Privacy policy

What we collect

Information your employer gives us when they add you:

• Your name, work email address, phone number, job title and staff number.
• The branch and department you belong to, and your start date.

Information the app creates when you use it:

• Your location at the moment you press check in or check out — latitude, longitude and how accurate the reading was. We do not track you in the background and we do not read your location at any other time.
• On Android, whether the location was reported as simulated, which is used to reject fake check-ins.
• The date and time of each check in and check out, and whether it was late or early against your branch's policy.
• Corrections you request and the decision your manager makes on them.
• Your profile photo, if you set one.
• Which phone you registered, its model, manufacturer and operating system version, and the public half of the signing key described below.
• Sign-in events, including the IP address and browser or app version, kept as a security record.

The key on your phone

When you register your phone, it creates a signing key inside the phone's secure hardware — the Android Keystore or Apple's Secure Enclave. Every check in is signed with that key, which is how your employer can tell the record came from your phone and not someone else's.

The private half of that key never leaves your phone and we never receive it. We only hold the public half, which can verify a signature but cannot create one. Unlocking with your fingerprint or face happens entirely on the phone: we never receive your fingerprint, your face, or any biometric data.

Why we are allowed to hold it

Your employer is responsible for this data and instructs us on how to handle it. They rely on it to run payroll, to manage attendance, and to meet record-keeping duties the law places on them. We process it only to provide the service to them, and never to sell it or to build a profile of you for advertising.

Who else sees it

Inside your organisation: your managers and administrators, according to the branch they are responsible for.

Service providers we use to run the app:

• Cloudflare R2, which stores profile photos.
• Expo's push notification service, which delivers notifications to your phone.
• Google, if you choose to sign in with your Google account — in which case Google tells us your email address to confirm who you are.
• Our email provider, to send invitations and password resets.

We do not sell your personal data, and we do not share it with advertisers.

How long it is kept

Short-lived items expire on their own: a sign-in session lasts 30 days, an invitation 7 days, a password reset link 1 hour, and the challenge used to sign a check in 90 seconds.

Attendance records and correction decisions are kept for 5 years, which is how long your employer needs them for payroll and legal record-keeping. After that they are deleted.

Security and audit records of sign-ins, device registrations and rejected check-ins are kept for 12 months, so misuse can be investigated, and are deleted after that.

Your choices on the phone

Location and notification permissions are yours to grant or refuse, and you can change them at any time in your phone's settings. Refusing location means you cannot check in from the app, because confirming you are at the office is what a check in is for. Refusing notifications only means you will not be told when a correction is decided.

Deleting your account

You can delete your account from inside the app, under Profile, or ask us to do it using the link at the end of this policy if you have already uninstalled it.

When you delete your account we immediately remove your name, email address, phone number, job title and photo, your password and any linked Google account, your registered phone and its signing key, and your notification tokens. You will be signed out everywhere and cannot sign in again.

We keep the record of the days you attended, with your name removed from it. We do this because those records belong to your employer, who needs them for payroll and must keep them for a period the law sets for them — an employee deleting their own account does not erase their employer's books. The remaining record cannot be used to identify you by name.

Contacting us

Questions about this policy, or about data your employer holds about you, can be sent to the support address below. For anything about why your employer records your attendance, or how long they keep it, your employer is the right place to ask — they decide that, not us.