Privacy

• Hustle keeps your jobs, shifts and pay settings so it can show your calendar and estimate your pay. Only you can see them in the app.
• With Data lock on, your shifts, jobs, pay settings and money are locked on your device before they’re saved, and only you can read them. We can’t, except what you send to Chat or rota import, or the timetable copy an app you connected asks for (see Data lock below). Shift times you sync to Google Calendar go from your device straight to Google.
• AI is only used when you import a rota or use Chat, and only gets what that needs.
• Connected apps (ChatGPT or Claude) only if you turn sharing on: they can read your work timetable, never your pay or money.
• Google Calendar only if you connect it: your shift times go into a calendar called “Hustle shifts”, never your pay or money.
• No bank login, no ads, and we never sell your data.
• Usage statistics only if you say yes, and you can change your mind any time.
• You can clear your data, or delete your account, from Settings at any time.

Hustle is a small independent app run from the UK. For anything about your data, email privacy@hustlepay.co.uk.

• Your sign-in: your email address, an account ID and the name you give Hustle (with Google, the name, email and profile photo link Google shares). To sign you in and greet you. Kept until you delete your account.
• Your jobs: names and the other names they go by on your rota, colours, pay rates, night, overtime, holiday and sick pay settings, breaks, pay dates, tax code, tax region, National Insurance category, and pay and tax so far this year if you add them. To estimate your pay. Kept until a full reset or account deletion.
• Your shifts, overtime, holiday, sick days and notes; days you protect and their notes; when each job is open. For the calendar and availability. Kept until you clear them, a full reset or account deletion.
• Money you note down (account, savings and loan savings totals, next rent, transactions). For the money planner. Kept until a full reset or account deletion.
• Data lock, if it’s on: your locked data; the key to it, itself locked separately by your unlock password, by each Face ID or fingerprint passkey you set up, and by each recovery code, so only those can open it; the passkeys’ IDs, with the kind of device each was added on (like iPhone or Windows PC) and the day; one-way codes (hashes) that find a recovery code when you use one and check that a change comes from someone holding the key; and whether it’s on. So you can unlock on your devices. Kept until you turn Data lock off, start fresh, run a full reset or delete your account.
• Your devices: for each phone or computer signed in, the kind of device and browser (or the Hustle app), an approximate town and country worked out from the internet address when it connects (the address itself isn’t kept), when it first signed in and was last active, and whether it opens Data lock with Face ID or a fingerprint. Also the random IDs and countries of devices your account has used, so signing in again on the same browser isn’t treated as new, and how many new sign-in emails went out today. So you can see where you’re signed in and sign devices out, and so we can warn you about a new sign-in. A device is removed when you sign it out, after 90 days without use, or when you delete your account.
• Connected apps, if you turn on sharing: a copy of your timetable (shift days and times, job names or plain labels, the days you’re not working with no reason, protected days, with their notes only if you choose, and payday dates), sent by your device and kept locked so Hustle can only open it when an app you connected asks; which apps you connected, from which website, and when each last asked; one-way codes (hashes) of the sign-in tokens each app uses; and your sharing choices. Never pay, rates, estimates, tax, money, or shift and leave notes. A copy is deleted when you disconnect that app, turn sharing off, change what’s shared or delete your account.
• Google Calendar, if you connect it: your Google account’s email, the ID of the “Hustle shifts” calendar, whether events show job names, when you connected, and a sign-in token from Google, kept encrypted, so your device can update that calendar. Never your shifts. While you’re on Google’s page, for up to 10 minutes, which account is connecting and two one-time codes that make sure it finishes in the same browser. Deleted when you disconnect or delete your account.
• Your own OpenAI key, if you add one: stored only encrypted, and it can’t be read back, even by you. Kept until you remove it or delete your account.
• Free AI counts: how many questions and imports you’ve used this month, kept under a scrambled form of your email address (not your account), so each person gets a fair allowance. Each count is only needed until the start of the month after next, even if you delete your account, so deleting and signing up again doesn’t reset it. After that they’re deleted automatically, usually within a day.
• Short-term counts that stop overuse and inbox flooding: AI requests, password-reset and confirmation emails, and contact form messages, kept under your account ID or a scrambled form of your email or device (IP) address. Each is only needed for about a day. Old counts are then deleted automatically, usually within a day.
• Welcome email note: the date we sent your welcome email, so it’s only sent once. Kept until you delete your account.
• Messages you send us, by email or the contact form (with your reply address if you give one). To answer you. Kept for 2 years after our last message with you; ideas from the What’s new form for 12 months.

