Last updated July 13, 2026
This Cookie Policy explains how ShiftDispatch ("Company," "we," "us," and "our") uses cookies and similar technologies to recognize you when you visit our website at https://shiftdispatchhq.com ("Website") and use ShiftDispatch. It explains what these technologies are and why we use them, as well as your rights to control our use of them.
In some cases we may use cookies to collect personal information, or that becomes personal information if we combine it with other information.
What are cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information.
Cookies set by the website owner (in this case, ShiftDispatch) are called "first-party cookies." Cookies set by parties other than the website owner are called "third-party cookies." Third-party cookies enable third-party features or functionality to be provided on or through the website (e.g., advertising, interactive content, and analytics). The parties that set these third-party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites.
Why do we use cookies?
We use first-party cookies and browser storage for several reasons. Some cookies are required for technical reasons in order for our Website and application to operate, and we refer to these as "essential" or "strictly necessary" cookies. These include signed, HTTP-only session cookies used for account authentication, staff access, workspace multi-factor authentication, and cross-site request forgery protection. We may also use browser storage for draft schedules, public schedule link management metadata, push notification setup preferences, PWA install prompts, and similar product functionality.
We may use third-party browser analytics technologies only when browser analytics is enabled in the applicable environment and the relevant browser provider keys are configured. Separate server-side product analytics may be used when server-side analytics provider keys are configured, as described in our Privacy Policy. Third-party services may also be involved when you enable optional features, such as Stripe billing, Twilio SMS verification, Supabase Realtime chat, Sentry error monitoring, Google Drive/Docs invoice connectors, and browser push notifications.
How can I control cookies?
You have the right to decide whether to accept or reject non-essential cookies where applicable law gives you that right. Essential cookies cannot be rejected through ShiftDispatch because they are strictly necessary to provide core services such as authentication, staff access, workspace verification, and request security.
You may set or amend your web browser controls to accept, refuse, or delete cookies and browser storage. Where analytics or similar non-essential technologies require consent, ShiftDispatch should not enable those technologies until the required consent or legal basis is in place. You may also contact us at [email protected] with cookie or tracking preference questions.
The specific types of first- and third-party cookies and browser storage used through our Website and application and the purposes they perform are described below (please note that the specific cookies served may vary depending on the specific Online Properties you visit and the features enabled for your account):
Strictly necessary cookies:
These cookies are required for core application functionality, including authentication, staff access, workspace verification, and request security.
Name: __session
Purpose: Maintains signed account session data, login status, login CSRF protection, and limited workspace context.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: http_cookie
Expires in: Authenticated account sessions last up to 30 days; anonymous form sessions expire with the browser session; limited workspace onboarding sessions last up to one hour
Name: __staff_session
Purpose: Maintains signed staff access session data, staff CSRF protection, selected team or worker context, and pending phone verification state.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: http_cookie
Expires in: Up to 30 days
Name: __workspace_mfa
Purpose: Maintains signed workspace multi-factor authentication challenge and CSRF state while an admin verifies a phone-based code.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: http_cookie
Expires in: Up to 10 minutes
Functional browser storage:
These storage mechanisms support product functionality and preferences. They are stored in your browser and may be cleared through your browser controls.
Name: Free schedule builder draft and publish metadata
Purpose: Stores free schedule drafts locally in the browser, spreadsheet import/export state, publish metadata, public schedule URLs, and management tokens used to unpublish or republish free schedule links. Published schedule snapshots are stored server-side.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: html_local_storage
Expires in: Until cleared by you, your browser, or the application
Name: Staff schedule and mobile setup preferences
Purpose: Stores dismissal preferences for shift confirmation prompts, push notification setup prompts, and PWA install prompts. Session storage may also be used to remember a one-session mobile setup bypass.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: html_local_storage and html_session_storage
Expires in: Local storage persists until cleared; session storage expires when the browser session ends
Name: Service worker cache
Purpose: Caches selected staff and workspace application resources and, for staff schedules, selected schedule responses to support PWA behavior and performance.
Provider: shiftdispatchhq.com
Service: ShiftDispatch
Type: browser_cache
Expires in: Until updated, cleared by the browser, or cleared by the service worker
Analytics and customization cookies:
These cookies collect information that is used either in aggregate form to help us understand how our Website is being used or how effective our marketing campaigns are, or to help us customize our Website for you.
Name: Google Analytics 4 technologies
Purpose: If browser analytics is enabled and a Google Analytics measurement ID is configured, Google Analytics may be used to measure aggregate page views and product events. The current implementation sends explicit events and sanitizes campaign parameters before sending analytics data.
Provider: google.com / googletagmanager.com
Service: Google Analytics
Type: script, http_cookie, and related browser storage
Expires in: Set by Google Analytics
Name: PostHog technologies
Purpose: If browser analytics is enabled and a public PostHog key is configured, PostHog browser technologies may be used for product analytics. The current browser implementation disables autocapture, pageleave capture, and session recording, and strips URL/referrer/path properties before sending events.
Provider: PostHog host configured for the applicable environment
Service: PostHog
Type: script and related browser storage
Expires in: Set by PostHog or the configured host
How can I control cookies on my browser?
As the means by which you can refuse cookies through your web browser controls vary from browser to browser, you should visit your browser's help menu for more information. The following are links to information about how to manage cookies on the most popular browsers:
- Chrome
- Internet Explorer
- Firefox
- Safari
- Edge
- Opera
If targeted advertising technologies are added in the future, most advertising networks offer a way to opt out of targeted advertising. If you would like to find out more information, please visit:
- Digital Advertising Alliance
- Digital Advertising Alliance of Canada
- European Interactive Digital Advertising Alliance
What about other tracking technologies, like web beacons?
Cookies are not the only way to recognize or track visitors to a website. We may use other, similar technologies from time to time, like web beacons (sometimes called "tracking pixels" or "clear gifs") if analytics or related features are enabled. These technologies can help us understand traffic patterns, improve site performance, and measure product usage. In many instances, these technologies are reliant on cookies to function properly, and so declining cookies may impair their functioning.
Do you serve targeted advertising?
Based on the current application implementation, we do not serve targeted advertising cookies through ShiftDispatch. If this changes, this Cookie Policy should be updated before such advertising technologies are enabled.
How often will you update this Cookie Policy?
We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal, or regulatory reasons. Please therefore revisit this Cookie Policy regularly to stay informed about our use of cookies and related technologies.
The date at the top of this Cookie Policy indicates when it was last updated.
Where can I get further information?
If you have any questions about our use of cookies or other technologies, please contact us at:
This Cookie Policy was created using Termly's Cookie Consent Manager.