Privacy Policy — Overtime HQ

Last updated: November 4, 2026 (team calendar, version counts, crash reports)
Contact: overtimeanddetail@gmail.com

Overtime HQ ("the App") helps you track overtime, paid details, pay and retirement. It is built so your information stays on your phone. This policy explains what the App stores and when anything leaves your phone.

The short version

• Your records are stored on your phone, encrypted. We have no copy of your overtime, pay, paystubs, ESS information or pension figures.
• No ads and no tracking. To help us fix and support the App, it sends two small things that never include your name or anything you entered: its version once a day, and crash reports (from the 1.1.1 store version). Both can be turned off in Settings › App version.
• The shared calendar is optional. If you use it, you sign in, and the name you choose, the overtime slots you post and your sign-ups are stored on our server (Google Firebase) so the people you invite can see them. Nothing else from the App goes there.
• Otherwise, information leaves your phone only when you send it: when you email or share something (through your phone's Mail app or share sheet), or when you sign in to NYC Employee Self-Service (directly with the City of New York).

Information stored on your phone

Everything you enter or import — overtime entries, paid detail shifts, pay stubs, paid overtime and W-2 figures from ESS, leave balances, calendar events, retirement figures, your profile (name, rank, command, email for slips) and your signature — is stored in the App's storage on your phone, encrypted with AES-256. The encryption key is kept in your phone's secure Keychain (iOS) or Keystore (Android).

Deleting the App deletes your records. iOS may keep the App's encryption key in the Keychain, but it cannot open anything once the records are gone.

Shared calendar (optional)

The shared calendar lets you post overtime slots and share them with people you invite with a code or link. It is the only part of the App that uses an account and a server.

• Sign-in: Sign in with Apple (iPhone) or Google (Android), through Google Firebase Authentication. Firebase keeps your sign-in ID and the email address Apple or Google gives it (with Apple you can hide your real address). We never show your email to anyone.
• What is stored on the server: the name and color you choose; the calendars and super teams you are on and your role; the slots you post (date, start and end time, overtime type, people needed, a note, and a place only if you add one); who signed up, asked for a spot, or answered "Did you work it?" for a slot; the days you mark as not available (just the dates, never a reason); entries you add to a super team's calendar or choose to share there, one at a time (whether it's overtime, a day off, vacation or an event, its day or days, its times, the overtime type or event title, and a note only if you add one); comments people write on those entries and on slots; people you blocked; reports you send; and your phone's notification token, so the App can notify you.
• Who can see it: only people on the same calendar or team, through the invite code or link. The person who posted a slot and team leaders can see the names on it; others see names only if the calendar's owner allows it. Days you mark as not available show as "Unavailable" to the people on your own calendar and your super teams, not on other people's calendars you follow. An entry on a team calendar, and its comments, are seen only by the people on that team; comments on a slot by the people who can see the slot. Nothing from your own calendar is shared unless you add it or tap Share on that entry — never automatically, and never pay. Codes can be reset at any time, and owners can remove and block people.
• What is never sent: your overtime log, pay, rates, slips, paystubs, W-2s, leave banks, ESS login and data, paid details, pension figures, photos and notes stay on your phone. When you answer "Did you work it?" with Yes, the overtime entry is made on your phone; the server only records that you worked it.
• Where: Google Firebase (Cloud Firestore, Cloud Functions and Authentication) in the United States. Information is encrypted in transit and stored encrypted by Google. Security rules let each person read only their own information and the calendars they are on; only our server can change anything.
• Notifications: sent through Expo's push service and Apple or Google. They show names, dates and times, never pay. Each kind can be turned off in Settings › Shared calendar.
• How long: slots and sign-ups are deleted automatically 60 days after the slot's date; shared team-calendar entries and their comments 60 days after the entry's last day. Everything else stays until you delete it.
• Deleting: Settings › Shared calendar › Delete my shared calendar data deletes your sign-in, your calendar and its slots, your places on other slots, the entries you shared on team calendars and the comments you wrote, your notification tokens and your name from slots you posted on teams. A team you lead alone passes to the next member. Reports you sent are kept without your name. Nothing on your phone is touched.
• Reports: reports go to us for review. We may remove content or people that break the Terms of Service.

NYC Employee Self-Service (ESS)

The optional ESS import opens the City of New York's own Employee Self-Service website inside the App. You sign in on the City's page, including any verification code the City sends you. The App then reads the pages you are signed in to — pay stubs, overtime inquiry, pay type inquiry and tax summary — and saves the figures on your phone. Overtime HQ is not affiliated with the City.

If you choose "save my login", your ESS username and password are stored only in your phone's Keychain (iOS) or Keystore (Android), on that phone only, protected by Face ID or your device passcode, and used only to fill in the City's sign-in page. They are never sent to us or to anyone else. "Disconnect ESS" deletes them at any time; if you delete the App, a saved login is removed the next time the App is installed.

The App never stores or reads your verification codes.

Photos and scanning

Photos of overtime slips, paid detail cards, checks or screenshots are read on your phone with Google's on-device text recognition (ML Kit). The images and their text are not uploaded. Google's ML Kit software may send Google anonymous information about how the text recognition performs (for example, how long it took); it does not include your images, their text or anything that identifies you.

Moving to a new phone

Settings › Backup & restore makes one encrypted backup file, locked with a passphrase you choose. You decide where to keep it (for example Files or iCloud Drive). We never receive it, and it cannot be opened without your passphrase, which is not stored anywhere.

Email, print and share

When you email an overtime slip, a report or a problem report, or share a file, the App opens your phone's Mail app or share sheet with the content filled in. Nothing is sent until you tap Send, and it goes through your own email account to the addresses you choose. ESS problem reports leave out passwords, codes, names and pay amounts.

Notifications

Reminders (for example a paid detail starting soon) are scheduled on your phone; no server is involved. Shared calendar notifications come from our server, as described above, only if you use the shared calendar and allow notifications.

Version counts and crash reports

So we know how many members are still on an older version, and how many use the App, the App sends once a day at most, when it opens: a random number made on your phone (not linked to you, your name, your sign-in, ESS or anything you entered), the App's version and build, and whether the phone is an iPhone or Android. Our server (Google Firebase, United States) keeps only that and the day it was last seen, deletes it after 15 days without a new one, and shows us only totals — phones per version, and phones that opened the App in the last 7 and 14 days.

From the 1.1.1 store version, if the App crashes — or shows its "Something went wrong" screen — it sends a crash report through Google Firebase Crashlytics: which screen was open (its name, like "Overtime"), the error and where in the App's code it happened, the phone model, system version, App version, and a random identifier Crashlytics makes for the installation. Never your name, sign-in, notes, pay or anything you entered. Google keeps crash reports for up to 90 days.

Settings › App version has a switch for each: Count this phone in app usage and Send crash reports.

Advertising, tracking

The App contains no advertising and no cross-app tracking. We do not sell or share personal information. The shared calendar information above is used only to run the shared calendar; version counts and crash reports are used only to support and fix the App.

Deleting your information

Settings › Danger zone › Reset all data deletes everything the App has stored on your phone. If you used the shared calendar, also use Settings › Shared calendar › Delete my shared calendar data (or email us) to delete what is on the server. Emails you sent stay in your own mailbox and with the people you sent them to.

Children

The App is not directed at children under 13, and we do not knowingly collect information from children.

Changes to this policy

If this policy changes, the updated version will be published at the same address with a new "Last updated" date.

Contact

Questions: overtimeanddetail@gmail.com

Overtime HQ is an independent app. It is not affiliated with, endorsed by, or connected to the New York City Police Department, the City of New York or any union.