Privacy

Version 2026-10-04. This is the version recorded against any consent you give in the app.

14 October 2026: Resend now sends the sign-in codes, in place of our own email server. Nothing you agreed to has changed.

Post Nights works out where your body clock is from the shifts you actually work, and tells you when to sleep. That makes almost everything it holds health information, and this page is written on that basis rather than hoping otherwise.

We do not sell your data, and we never will. Not to advertisers, not to data brokers, not to your employer. There is no version of this product where your roster is a revenue stream.

Who is responsible

Post Nights LLC is the controller of the data described here.

Post Nights LLC
5900 Balcones Dr, Ste 5374, Austin, TX 78731
United States
+1 (512) 955-2518

What we collect, and why

What	Why	Basis
Your roster — the shifts you enter or import	It is the input to the model. Without it there is no plan.	Explicit consent (GDPR Art. 9(2)(a))
Your plan — the sleep, nap and light times we compute, and the estimate of your body clock behind them	It is the product.	Explicit consent
Sleep you log, how alert you felt	Corrects the plan against your life instead of an average. Each is optional and asked for separately, when it first matters.	Explicit consent, separately for each
A week you choose to share, if you make a link to it — your rest times for the week, and whether you are at work or have a long drive home if you leave those switched on	So the person you send the link to can see when you are resting. Only what the app previewed to you; never your shift times.	Explicit consent, asked when you make the link
Your sleep in your own calendar, if you make a calendar link — your sleep and nap times for the next two weeks	So the calendar app you subscribe with can show them. Only sleep and naps; never your shifts, where you work, or why.	Explicit consent, asked when you make the link
Whether the plan is working, if you agree — how long you slept, whether you slept when the plan said, how well the plan fitted your body clock, and whether you logged it, counted together with other people's	So we can tell whether the plan helps anyone. We only ever look at totals over five or more people, never yours on its own, and they are not shared with anyone. Asked after you have seen your own results; the app works the same if you say no.	Explicit consent, asked separately
A second estimate of your body clock from your watch’s steps (an Apple Watch through Apple Health, or a watch that records to Health Connect on Android), if you agree — each day’s estimated time window, and how much of your waking day the watch saw	To find out whether a watch makes our estimate better. It runs beside the estimate from your roster and does not change your plan or anything you see. Your step counts, and the times your watch recorded your heart rate, are read on your iPhone and never sent to us — only the window is. If you have also agreed to be counted, how far apart the two estimates are is counted in totals over five or more people, never yours on its own.	Explicit consent, asked separately in the app, under Alerts
Your email address, if you add one	So your plan survives a lost or replaced phone. You can use the app without one.	Contract
What Apple or Google gives us if you sign in with them — if you sign in with Apple, Apple gives us an email address, which can be a private relay address Apple forwards to you, and an identifier for your Apple ID. We never ask Apple for your name. We keep a token from Apple, encrypted, only so we can revoke it with Apple when you delete your account. If you sign in with Google, Google gives us your email address and an identifier for your Google account. Google also sends your name and photo, and we delete them before they are stored.	So you can sign in with an account you already have, and so deleting your account also ends Apple's sign-in link to us.	Contract
Anonymous usage analytics — which screens are used and what breaks	To find what is broken. Off unless you turn it on.	Consent
Crash and error reports	So a failure that stops an alarm firing is visible to us.	Legitimate interests
Waitlist email, if you gave us one on this website	One message when the app launches.	Consent
Beta sign-up, if you asked to test the app on postnights.com/beta — your email, whether you use an iPhone or Android, and whether you work nights or rotating shifts	So Apple or Google can invite you to test the app before it launches. Your address goes to Apple (TestFlight) or Google (Play testing) for that one invitation, and to no one else.	Consent, asked on that page

What we deliberately do not collect

Location. Ever. We never ask for the permission. Your workplace is stored as text you typed, and it is never turned into coordinates.
Your name, photo, contacts or phone number. An email address is the only contact detail we hold — one you add, or the one Apple or Google gives us if you sign in with them — and only if you want your data to outlive the phone.
Photographs of rosters. If you photograph a unit roster, it is read on your device and only your own row leaves it. The image never does.
On an iPhone the reading is done by Apple, on the phone, and nothing about it is sent anywhere. On Android it is done by Google’s ML Kit, also on the phone. ML Kit is built to send Google a usage report each time it reads — the app’s version, your phone’s model and country, and an ID for this installation, never the text or the picture — and we have switched that off: the app does not let those reports leave. One thing no app can switch off: Google Play services, which ML Kit runs through, notes for itself that the reading feature was used, whether it worked and how long it took. That record is Google’s, part of how Play services runs on every Android phone, and it holds nothing from your roster.
What Apple Health holds. If you allow it, Post Nights reads how long you were in daylight, which an Apple Watch records, to show beside the plan’s advice to get outside; that number is never sent to us or to anyone else, stored with your account, or used for anything else. When you log your sleep, it can also read when Apple Health recorded you asleep — only the start and the end, never sleep stages or anything else — and offer those two times for you to check. Nothing is filled in until you tap to use them, and nothing reaches us unless you then save the log, when they are sleep you log like any other, in the table above. If you also agree to the watch estimate above, it reads your Apple Watch’s step counts and the times it recorded your heart rate — never the rate itself — and those too stay on your iPhone: only the estimated window described above leaves it. Post Nights writes nothing to Apple Health, and nothing from it goes to iCloud, to advertising or to anyone else. You can turn each off in the app, and change what it may read in Settings › Health › Data Access & Devices.
What Health Connect holds, on Android. Only if you agree to the watch estimate above and then allow it in Health Connect, Post Nights reads the steps your watch recorded and the times it recorded your heart rate — never the rate itself, and never steps your phone counted. They stay on your phone: only the estimated window described above leaves it. Post Nights writes nothing to Health Connect and reads nothing else from it. Removing its access in Health Connect stops the reading; turning the estimate off in the app also deletes the windows we hold.

