NCHD Pay Audit
Privacy Policy
Local-first records
Employment, shift, location-candidate, pay, payslip, attachment and note data is stored on the user’s iPhone. Payslip recognition runs on device. The developer does not receive or sell this data.
Optional private iCloud sync
When enabled, app records are stored in the signed-in user’s private CloudKit database and count against that user’s iCloud storage. Apple processes App Store purchases and iCloud data under Apple’s terms.
Disabling sync stops future transfers. Users can permanently delete the app’s private CloudKit record from Settings without deleting local records.
Location
Location monitoring is optional and limited to arrival and departure candidates around locations selected by the user. It does not store a continuous location trail, and candidates do not become paid time until confirmed.
Diagnostics
Operational diagnostics may contain app version, error category, feature state and duration. They exclude pay amounts, hospital, location, notes, attachments and stable business-record identifiers. The app keeps at most 50 events in memory, sends nothing automatically and clears them when the app closes or local data is deleted. If a user deliberately shares diagnostics with support, the selected sharing service may attach account information such as an email address. The developer uses the support request only to resolve that issue and deletes it within 30 days after resolution.
Data rights
Users can export their raw records, create a checksummed backup and permanently delete local data from Settings. CSV exports and backups may contain sensitive pay records and evidence. The backup is integrity-checked but is not encrypted by the app after export, so users must choose a secure destination. Local deletion also stops location monitoring and removes pending app notifications. User-created exports and backups remain under the user’s control until the user deletes them. Subscription expiry does not remove or hide existing records.