This Privacy Policy explains how Jack Morgan ("we", "us", "our") collects, uses, and protects your personal data when you use the VillageShop application ("the Service").
1. Who we are
The Service is operated by Jack Morgan, based in the United Kingdom. For privacy-related enquiries, contact us at hello@villageshop.app.
2. Data we collect
Account information: your name, email address, and optionally your phone number, provided when you accept an invitation to join or via your profile settings.
Authentication data: a hashed (not readable) version of your password and session tokens stored locally on your device.
Rota and shift data: shift assignments, leave requests, and availability records linked to your account.
Push notification tokens: device endpoint details used to deliver push notifications if you choose to enable them.
Usage data: your last login timestamp.
We do not collect payment information, precise location data, or any data from minors.
3. How we use your data
To provide the volunteer rota and community shop ordering service.
To send you notifications about shifts, rota updates, and service announcements.
To allow shop managers to coordinate volunteers.
4. Legal basis for processing (UK GDPR)
Contract: processing your name, email, phone number, and rota data is necessary to provide the service you have been invited to use.
Legitimate interests: maintaining anonymised historical rota records for operational continuity.
Consent: push notifications, which you can withdraw at any time in your device settings.
5. Data sharing
We do not sell your personal data. We use the following third-party processors:
Google Firebase — push notification delivery on Android devices
Apple APNs — push notification delivery on iOS devices
6. Data retention
Your personal data is retained for as long as your account is active. If you request deletion, your name, email, and phone number are permanently removed and your password is erased. Anonymised rota history records (with no personal identifiers) are retained for operational record-keeping purposes.
7. Your rights
Under UK GDPR you have the right to:
Access the personal data we hold about you
Correct inaccurate data
Request erasure of your personal data
Object to or restrict certain processing
Data portability
To exercise any of these rights, contact us at hello@villageshop.app or use the "Delete my account" option in the app's Profile page.
8. Security
All data is transmitted over HTTPS. Passwords are stored as one-way hashes and are never readable. We take reasonable technical measures to protect your data against unauthorised access.
9. Changes to this policy
We may update this policy from time to time. Continued use of the Service after changes constitutes acceptance of the updated policy.