Last updated 12 August 2026
The short version. Lineup holds your name, your work email, your shifts and your hours, because that is what a schedule is. Your manager can see them; your coworkers see far less. There is no advertising, no analytics SDK, no tracking, and nothing is sold or shared with data brokers. Your phone's location is read only on the clock screen, compared to the restaurant's address on the device itself, and thrown away — the coordinates never leave your phone.
Lineup is operated by the publisher named on its App Store listing. For anything in this policy, including a request to see or delete your data, write to colmbremer@gmail.com. A person reads that inbox.
| What | Why |
|---|---|
| Your email address and password | So you can sign in. The password is stored only as a salted hash — nobody at Lineup or at your restaurant can read it. |
| Your name, job title, phone number and start date | Your employer enters these when they add you to the roster. They are how you appear on the schedule. |
| Your shifts, swaps, availability and time-off requests | The schedule itself. |
| Your clock-ins, clock-outs, breaks and declared tips | Your timesheet. In most places your employer is legally required to keep these. |
| Your pay rate and paid-time-off balance | So the app can show you what a week is worth. Coworkers never see either. |
| Messages you send in the app | Shift cover, menu changes, notes from the GM. Visible to the people in that conversation and to a manager. |
Lineup asks for your location only while the Clock screen is open, and only to answer one question: are you at the restaurant right now?
Your phone works out the distance between where you are and the address your manager set, on the device. All that leaves your phone is the answer — inside the geofence, or outside it. Your coordinates are never transmitted and never stored, on our servers or anywhere else. There is no background tracking; if the Clock screen is not open, Lineup is not asking where you are.
You can refuse the permission. The clock still works — the screen says the location was not confirmed, and your punch is recorded as a manual one for your manager to approve rather than as a verified one. The same is true of a punch taken away from the restaurant: it is accepted and flagged, not thrown away, so a bad GPS fix never costs anybody their hours.
A restaurant can choose the stricter setting — “Only allow clock-ins at the restaurant” — in which case a clock-in has to be confirmed by location and the app says so on the Clock screen before you tap. That changes when you can clock in. It does not change any of the above about what is read or what is sent: the comparison still happens on your phone, and your coordinates still never leave it.
Everything above for the staff at their restaurant. That is the job — they build the schedule and approve the hours.
Your name, job title, and the shifts you are on with them. Not your pay rate, your phone number, your time-off balance, your tips or your address.
Nothing. Restaurants are walled off from each other in the database itself, not just in the app, so one restaurant cannot query another's staff even by mistake.
Two companies, both as processors acting on our instructions, and no one else:
Lineup does not sell your data, does not share it for advertising, and contains no third-party advertising, analytics, attribution or tracking software of any kind. We do not track you across other companies' apps or websites.
Data is stored on Supabase infrastructure in the United States, encrypted in transit and at rest.
Your restaurant controls how long its records are kept. Timekeeping records are usually retained for several years because wage-and-hour law requires it — in the United States, the Fair Labor Standards Act sets a floor of three years for payroll records and two for the underlying time cards. When you delete your account, the login is destroyed immediately and your name comes off the roster; the hours you worked stay with your employer, because they are the employer's record as much as yours.
In the app: Me → Account → Delete my account. You will be asked to confirm by typing a word, and then it happens straight away — your login is deleted, you are unlinked from the roster and removed from every message thread, and your name is replaced everywhere it appeared.
One exception, for a good reason: if you are the last manager who can sign in at your restaurant, the app will refuse until you have made somebody else a manager. Otherwise the restaurant would be left with nobody able to publish a schedule and no way to fix it from inside the app.
Most of it is on the Me tab and the Timesheet screen. For anything else, or for a copy in a portable format, email colmbremer@gmail.com and we will respond within 30 days.
You have the right to access, correct, delete, and receive a portable copy of your personal data, and to object to or restrict certain processing. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. Use the same address above; we will not treat you differently for asking.
Lineup is a workplace tool and is not directed at children under 13. We do not knowingly collect data from them. Where a restaurant employs minors under local law, the account is created and controlled by the employer.
Every request is checked against row-level security policies inside the database, so access is enforced by the database rather than only by the app. Passwords are hashed. Connections use TLS. If a breach ever affects your data, we will tell affected users and the relevant regulator as the law requires.
If this policy changes in a way that matters, the date at the top changes and we will say so in the app before the change takes effect.