Ratefold: Hospital Shift Pay — Privacy Policy

Effective date: 31 October 2026, for Ratefold 1.1, the version that sells Ratefold Pro, on Google Play and in the iPhone app on the App Store. (The 8 October 2026 policy covered 1.0, which sold nothing. Revised the same day, 31 October, to cover the iPhone app.)

This policy covers Ratefold: Hospital Shift Pay ("Ratefold", "the app") from Google Play, from the App Store on iPhone, and as an installable web app. It describes this version as it is built today.

The short version

• Ratefold has no account. You do not sign up, sign in or give a name or an email address.
• What you enter stays on your phone. The app does not send your shifts, rates, pay settings or tax answers (your state, W-4, state form and deductions) anywhere. (If your phone's own backup is on, Android may copy app data to your Google account, or iOS to your iCloud account; see below.)
• There are no ads and no usage tracking, and no crash reporting.
• No third-party code for ads or attribution ships in this version. RevenueCat, the billing service, is the one outside service (see below).
• Ratefold Pro is sold as a subscription through Google Play, and in the iPhone app through the App Store. To know whether you own it, the app asks RevenueCat, the app's billing service, soon after it starts. That sends RevenueCat a random app user ID and basic app and device details even if you never buy (in the iPhone app, also Apple's identifier for vendor); if you buy, your purchase goes too. Nothing you enter in Ratefold goes with it. See Purchases, below.
• You can export everything you have entered, at any time, for free, and erase it from your phone whenever you like.

What Ratefold stores, and where

Everything you put into Ratefold is kept in the app's own storage on your phone:

• your jobs, base rates and differentials
• the shifts you log, including clock-in and clock-out times, breaks, the differentials you mark on them, and any note you add
• your overtime rule and pay schedule
• your settings: appearance and lock timing
• a few things the app keeps about itself: how many times it has been opened, when it was first and last opened, whether you dismissed the install invitation, and when you last copied a backup. Like everything else here, they leave the phone only inside a backup you copy or save yourself. Your passcode never goes into a backup.
• if you set a passcode, a salted hash of it (PBKDF2-SHA-256). The digits themselves are never stored.

Ratefold keeps a copy of its own data on the phone before it upgrades the storage format or restores a backup over it, as a way back if something goes wrong. That copy never leaves the phone either, and Erase everything removes it.

The passcode keeps Ratefold's screens closed to someone holding your unlocked phone. It is not encryption: the stored data is protected by your phone's own security, such as its screen lock.

What leaves your phone, and only when you choose

Nothing you enter in Ratefold leaves your phone unless you take it out yourself. You can:

• copy your shifts as a CSV, or save them as a CSV file where your browser lets the app save files
• copy the pay breakdown as plain text
• copy a full backup, or save it as a file where your browser lets the app save files
• copy your rule card to share with a coworker

What happens to that text or file next is up to you and the app you paste it into or the place you save it. Ratefold does not send it anywhere.

If you restore a backup using the paste button, Ratefold reads your clipboard at that tap and no other time. When you restore a backup or import a rule card, it shows you what would change before anything changes.

Purchases

Ratefold Pro is sold as a yearly or a monthly subscription through Google Play, and in the iPhone app through the App Store. If you buy it, the purchase is made in Google Play, or in the App Store on iPhone, and Ratefold uses RevenueCat (RevenueCat, Inc.), its billing service, to know what your store account owns.

Exactly what leaves your phone, and who receives it. Ratefold asks RevenueCat what this install owns soon after it starts (each time it shows a screen with Pro in it), whether or not you ever buy, and again when you buy or restore:

• RevenueCat receives, over an encrypted connection:
• a random app user ID that RevenueCat's code creates on this install the first time the app asks

what you own (it is not your name, email, Google account, Apple Account or any device identifier);

• only if you buy or restore, the purchase: the purchase token Google Play issued (in the iPhone app, the App Store's transaction), the plan's product ID, its price and

currency, whether it was a restore, and from then on the dates, trial and renewal state that RevenueCat reads back from Google Play or the App Store;

• with every request, the app and device details any app sends: the app's package name and

version, RevenueCat's code version, the Google Play Billing Library version, the Android version number, the phone's brand and model, the phone's and the app's language, the store country, and whether the app is open or in the background (in the iPhone app, the iOS version and the iPhone's model in place of the Android details);

• your IP address, as with any internet connection. Ratefold does not use it to find where you are;
• in the iPhone app only, with every request, Apple's identifier for vendor: an ID iOS gives the

apps of one developer on one phone, which RevenueCat's iOS code sends. It is used to run the purchase, is not linked to your identity, and is not used for tracking. The Android app sends no device identifier.

• RevenueCat does not receive your name, email address, payment details, advertising ID or

Android ID, or anything you enter in Ratefold. (In the Android app its code collects device identifiers only when an app sets an advertising-attribution ID, and Ratefold sets none; in the iPhone app the one device identifier it sends is the identifier for vendor, above. Its diagnostics reporting is off.)

• Google Play receives the purchase itself, on its own screens: your Google account, the payment

method, the item, the price and the order. Google's billing library on your phone may also send Google technical information about the purchase flow. All of that is governed by Google's privacy policy, not this one, and Ratefold never sees your payment details.

