Tough Cookies Team App Privacy Policy

This policy explains how Tough Cookies LLC ("Tough Cookies," "we," "us," or "our") handles information in the Tough Cookies Team mobile application and its related workforce services. The app is for current Tough Cookies employees and approved contractors. It is not a public consumer service, and accounts are provisioned by Tough Cookies.

Information we collect

• Account, employment, and sign-in information: name, email, mobile phone number, employee or contractor identifier, job role, work location, employment status, trained skills, account permissions, one-time sign-in code submissions, and related verification and security records. The app does not request access to or read SMS inbox contents, contacts, or call history.
• Schedule and timekeeping information: scheduled shifts, clock-in and clock-out events, breaks, time-off requests, timecard corrections, approvals, and related audit records.
• Training information: assigned courses, lesson activity, quiz answers and results, acknowledgments, certifications, skills, and training-time records.
• Location information: approximate or precise location when a company policy requires evidence for an approved clock action. For eligible delivery workers, precise background location may be collected only while the worker deliberately starts and remains in an active delivery shift.
• Device and technical information: app and device identifiers, push-notification tokens, operating system, app version, security events, and limited diagnostics needed to keep the app secure and reliable.
• Information you submit: time-off reasons, timecard or schedule requests, training responses, acknowledgments, and messages or other content you choose to provide through the app.

How location works

Location access depends on the worker's assigned role and company policy. Kitchen and other on-premises roles are not asked to share precise location unless an authorized policy specifically requires it. Delivery workers may be asked to allow precise and background location for active-route safety, operational visibility, and timekeeping review.

Active delivery tracking begins only after an eligible worker starts an active delivery shift. The app displays an active-tracking state and, where required by the device, a persistent system notification. Tracking pauses during recorded breaks and stops at clock-out, sign-out, shift revocation, or when the worker is off duty. Location failures create a manager-review exception and do not automatically remove paid time.

How we use information

• Provide secure access to schedules, timekeeping, and training.
• Send and verify one-time sign-in codes by SMS to authenticate workforce accounts.
• Apply role-based clock and location policies.
• Coordinate delivery work and verify active-route activity.
• Process time-off, correction, skill, and certification requests.
• Send operational notices about shifts, breaks, training, and requests.
• Investigate errors, protect accounts, prevent misuse, and maintain audit records.
• Meet payroll, employment, tax, safety, and other legal obligations.

How we disclose information

We do not sell personal information and do not use workforce information for third-party advertising or cross-app tracking. We may disclose information to authorized Tough Cookies managers and administrators; to service providers supporting cloud hosting, notifications, messaging (including SMS sign-in delivery), route operations, security, payroll, and business systems; when directed by the worker; or when required to comply with law, protect safety, or defend legal rights. Providers may use information only to perform their contracted services for Tough Cookies.

To deliver an SMS sign-in code, our messaging provider receives the destination mobile phone number and the one-time sign-in code message required for delivery.

Retention and deletion

We retain information only as long as reasonably needed for workforce operations, account security, payroll and employment records, dispute resolution, audits, and legal obligations. Terminating or deactivating an account stops future access but does not automatically erase historical schedules, punches, approvals, training evidence, or other records that must be preserved. Precise route history is subject to more limited access and retention than ordinary workforce records.

Security

We use administrative, technical, and organizational safeguards designed to protect workforce information. These include encrypted network connections, role-based access, secure device storage, audit trails, and access revocation. No security measure can guarantee absolute protection.

Your choices and requests

Device settings let you control location and notification permissions. Some job functions may not work when a required permission is denied, but the app will provide a recovery or manager-review path. Workers may ask a manager to review or correct account, schedule, timekeeping, training, or location-related records. Privacy and deletion requests are evaluated subject to applicable recordkeeping and legal requirements.

Children

The app is a workforce service and is not directed to children under 13.

Changes to this policy

We may update this policy as the app, our practices, or legal requirements change. The updated date above identifies the current version. Material changes may also be communicated through the app or workforce channels.

Contact us

Questions or requests may be sent to mike@toughcookies.co, by phone at +1 781-436-0235, or by mail to Tough Cookies LLC, 44 Auburn St, Brockton, MA 02302-4239, United States.