Emails we send you: a link to confirm your email address, a password reset link when you ask for one, one welcome email after you join, a new sign-in alert when a device we haven’t seen signs in to your account (one per new device, at most 3 a day), and an automatic reply when you use the contact form (at most once a day, never repeating your message). No newsletters or marketing.

We don’t keep your Chat conversations: they stay on your device only until you clear the chat, sign out or close Hustle. We don’t keep the rota screenshots or text you import. Your pay estimates are worked out on your device each time.

“Scrambled” means a one-way code (a SHA-256 hash) instead of the address itself. It can’t simply be read back, but the same address always gives the same code, so we still treat it as personal data.

Who you work for, your pay rates, tax code and money totals are private. We use them only for the features you use, our database rules stop any other account from reaching them, and we never share them with your employers. With Data lock on, they’re locked on your device before they’re saved, so we can’t read them either. If you copy an availability message, you choose who gets it. We never ask for your bank login or connect to your bank.

New accounts set up Data lock when they get started, and you can turn it on or off in Settings › App & data › Data lock. Your shifts, jobs, pay settings and money are locked on your device with a key only you hold, before they’re saved. We store them locked and can’t open them.

While Data lock is on, we can still see:

• your name, your email address and how you sign in;
• how much of the free AI you use (the counts above);
• how many records you’ve saved, how big they are and when they were saved, but not what’s in them;
• everything else under What we keep that isn’t your shifts, jobs, pay settings or money, like whether Data lock is on, how many recovery codes you have left and whether you saved an AI key.

We can’t see your shifts, jobs, pay settings or money, except the timetable copy an app you connected asks for, while it’s answered (see Connected apps below).

Getting back in. You unlock with Face ID or fingerprint, your unlock password or one of your recovery codes. Resetting your sign-in password by email gets you back into your account, but it can’t open locked data. If you lose every way to unlock, nobody can open your locked data, not even us; Start fresh deletes it and keeps your account.

Google Calendar. Your device syncs only after you unlock, and sends shift times straight to Google; they never pass through our server.

Connected apps. Your device sends the timetable copy only after you unlock, already locked to each app you connected. Hustle can open it only when that app asks, for that one answer.

Chat and rota import. When you ask Chat or import a rota, your device sends what that one request needs through our server to the AI to get your answer. It can be read while it’s answered, just as without Data lock, and we don’t keep it. What OpenAI may keep is under When AI is used.

Recovery codes. Your codes and the Recovery Kit file you download are made on your device and never sent to us, so we can’t see them or send them to you again. Making new codes stops the old ones working.

Only when you use rota import or Chat, through OpenAI (USA). If you’ve added your own OpenAI key, it’s used first and OpenAI’s terms for your account apply; otherwise Hustle’s free AI is used, which needs a confirmed email address.

AI answers send your message, recent chat and a summary of your shifts and pay to OpenAI. Money totals are only sent for money-planning questions, and protected days only for questions about days or availability. Some simple pay questions are answered on your device, without AI. Chat asks OpenAI not to store the request.

To read your rota, Hustle sends the screenshots or text, plus your job names, to OpenAI. Nothing is saved until you review it and press Import. Before you send, it’s worth removing anything private you don’t need, like your address or phone number.

OpenAI says API content is not used to train models by default. Depending on API account settings, prompts and responses may be retained for abuse monitoring for up to 30 days.

Connected apps. If you turn on sharing and connect ChatGPT (OpenAI) or Claude (Anthropic) in Settings › App & data › Connected apps, that app receives your timetable when you ask it something that needs it, in the USA, under its own terms and privacy policy. While it’s answering, Hustle’s server can read the copy. Your device locks each app’s copy so it opens only with that app’s sign-in, and the app can only read; it can’t change anything in Hustle. What OpenAI or Anthropic keep depends on your settings with them.

Google Calendar. If you connect it in Settings › App & data › Google Calendar, your device sends each shift’s start and end time, titled “Work” (or the job’s name if you turn that on), to a calendar called “Hustle shifts” in your Google account, under Google’s terms and privacy policy. Hustle can only change calendars it made, never your others. Never pay, rates, estimates, notes or leave.

When you first visit, Hustle asks whether we may use analytics cookies. Rejecting them is as easy as accepting them, and you can change your mind any time from Cookie settings at the bottom of the site or in Settings › App & data. We ask again after a year.

