What it is

Merci is the software the crew uses to run a shift.

Merci does not write the schedule and does not make staffing decisions. The posted schedule comes from the scheduling app the house already uses; Merci reads it so the record knows who was expected.

Staff open it to get their side work, mark it done, photograph the finished work, and read what their manager sends them. It also carries a document to a crew member for a signature, helps them fill it in, and returns it signed.

The first question

Is this an app on their phone?

No. It is a web page.

There is nothing to install and nothing in any app store. Staff open a link in the browser they already have, the same way they would open a bank or a news site.

That is the whole answer, and it settles most of what follows. A web page cannot reach the contacts, the photo library, the messages, the other apps, or anything else on the phone, because browsers do not let web pages do that.

Merci goes one step further and tells the browser, on every single page it serves, that it may not use location, the microphone, or a camera feed even if something on the page were to ask.

The second question

Does anyone have to use their own phone?

No, and the choice is theirs.

• The choice is in the welcome email. Two buttons, side by side: use my own phone, or use the company tablet only. Nobody has to open their email on a company device to say no.
• Both ways work identically. Same list, same jobs, same everything. The tablet does not come with extra steps.
• They can change their mind. Either direction, any time, from their own menu. No request, no manager approval.
• Every choice is dated and kept. Who chose what, when, and whether they or a manager entered it.
• Notifications are off until they turn them on. One tap on their own menu, then the phone itself asks. Off again the same way. A shift lead is only notified while checked in, never off the clock.

The third question

What does it save on their phone?

Sign in cookies. Nothing else.

• That they are signed in. The same cookie every website you log into leaves behind.
• Which company and which store. No name, no staff number.

No roster, no photographs, no shift history, no contact list. All of it is on the server and is fetched when they open the page.

The fourth question

What does it actually write down?

The shift, and only the shift.

The fourth question, continued

And nothing that is not on that list.

• Name, and a voluntarily provided email, so she knows whose list it is.
• Write-ups and statements are encrypted with the company's own key, readable only by that company's managers and head office. A crew member asked for a statement sees the one-line ask and a blank form, never the record.
• Merci does not touch payroll.

The photograph

A picture of the work, not of the person.

• Their own camera app takes it. Merci opens the phone's camera the way an attachment does. There is never a live camera feed inside the page.
• What she asks for is the tray, the station, the rack. The job is the subject. Nobody is asked to photograph themselves.
• Some jobs get counted. If the job says a number, the picture is counted, and Merci only speaks up when she is certain it is short. Blurry, dark, awkward angle, anything at all going wrong: the work goes through.
• Pictures are deleted after 60 days. The fingerprint of the picture stays, so the record still shows one was filed and that it was never swapped.

Say it out loud

What Merci does not do.

• No location. Ever. Not at check in, not on a photograph, not in the background. The browser is instructed on every page that it may not ask.
• No biometrics. No face, no fingerprint, no voiceprint. Nothing that would put you inside California's biometric rules.
• Nothing off shift. No tracking, no reading, no listening, no idea the phone exists between shifts.
• No contacts, messages, browsing, or other apps. A web page cannot see them.
• Nothing is sold or shared for advertising. Not to anyone, at any price.

Signing in

Six digits, like the register.

• Merci hands out the number, not the manager. No manager can see a code, choose one, or type one in. A manager can retire one, and the next number appears on the crew member's own screen.
• It is locked to one store. A code from another location does not exist as far as that tablet is concerned, so nobody is ever accidentally started at the wrong store or the wrong brand.
• Off the schedule, no work is handed out. Where the house turns this on, someone not on the day's schedule gets no list until a manager says so. Their arrival is still written at the real minute. Merci never tells anyone they are not scheduled; the screen says they are waiting on their manager, and the conversation happens in person.
• Four ways in, and the house decides which it offers. A tap of the tag by the door, the code on the wall tablet, a link, or an email and password for anyone who prefers one.
• Codes are stored the way passwords are. Hashed, salted, never readable. Not by a manager, not by head office, not by us.

A word at check-in

A notice they read, and a receipt that says so.

• A manager writes it. A big party tonight, a menu change, a policy reminder. It shows on the crew member's screen the moment they tap in, and nothing else until they have read it.
• Tapping is the receipt. Who read it, at what minute, and a fingerprint of the exact wording they read. The receipt is sealed into the same chain as everything else, so neither side can later say it said something different.
• It is a receipt, not a signature. It records that the notice was seen. It does not make the notice policy, and it does not stand in for a document sent for signature.

Orders and guests

What a server may see about a guest.

