Privacy Policy

What this covers

This policy describes how Tello Staff handles data for the account holder(s) who use the app to manage staff scheduling. It does not cover resident health information — Tello Staff is a staffing tool, not a resident records system, and should not be used to store protected health information.

What we collect

• Account data — the email address and password used to sign in (handled by Supabase Auth; passwords are never visible to us in plain text).
• Schedule data you enter — home names, staff names, shift assignments, reminders, and birthdays you type into the app.
• Staff directory data — names, roles, phone numbers, and notes you add for staff members.
• Chat messages — questions you ask the "Ask Tello" feature and its replies, stored so your conversation persists between visits.
• Time clock records — when a staff member taps Clock In or Clock Out, break start and end times, and any hours the account owner adjusts.
• Time clock sign-in — staff sign in to the time clock by choosing their name (or typing an employee number) and a 4-digit PIN set by the account owner. The PIN is stored only as a salted hash, never in readable form. The names shown on the sign-in screen are the staff the owner has set up. Staff can use the clock page only to clock in and out and to see their own schedule and hours. The owner can also place the clock on their own website; it opens in a panel and works only on websites the owner has approved.
• Clock-in and clock-out photo — each time a staff member clocks in or out, the app takes one photo with the phone's live camera and saves it so the account owner can confirm who clocked in. It is only a photo for a person to look at: no face scan, face template or face matching is made or stored. The staff member sees a notice and agrees before the first photo is taken.
• Location at clock-in and clock-out — if the account owner has saved a home's location, the phone's location is read once, at the moment of Clock In or Clock Out, to check the staff member is at the home. The location (and the distance from the home) is saved with that punch. Location is never tracked in the background or between punches.

How it's used

Solely to operate the app for you: displaying your schedule, sending your schedule data as context to the AI chat feature so it can answer grounded in your actual roster, and nothing else. Data is not sold, and is not used to train any AI model.

Who else sees it

• Supabase hosts the database and handles authentication. Your data is stored in Supabase's infrastructure under this app's account.
• Anthropic processes messages sent to the "Ask Tello" chat feature, including the schedule context sent with each question, in order to generate a reply. See Anthropic's privacy policy for how they handle API data.
• Cloudflare hosts and serves the application files.

No other third parties receive your data.

Data retention and deletion

Data persists until you delete it in the app (staff records, reminders, birthdays, chat history) or ask the account owner to remove it. There is currently no self-service "delete my account" flow — contact the account owner directly to request removal.

Clock-in and clock-out photos are deleted automatically 90 days after the punch. The recorded hours stay on the timesheet. Photos are stored in a private storage area that only the account owner's sign-in can read, are not sold or shared, and are not sent to the AI chat feature.

Security

Data is scoped per account via database-level access rules (row-level security), so one account cannot read another's data. All traffic is encrypted in transit (HTTPS).

Children's privacy

Tello Staff is a workplace tool for adult staff scheduling and is not directed at children.

Changes to this policy

If this policy changes in a way that matters, the date above will be updated and, where practical, existing users will be notified.

Contact

Questions about this policy go to the account owner directly, through whatever channel you already use to reach them.