Siby privacy policy

Last updated 23 October 2026

Siby is a team scheduling app. Managers collect their staff's availability, make shift schedules, publish them and send messages to their staff. Staff answer, see their shifts and read the messages. Siby runs as an app on iPhone and iPad, on Android phones and tablets, and in any web browser at siby.work. This policy says what Siby keeps about you, why, who else handles it, and how to delete it. "We" means the people who run Siby.

Organizations and us

Most people use Siby because their workplace invited them. Your workplace (the organization) decides who joins it and what goes into it. For the details an organization puts into Siby about its staff, we act on the organization's behalf, and the organization is responsible for them. For your sign-in, and for anything you send us yourself, we are responsible.

What Siby keeps

• Your account: the email address you sign in with, and your sign-in sessions on each device.
• Signing in with Google or Apple: you can sign in with a code Siby emails to you, with your Google account (in the apps and on the web), or with Sign in with Apple (in the iPhone and iPad app). If you sign in with Google or Apple, Siby receives your email address, your name (from Apple only if you choose to share it), and an identifier for your account with them, so Siby knows it is you next time. Google also sends the web address of your Google profile picture; Siby keeps it with your sign-in but never shows or uses it. Sign in with Apple lets you hide your email address: Siby then receives a private relay address from Apple, which forwards our emails to you. Siby never receives your Google or Apple password. Google and Apple handle your sign-in with them under their own privacy policies.
• Your profile in each organization: your name, a contact email, a phone number if you or an admin add one, your role, your departments and your skills. Admins can also write private notes about a member; only admins see them.
• Your availability answers: when you can or would like to work, and any notes you add.
• Schedules: the shifts you are given, the schedule's change log, and the comments and notes on schedules and shifts.
• Messages: the messages in your Siby inbox, such as "a schedule was published", and the messages admins write to their staff, with who wrote each one. When you mark an admin's message as read, Siby keeps the time.
• Notifications: if you allow notifications in the Siby app, your device's push token, its system (Android or iOS), and the app's language, so a notification arrives in your language. Also your choice of which notifications you get.
• Server logs: the server and its sign-in service record each request, with its time and the IP address it came from. The sign-in service also keeps the IP address with each sign-in session, and keeps a record of sign-ins with each one's time, email address and IP address. We use them to keep Siby secure and to fix problems, never to find out where you are.

Some things stay only on your own device: your language, appearance and text size choices, a copy of your schedules so you can read them offline, and availability answers you have not sent yet.

Siby does not collect your location, contacts, photos, files, or payment details, and does not read your device's advertising ID.

What we use it for

• To run Siby: to sign you in, show you and your coworkers the schedules and messages, send sign-in codes and invites, and send notifications.
• To keep Siby secure and to fix problems.

We do not sell your data. We do not use it for advertising or to build a profile of you.

Who can see it

Inside your organization, people see what their role allows. Coworkers in your department see your name on the published schedule. Admins see the availability answers and contact details of the people they manage. Your contact details and your answers are never shown to other staff.

A message from an admin goes only to members of its own organization: the people in the departments it was sent to, or everyone in the organization. Your organization's top admins can see whether you have marked it as read, and when. So can the admin who sent it, while they may still send messages to one of the departments it went to. Other staff never see it. The message's page tells you who can see it.

We, the people who run Siby, can see each organization's name and its totals, such as how many members, schedules and availability requests it has. We never see anyone's name, email address or phone number this way. If you use "Report a problem" on a message, Siby opens an email to us in your own email app, with the organization's and the message's ids already in it, and no names, email addresses or message text. We receive what you write and the address you send it from, as with any email, and use them only to deal with your report.

Outside your organization, only these service providers handle data for us, and only to run Siby on our instructions:

• Hostinger rents us the server that stores Siby's database and runs the website. The server is in Boston, in the United States.
• Resend delivers our emails: sign-in codes and invites. It receives the address and the email.
• Expo (its push notification service) passes notifications on to your phone. It receives the push token and the notification's text.
• Google Firebase Cloud Messaging delivers notifications to Android phones.
• Apple Push Notification service delivers notifications to iPhones and iPads.

We may also share data when the law requires it.

Ads

Siby shows no ads. If that ever changes, we will first update this policy to say what it means for your data.

How long we keep it

• Your account and profile stay while you use Siby.
• When you delete your account, your sign-in, your contact details, your inbox with the times you marked its messages as read, your skills and your notification settings are deleted. Your name stays on schedules made before, with your past availability answers and the comments and notes you wrote, because they are part of the organization's records. The same happens in one organization when you leave it or an admin removes you.
• If you signed in with Apple and delete your account in the iPhone or iPad app, you confirm with Apple once more, and Siby asks Apple to remove Siby from your Apple Account. If you close Apple's sheet and delete anyway, or Apple cannot be reached, your account is still deleted, and you can remove Siby from your Apple Account yourself (see how to delete your Siby account).
• An organization's schedules, requests, answers and messages stay until its top admin deletes the organization.
• Backups of the database are deleted after 14 days.
• Server logs are kept for a short time, only for security and to fix problems. The sign-in service's record of sign-ins is kept for security, and is not removed when you delete your account.

Your choices

• Change your name and phone number in Siby: More, then your name.
• Turn notifications off in More, or in your phone's settings.
• Delete your account in Siby: More, your name, Delete account. Or see how to delete your Siby account without the app.
• Ask us for a copy of your data, or to correct or delete it, by email. For details your organization put in, you can also ask your organization.
• If you think we handle your data wrongly, you can complain to the data protection authority where you live.

Children

Siby is a tool for workplaces. It is not for children under 16. If you are under 16, do not use Siby. If we learn that someone under 16 has an account, we delete it.

Security

Every connection to Siby is encrypted (HTTPS). The database checks every request, so each person sees only what their role allows. The server's admin tools are not reachable from the internet.

Changes to this policy

When this policy changes, we update this page and its date. If a change matters for your data, we also tell you in Siby before it applies.

Contact

Questions or requests: support@siby.work.