• A switch on the employee file. "Read restaurant orders: yes or no." Off for everyone until a manager turns it on for the servers who hand orders out. Leads and managers have it.
• With it on: the guest as a first name and initial or a company, which restaurant the order is for, the amount, the time, the items, and the original ticket.
• Never: a phone number, an address, an email, or the guest's notes. Those stay with the manager.
• Reservations. The front-of-house board shows the book as first name and initial. The guest's phone is encrypted and appears only when a host taps that reservation to call them.

Cameras

Merci's eye watches the floor, not the people.

• What it looks for. A person down, a fall, a spill or trip hazard, a table left dirty, a guest kept waiting at the door. Positions and movement, not identities.
• No faces, no names, no biometrics. It does not recognise anyone and is instructed not to describe a person beyond where they are and what position they are in.
• It flags; a manager decides. It files a draft incident with a frame and a short clip and tells the managers. A manager confirms it happened or takes it off. Either answer is recorded with a name.
• Who can watch. Only a manager, signed in, can open the live view. When a manager sees something on the floor that needs to go up the chain, they ask Merci to find that stretch of footage; Merci writes an unbiased account of what she witnessed, and the manager sends it up to headquarters. A manager cannot download footage. Only headquarters can save a copy, and each download is a ledger line with a name and a time. The crew never sees the cameras. Nothing is streamed off the store's network; the box only sends what a manager asks for.
• Retention. Footage on the box is kept three days, a week around anything it flagged. A clip attached to a confirmed incident follows the incident rule: one year, then a still; five years when the incident is about an employee.
• Notice. The crew's "What Merci knows about you" page carries the written camera notice: where, what for, who sees it, how long. No sound is ever recorded.
• Status. Running in the first store since September 2026.

California, in writing

What the state asks, and what Merci does about each.

• Privacy notice (CalOPPA). merciapp.net posts a privacy policy and a "What Merci knows about you" page for the crew: what is collected, why, how long, who sees it.
• Your rights over your data (CCPA). Merci is below the law's size thresholds and honours the rights anyway: to know, to correct, to get a copy, to delete what the law does not require kept. Ask the manager; Merci prints it. Nothing is sold or shared for advertising.
• Cameras (Labor Code § 435, Penal Code § 632). No camera in a restroom, locker room or changing area. No sound recorded, ever. Video-only, disclosed in writing. Positions and movement, never faces or biometrics.
• Personnel records (Labor Code § 1198.5). A copy of what is on file about a person, within 30 days of asking. The PDF for HR on any record is that copy.
• Signatures (Civil Code § 1633.7). A signature drawn on the screen, with the time, the device and the document it was on, sealed in the ledger. Valid as ink.
• Injury and violence records (Cal/OSHA; SB 553). Anything filed about an employee, including a clip, is kept five years. The violent-incident log is written without identifying details.
• Security and breaches (Civil Code § 1798.82). Names, notes and statements are encrypted at rest; a breach of personal information is disclosed to the people affected without delay.
• Automated decisions. Merci makes none. Every write-up, schedule, release and discipline decision is a person's; Merci documents it. The "No Robo Bosses" rules under discussion in Sacramento would change nothing here.

Plain reading of public rules, not legal advice. Reviewed September 2026.

Where it lives

On the server, under lock.

• Names and voluntarily provided email addresses are encrypted in the database. Each company gets its own key, and the key that unwraps it is never stored beside the data.
• Encrypted in transit. Every page, every photograph, every time.
• One kitchen cannot see another. That separation is enforced by the database itself, not by the software remembering to ask.
• Managers see their own house. Head office sees them all. Nobody sees a store they do not run.

Why it protects them too

Nobody can quietly change what it says.

An attendance record usually lives in the same hands that can edit it, which means on the day it matters it is worth exactly one person's word.

• Every line is sealed to the line before it. The day is one unbroken run back to the first entry ever written.
• Every photograph carries a fingerprint. Swap the picture and the fingerprint stops matching.
• An edit is not possible quietly. Not the time, not the name, not by head office, not by the founder. Any change breaks the run and the page names the line it broke on.

This applies in both directions. A missed job cannot be invented after the fact, and a finished one cannot be erased.

Full circle

Check the paperwork against the record.

A shift package is the printed record of a day. Forward one back to Merci's verification address and she reads the seals on it, checks each against the record, and writes back.

• Three answers, not one. The package is genuine; or the paper does not match the record; or the record itself has been changed since it was written. Those are different problems and they point at different people.
• Anyone can ask. A lawyer, an auditor, a manager, the crew member. No account, no login, no permission needed.
• Asking never changes anything. Nothing mailed in can write, edit, or delete a single line.

For your file

What to put in the notice.

If you give a notice at collection, this is the shape of what Merci handles on your behalf, ready to be lifted into your own wording.

Personal device use is offered and never required, the alternative is a house tablet, and the choice is recorded with a date.