Privacy Policy

This Privacy Policy explains what information Rush ("Rush," "we," "us") collects when you use our marketplace connecting businesses with independent workers for short-term shifts, how we use it, who we share it with, and the choices you have.

The short version: we collect what the marketplace needs to run — identity, contact details, shift and location records, and payment status — and nothing more. We never see or store your Social Security number or bank details, we don't sell personal information, and we delete location coordinates after 90 days.

Account information. Email address, password (managed by our authentication provider), phone number (verified by SMS code), your name, an optional profile photo, and whether you joined as a worker or a business.

Worker profile and activity. Onboarding details including your quiz results and work-authorization attestation, your applications and shift history, reliability score and its history, and reviews exchanged with businesses.

Business information. Business name, contact name and phone, shift locations and details, and the names and phone numbers of managers or supervisors the business adds to its shifts.

Location information. GPS coordinates captured at check-in and check-out, plus an arrival confirmation near the shift site. We collect location only around shift attendance — never in the background.

Referral and waitlist information. Your referral code, who referred whom, and waitlist entries (name, email, phone, and business name for businesses).

Device and usage information. Push notification tokens for your devices, notification history, and standard technical logs needed to keep the service secure and working.

Support communications. Messages you send us, including dispute reports and safety reports.

Payout and identity-verification details — Social Security numbers, dates of birth used for KYC, and bank account numbers — are provided by you directly to Stripe, our payment processor, and are held only by Stripe. Rush receives only your verification status and payout status, never the underlying numbers.

Attendance on Rush is GPS-verified: checking in requires being within 60 meters (about 200 feet) of the shift address, and check-out is recorded the same way. These records exist to verify hours worked and to resolve disputes fairly, for both sides.

GPS coordinates from check-in and check-out are automatically deleted 90 days after the shift. Check-in and check-out times are kept longer as part of the pay record for the shift.

Phone numbers are not public. They unlock only when both sides are committed, and only for as long as they are needed:

• Workers see the shift supervisor's contact number once confirmed for that shift; it is removed 24 hours after the shift ends.
• Businesses see a worker's phone number only for that worker's confirmed shifts — from confirmation through completion of the shift.

Outside these windows, neither side can see the other's contact details.

• Run the marketplace: post and fill shifts, verify attendance by GPS, compute hours and reliability scores, and process reviews.
• Pay people: coordinate payouts through Stripe and keep required pay records.
• Communicate: send shift reminders (you control the lead time), status updates, and support responses by push notification, SMS, or email.
• Keep the platform safe: detect fraud and referral abuse, investigate disputes and safety reports, and enforce our Terms, including non-circumvention.
• Comply with law: tax reporting (via Stripe's 1099-NEC filings), accounting, and responding to lawful requests.

We do not sell your personal information, and we do not use it for third-party advertising.

With the other side of a shift. Businesses reviewing an application see a worker's name, photo, reliability tier, and shift count; contact numbers follow the windows described above. Workers see the business name, shift address, and supervisor contact for confirmed shifts.

With service providers who process data for us:

• Stripe — payment processing, payout verification, and tax forms.
• Supabase — application hosting, database, and authentication.
• Twilio — SMS delivery for phone verification and notifications.
• Expo — push notification delivery to mobile devices.

With authorities or others when required by law, to enforce our Terms, or to protect the rights and safety of users and the public. If Rush is involved in a merger or acquisition, information may transfer as part of that transaction under this policy's protections.

• GPS coordinates from check-in/check-out: deleted 90 days after the shift.
• Supervisor contact numbers shown to workers: removed 24 hours after the shift ends.
• Account and profile data: kept while your account is active, then handled as described under Account deletion.
• Payment records: retained in anonymized form as required for tax, accounting, and legal purposes.

You can delete your account at any time from account settings, in the app or on the web. Deletion immediately removes your personal information — name, phone number, and photo for workers; contact name, phone, and description for businesses — deactivates the account, disables sign-in, and clears your favorites, notifications, and registered devices.

If you deleted your account by mistake, contact support@rush.app within 30 days and we can restore it. After 30 days, deletion is final. Anonymized financial records are retained as described above.

• Edit your profile information at any time from your account.
• Control push notifications through your device settings, and adjust your shift-reminder lead time in the app.
• Location is requested only when you check in or out; declining it means GPS attendance verification — and therefore working shifts — won't be possible.
• Delete your account as described above, or contact us with questions about your data.

We protect your information with encryption in transit, row-level access controls in our database so users can only reach data they're entitled to, and least-privilege access internally. The most sensitive financial data never touches our systems at all — it goes directly to Stripe. No system is perfectly secure, so if we learn of a breach affecting your information we will notify you as required by law.

Rush is for adults. You must be at least 18 to use the Platform, and we do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.

We may update this policy as the product evolves. Material changes will be announced through the Platform or by email before they take effect.

Questions or requests about your data: support@rush.app. Rush is based in State College, Pennsylvania.