Who else sees it

Only companies that run parts of the service for us, under contract, and only what each one needs:

Supabase — the database your account and plan live in (United States).
Resend — sends the sign-in codes to your email address (United States). It receives your address and the code, nothing else.
Sentry — crash reporting (European Union).
PostHog — usage analytics, only if you turned it on (EU, Frankfurt). It receives which screens were opened, the app and system version and the kind of phone — no account, no name, no IP-derived location, no time zone — and keeps them for a year.
RevenueCat and the App Store or Google Play — subscriptions. We never see your card.
Cloudflare — this website, the waitlist, the beta sign-up, and the page a shared-week link opens.
Apple and Google — if you asked to test the app before launch, your email address, so they can send you the invitation (TestFlight or Google Play testing). They handle it under their own privacy policies.
Expo — sends the app's notifications on their way to your phone (United States), and Apple or Google carries them the last step. It receives your phone's notification address and the notification itself — never your roster, your sleep or your alertness.

Each is bound by a written contract requiring protection equivalent to this policy, to process data only on our instructions, and not to use it for their own purposes. Your roster, your sleep and your alertness ratings are never sent to analytics or crash reporting. That is enforced in code, not by policy alone.

The calendar app you subscribe with — Google, Apple or another — fetches your sleep and nap times for the next two weeks from us, and keeps its own copy under its own privacy policy. So can anyone who has the calendar link, which is why it works like a key: it is made on your phone, and we keep only a one-way fingerprint of it. The times are stored with your account, updated each time you open the app. Turning the link off, withdrawing that consent or deleting your health data deletes them, and the link stops working; your calendar app may keep showing what it last fetched until it next checks.

Anyone who has a shared-week link sees that week, and nothing else — including anyone the link is passed on to, and someone who opens it may keep a copy. Nobody can find the page without the link: its key is made on your phone and travels in the link, and we keep only a one-way fingerprint of it. The week itself is stored with your account, like your plan. The page is served by Cloudflare, is not indexed by search engines, loads nothing from anyone else, and a chat app's link preview shows none of it.

Where data is transferred out of the UK or EEA, we rely on the European Commission's Standard Contractual Clauses.

How long we keep it

While your account exists, for the data the plan is built from — it is the model's memory.
A calendar link has no end date. It is deleted when you turn it off, withdraw that consent or delete your health data, and it shows nothing while a subscription has ended.
A shared week stops after ninety days unless you renew it, and is deleted then. Turning the link off deletes it at once, as does withdrawing that consent or deleting your health data.
The watch estimate is kept while that consent stands. Withdrawing it deletes every window at once, as does deleting your health data.
A beta sign-up is kept until the test ends, then deleted. Leaving it on postnights.com/beta deletes it at once.
Backups — we keep no backup of your data for longer than six months, so a deletion reaches every copy within that window.
A deletion record outlives the account: the fact that a deletion was requested and completed, keyed by a one-way hash rather than by you. It is what lets us prove we honoured it.

Your rights

You can get a copy of your data, correct it, delete it, restrict or object to how it is used, and take it elsewhere in a portable format. You can withdraw any consent at any time — and withdrawing stops us using that data, it does not merely hide a switch.

Four of these are separate things in the app, on purpose:

Withdraw a consent — Settings → Your data.
Delete your health data but keep the account — also Settings → Your data.
Export everything — Settings → Your data.
Delete your account — Settings → Delete account, or see how to delete your account if you no longer have the app.

We act within one month, and within 45 days for consumer health data. Deleting your account does not cancel a subscription — Apple or Google keeps billing you until you cancel it with them, and the app tells you so before you confirm.

If you are in the UK or EEA you may complain to your data protection authority. In the UK that is the Information Commissioner's Office.

Children

Post Nights is for adults at work. It is not directed at children and we do not knowingly collect their data.

What we do not claim

Post Nights is not a medical device. It does not diagnose, treat, cure or prevent any medical condition, it does not assess your fitness for duty, and it reports nothing to your employer. The model behind the body-clock estimate is accurate to about an hour in laboratory studies that measured the light people saw; we estimate yours from your roster, which is less precise — enough to place a nap and a pair of sunglasses, not enough to tell you a precise time.

For medical advice, a diagnosis or treatment, speak to a healthcare professional. If your sleep is affecting your health, that is worth raising with a doctor — Post Nights is a scheduling tool, not care.

Changes

If we change how your data is used in a way that needs your agreement, we ask again rather than updating this page quietly. Every consent you give is stored with the version of the words you were shown.