Always on, because Hustle needs them to work or they remember a choice you made:

• Your sign-in, kept by Firebase in your browser until you sign out, and a note that you’re signed in (hustle-signed-in).
• Your cookie choice (a cookie called hustle-cookie-choice, 1 year).
• Whether the side menu is folded (a cookie called hustle-sidebar-folded, 1 year), light or dark mode, whether you hid amounts (and how you show one) on this device, whether you skipped setup on this device, whether your welcome email has been asked for, the home page sound, and where you were on the home page so a reload brings you back.
• With Data lock: whether you said Not now to it on Home; whether this device is the one turning it off; which of your Face ID or fingerprint passkeys this device has; when it asks to unlock (Every time, After 15 min or At sign-out); and, unless you chose Every time, what this device needs to open your data (a key that can’t be read back out): for one visit only (that browser tab, gone when you close it or after 15 minutes without use) or, with At sign-out, until you sign out. Kept only on this device and cleared when you sign out.
• A reset code, only while you’re on the password reset page.
• A random device ID (hustle-device-id), so Hustle recognises this device in your list of devices, and signing in again here isn’t a new sign-in. It stays until you clear this browser’s data for Hustle. Also, for this tab only, why this device was last signed out, so the sign-in page can say.
• A short-lived pass that proves this browser is using the real Hustle website (Firebase App Check with Google reCAPTCHA), renewed about every hour, and the cookies reCAPTCHA needs to tell people from bots.

Only if you allow it: usage statistics through PostHog’s EU cloud (Frankfurt). PostHog keeps a random ID in a cookie and in your browser’s storage (named ph_… ) so a return visit counts as the same device, not a new one, along with where your visit came from. It records which pages are opened, how fast they load and when you leave them, where you came from (just the website’s name, like google.com, never the page on it) and a link’s campaign tag if it had one (like utm_source=reddit), and when an account is created, a shift is added, a rota is imported or a Chat question is asked. Never what you type, ask or earn, never search words or advertising click IDs, no clicks or screen recordings, and nobody is identified by name or email. Addresses are sent without the part after ? or #, so codes in links never leave your browser. PostHog also gets your browser type, operating system, screen size and language; IP addresses are discarded. Statistics are sent through our own address (www.hustlepay.co.uk) and passed on to PostHog. The data is kept for 1 year. Statistics only run on the live site.

There are no advertising cookies.

• Google Firebase (Google Cloud): the database, in London, and sign-in, a global Google service, including the Google sign-in window at auth.hustlepay.co.uk. If our own email sender is down, Firebase sends the confirmation or reset email instead.
• Google reCAPTCHA (Google Cloud): on the sign-in pages and in the app, it checks that requests come from the real Hustle website and not a bot, using details about your browser and device and how the page is used. It doesn’t show puzzles.
• Google Cloud KMS: encrypts your own OpenAI key and, if you connect Google Calendar, Google’s sign-in token, in the USA. Only the encrypted versions are stored.
• Google Calendar, if you connect it: your shift times, sent from your device.
• Vercel: hosts the website and app; our server code runs in the USA. It also tells us a device’s approximate town and country from its connection, for your list of devices.
• OpenAI: Chat and rota import, in the USA.
• OpenAI (ChatGPT) and Anthropic (Claude): only if you connect them, they receive your timetable when you ask, in the USA, under their own terms and privacy policies.
• Resend: sends Hustle’s emails (confirmation, password reset, the welcome email, the reply to contact form messages) and passes contact form messages to us (a US company; our account uses its Ireland region).
• Zoho Mail: our inbox, in its EU data centre.
• PostHog: usage statistics, only if you allow them, in the EU (Frankfurt).

• To give you Hustle (your account, jobs, shifts, pay estimates, money planner, and AI when you use it): because you asked us to provide the app (contract).
• To keep Hustle safe and fair (the short-term counts, the free AI allowance, keeping the free AI count after an account is deleted, server logs and alerts): our legitimate interest in stopping abuse and keeping free AI affordable for everyone.
• Usage statistics: only with your consent, which you can take back any time in Cookie settings.
• Answering your messages: our legitimate interest in replying to you, or the contract where it’s about your account.

Some of our providers handle data in the EU or the USA (see the list above). The UK recognises the EU’s protection as adequate. For the USA, we rely on the safeguards in each provider’s data processing terms, such as the UK Extension to the EU-US Data Privacy Framework or the UK’s International Data Transfer Addendum.

