.)

The App uses Expo’s push notification infrastructure to route notifications from our Firebase project to your device (via Apple APNs on iOS or Google FCM on Android). Expo does not have access to the content of your data — only the device push token is passed through their system to deliver notifications.

Expo’s privacy policy is available at https://expo.dev/privacy.

No Other Third Parties

We do not use:

Advertising networks or ad SDKs
Third-party analytics platforms (e.g., Mixpanel, Amplitude, Facebook Analytics)
Data brokers or resale services
Social media login (Facebook, Twitter, etc.)

6. We Do Not Sell Your Data

We do not sell, rent, trade, or share your personal information with any third party for their own commercial purposes. Your shift data, earnings figures, job profiles, and account information are yours. They exist solely to make the App work for you.

Osh is designed with a privacy-first model. Sharing within the App is strictly opt-in:

Friends — you must initiate or accept a friend request using a unique, randomly-generated friend code. Once connected, accepted friends can see your current shift status (on/off/paused) and your monthly earnings total. Your detailed shift records, hourly rates, and job profiles are never shared.
Groups — you must join or create a group. Group members can see the same information as accepted friends for leaderboard purposes: your current shift status and monthly earnings total.
Privacy level — you can set your account to “Private” in Settings, which hides your earnings from leaderboard displays within the App.
No public profiles — your data is never visible to unauthenticated users or to Osh users who are not your friends or group members.

8. Data Retention

We retain your data for as long as your account is active.

If you delete your account (via Settings → Delete Account in the App), we permanently delete:

Your Firebase Authentication credential
All Firestore data: your shift records, job profiles, earnings stats, friend relationships, and group memberships
Your push notification token
Your unique friend code

Account deletion is irreversible. Deleted data cannot be recovered.

We do not retain backup copies of deleted user data beyond what Firebase’s built-in infrastructure requires for its own operational purposes (typically a short technical retention window of up to 30 days in backup systems, which are governed by Google’s own data retention practices).

9. Data Security

We take reasonable measures to protect your data:

Encryption in transit — all communication between the App and Firebase uses TLS encryption.
Encryption at rest — Firebase Firestore encrypts data at rest by default.
Firestore Security Rules — we use server-side Firestore Security Rules that enforce strict access controls. Only authenticated users can access data, and cross-user access is limited to the explicit sharing scenarios described in Section 7.
No plaintext passwords — passwords are managed entirely by Firebase Authentication; we never see or store your password in plaintext.

Despite these measures, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password for your account.

10. Children’s Privacy

The App is not directed at children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [YOUR CONTACT EMAIL] and we will delete it promptly.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right	How to exercise it
Access	View all your data directly within the App (shifts, profile, friends, groups)
Correction	Edit your data at any time from within the App
Deletion	Delete your account via Settings → Delete Account
Data portability	Export your shift history as a PDF or CSV from the History screen
Withdraw consent (notifications)	Disable push notifications in your device Settings at any time
Object to processing (EEA users)	Contact us at contact@carasso.vip

For requests that cannot be fulfilled within the App itself, contact us at contact@carasso.vip. We will respond within 30 days.

12. International Data Transfers

Firebase stores data in Google’s infrastructure, which may be located outside your country of residence, including in the United States. Google is certified under the EU-U.S. Data Privacy Framework and offers Standard Contractual Clauses for Firestore data transfers. Details are available at https://firebase.google.com/terms/data-processing-terms.

13. Push Notifications

If you grant notification permissions, we may send you push notifications about:

Friend requests and acceptances
Friends or group members starting or ending a shift
Reaching your monthly earnings goal

You can withdraw notification permission at any time through your device’s Settings app. Revoking permissions does not delete your account or data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For significant changes, we will notify you through the App or by email before the change takes effect. Your continued use of the App after any change constitutes your acceptance of the updated policy.

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

Email: contact@carasso.vip App: Osh Website / Privacy Policy URL: https://liavcarasso.github.io/osh-privacy/

This Privacy Policy was written to comply with the Apple App Store Review Guidelines, Google Play Developer Policy, the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Israeli Protection of Privacy Law (5741-1981).