• Apple receives, in the iPhone app, the purchase itself, on its own purchase sheet: your Apple

Account, its payment method, the item, the price and the date. That is governed by Apple's privacy policy, not this one, and Ratefold never sees your payment details.

RevenueCat uses all of this only to tell Ratefold what you own, on this phone and when you restore on another, and to show the developer sales totals. It processes it on the developer's behalf, as a service provider. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

The free week, in the Android app: when you start it, Ratefold keeps the date it started in its own storage on this phone. It is not part of your exports, and starting, running or ending it sends no data anywhere and asks neither Google Play nor RevenueCat.

In the iPhone app the free week is Apple's 1-week free trial of the yearly subscription, for new subscribers. Starting it is a purchase in the App Store, which reaches Apple and RevenueCat as described above, and the yearly price is charged to your Apple Account when the week ends unless you cancel at least 24 hours before it ends.

To have that purchase record deleted, email the developer contact address shown on Ratefold's Google Play listing (the same address serves the iPhone app), and it will be deleted in RevenueCat. Google keeps its own record of the payment under Google's privacy policy, and Apple, for a purchase in the iPhone app, under Apple's.

Everything else in this policy is unchanged: there is no account, and there are no ads and no usage tracking, and nothing you enter in Ratefold leaves your phone.

What Ratefold does not do

• It does not collect your name, email, phone number, contacts or location.
• It does not use your camera, microphone, photos or files, beyond saving an export file you ask it to save and opening a backup file you pick.
• It does not use an advertising ID or any device identifier, apart from the identifier for vendor that RevenueCat's code sends in the iPhone app (see Purchases). (The purchase record uses a random app user ID that RevenueCat's code makes on this install; see Purchases.)
• It does not send notifications and does not ask permission to. (The Android app does declare the vibrate permission, through Capacitor's haptics plugin (@capacitor/haptics), so saving a shift can be felt as a short buzz. Android never asks you about it, and it sends nothing anywhere.)
• It has no server of its own. The app's screens are blocked from connecting to any outside address; the one exception is the store connection described under Purchases, which Google Play's (in the iPhone app, Apple's) and RevenueCat's own code makes, not the screens.
• It does not sell or rent data. The only data that reaches a third party is what Purchases describes, which RevenueCat processes on the developer's behalf.

Google Play, the App Store, and your phone's own backup

When you install Ratefold from Google Play, Google knows that your Google account installed it and handles updates, as it does for any app, under Google's own privacy policy. If you buy Ratefold Pro, Google Play takes the payment and keeps its own record of it; Ratefold never sees your payment details.

If your phone's own backup to your Google account is turned on, Android may include Ratefold's data in that backup, the same way it backs up other apps. That backup is made by Android and kept in your Google account under Google's terms. Ratefold's developer cannot see it. You can turn it off in your phone's settings.

On iPhone, Apple knows in the same way that your Apple Account installed Ratefold from the App Store, under Apple's own privacy policy, and if you buy Ratefold Pro, Apple takes the payment and keeps its own record of it. If iCloud Backup is on, iOS may include Ratefold's data in that backup, kept in your iCloud account under Apple's terms. Ratefold's developer cannot see it. You can turn it off in your iPhone's Settings.

The web version

If you open Ratefold as a web page instead of from Google Play, your browser downloads the app's files from its web address, as with any website. The web server receives the ordinary information every browser sends to load a page, such as your IP address. Ratefold adds nothing of yours to those requests. Once loaded, the app runs on your device and keeps your data in your browser's storage on that device.

Deleting your data

Ratefold keeps no copy of your data anywhere but your phone, so deleting it there deletes Ratefold's copy. You can:

• use Settings, Erase everything, which removes your shifts, rules, pay schedule, passcode and settings from the phone, or
• uninstall the app.

This does not reach copies outside Ratefold: a backup or export you copied or saved yourself, or your phone's own backup in your Google account or, on iPhone, your iCloud account. Delete those where you keep them.

If you bought Ratefold Pro, RevenueCat holds the purchase record described under Purchases. To have it deleted, email the developer contact address shown on Ratefold's Google Play listing, which serves the iPhone app too. Google, or Apple for a purchase in the iPhone app, keeps its own record of the payment.

Children

Ratefold is made for people who work hospital shifts. It is not directed at children, and the only data it lets reach anyone else is what Purchases describes.

If this changes

If a later version handles data differently, this policy will be updated before that version is released, and the change will say plainly what is new and who processes it.

Contact

Questions about this policy or about Ratefold: please use the developer contact email shown on Ratefold's Google Play listing. It is the same address for the iPhone app.

This website

Everything above is about the app on your phone. This last part is about this website, chibuapps.com, which is a different thing.

• What it collects. Nothing. The pages are plain files: no form, no script, no cookie of ours, and no analytics of ours.
• Who serves it. Cloudflare. Like any web host, Cloudflare sees the IP address, the page requested, the time and the identification string your browser sends, in order to deliver the page, and handles that under its own privacy policy: cloudflare.com/privacypolicy.