• Your account, jobs, shifts and money records: until you delete them (a full reset or account deletion).
• Free AI monthly counts: needed until the start of the month after next. Short-term counts: needed for about a day. Both are deleted automatically once they’re no longer needed, usually within a day.
• Welcome email note: until you delete your account.
• Your devices: until you sign a device out, it goes 90 days without use, or you delete your account. An unused device is deleted automatically, usually within a day of reaching 90 days.
• Connected apps: a connection until you disconnect it, or 90 days without use; its timetable copy until you disconnect, turn sharing off or change what’s shared, or 90 days after your device last sent it. Both are deleted automatically, usually within a day of reaching those 90 days.
• Google Calendar: until you disconnect it or delete your account. Sign-ins that never finished are deleted after 10 minutes.
• Messages to us: 2 years after our last message with you; ideas 12 months.
• Usage statistics (if you allowed them): 1 year.
• Copies kept by our providers: OpenAI up to 30 days, Resend’s sending logs about 30 days, Vercel’s server logs a day at most. Our own server logs hold only fixed event names, never your email, account, messages or keys.

• Your data is stored per account, and our database rules let only your signed-in account read or change it.
• Every request to our server that touches your account checks your sign-in.
• Your own OpenAI key is encrypted, tied to your account and never sent back to your browser. Saving or removing it, and deleting your account, need a recent sign-in.
• Every device is signed out after 30 days and asked to sign in again. Signing devices out, or every other device at once, needs your password (or your Google account), and signing out every other device cuts them off straight away.
• Changing Data lock (a new unlock password, new codes, adding or removing a passkey) or turning it off needs proof from your device that it holds the key, and a recent sign-in.
• A connected app gets its own sign-in, which can only read your timetable, lasts an hour and is renewed only while the app still holds its matching key; your device locks each app’s copy to that app; allowing an app needs a recent sign-in, and disconnecting it stops it at once.
• When something goes wrong on our server, we get an alert that says only what failed and when, never anything about you.

No system is perfectly secure. If something happens that puts your data at risk, we’ll tell you and the ICO where the law requires it.

• Devices (Settings › App & data › Devices): see where you’re signed in, and sign out one device or every other device. Password: change your sign-in password.
• Connected apps (Settings › App & data › Connected apps): turn sharing on or off, choose whether protected-day notes are shared and how your jobs are named, and disconnect an app.
• Google Calendar (Settings › App & data › Google Calendar): show job names or “Work”, sync now, and disconnect, which deletes “Hustle shifts” from your Google Calendar.
• Clear all shifts (Settings › App & data): your jobs stay.
• Full reset: deletes your jobs, shifts, settings and money records. It keeps your login, your name, your saved AI key and your AI usage counts.
• Remove your AI key from Settings at any time.
• Data lock (Settings › App & data › Data lock): turn it on or off, change your unlock password, make new recovery codes, add or remove Face ID or fingerprint on each device, or choose when this device asks to unlock. With Data lock on, a full reset also turns it off.
• Start fresh (on the unlock screen, under Can’t unlock?): like a full reset, deletes your jobs, shifts, settings and money records, and keeps your login, your name, your saved AI key and your AI usage counts.
• Delete my account: deletes everything Hustle holds under your account, then your login. You’ll need to have signed in recently. The free AI count and short-term counts above aren’t linked to your account and stay until they’re deleted (see How long things are kept), as do copies kept by our providers and emails you’ve sent us.
• Cookie settings: change your usage statistics choice.

You can ask to see the data we hold about you, correct it, delete it, get a copy you can reuse, or ask us to stop or limit how we use it. Most of it you can edit or delete yourself in the app; there’s no download button yet, so email privacy@hustlepay.co.uk and we’ll send you a copy. With Data lock on, we can’t read your shifts, jobs, pay settings or money, so our copy only has what we can see; the rest is in the app, where only you can open it. To get a full copy from us, turn Data lock off first. We’ll reply within a month, and may ask you to write from the email address on your account so we know it’s you.

If you’re unhappy with how we handle your data, please tell us first. You can also complain to the ICO.

Hustle is for people aged 18 and over. We don’t knowingly hold data about anyone younger; if you think we do, email privacy@hustlepay.co.uk and we’ll delete it.

If this page changes in a way that matters, the date at the top changes, and for bigger changes we’ll tell you in the app first.