Privacy Policy

Last updated: October 23, 2026

ClockWork Pro LLC ("ClockWork Pro," "we," "us") runs the ClockWork Pro website (clockworkpro.app), web dashboard, mobile app and kiosk page (together, the "Service"). This policy explains what we collect, how we use it, who sees it, and the choices you have.

Your employer and us. ClockWork Pro is used by employers. When your employer uses it, your employer decides what information about you goes in and how it is used at work, and we handle that information for your employer. Questions about how your employer uses your information, such as why a time card was changed, go to your employer. A smaller set of information we handle for our own purposes: website visits, the Admin's billing contact, support emails and deletion requests.

Finding this policy in the app: Menu → Privacy & data (app version 2.0.7 and later).

1. Information we collect

• Profile: name, email, phone (optional), role, department, hourly rate, external payroll ID, the work locations you're assigned to, profile photo (optional), PTO and sick-hour balances, and notification settings. Most of this comes from your employer.
• Time and attendance: clock-in and clock-out times, breaks, schedules, shift swaps, time-off requests and notes, approvals, flags, and edits to time cards.
• Location: see Section 5.
• Messages: direct and group messages, announcements, and files you attach.
• Kiosk PIN: stored only as a keyed hash (Section 7).
• Feedback: if you rate the app or send feedback, we keep the rating, your comment and the app version.
• App and device: a push notification token (so we can send notifications to your phone), and which platform (iPhone or Android) and app version you use, with the first and last date we saw it. We do not collect your device model. The mobile app contains no advertising or analytics tools.
• Billing (Admins only): your email and company ID go to Stripe. You enter card details on Stripe's page, so we never see your full card number.
• Website and dashboard visits: see Section 12.
• Technical logs: our hosting providers keep standard request logs (such as IP address and time) to run and secure the Service. Vercel keeps its logs for 1 day and Supabase for 7 days.
• Deletion requests and support emails: the name, email, reason and details you give us.

We do not collect biometric information (no fingerprints or face scans), and the web dashboard and kiosk never collect location.

2. How we use your information

• Provide scheduling, time tracking, messaging and workforce management for your employer
• Verify where you clock in and out, send left-site alerts, and close shifts that weren't clocked out (Section 5)
• Calculate hours, overtime and payroll estimates (Section 8)
• Send push notifications (Section 9)
• Create reports for your employer
• Keep an audit history of changes to time records and settings
• Tell you when your app version must be updated
• Keep the Service secure, including blocking PIN guessing and misuse
• Answer support and deletion requests, and bill Admins
• Improve the Service, including by using ratings and feedback you choose to send
• Comply with the law

We do not sell information about Employees, and we do not use it for advertising. Our public marketing and sign-up pages use a Google Ads tag (Section 12). The sign-in page, the web dashboard and the mobile app do not.

3. How we store and protect your information

Your information is stored by Supabase on Amazon Web Services in the United States (the US East region, in Northern Virginia). It is encrypted in transit and at rest. Database rules decide who can see each record (Section 4). Kiosk PINs are stored only as keyed hashes. Our backups of the database and of uploaded files (profile photos and message attachments) are encrypted, and the key is kept offline. No system is perfectly secure. If a breach affects your information, we will tell your employer and, where the law requires, you.

4. Who can see your information

• Managers see records only for the locations they cover. Your employer decides who is an admin or manager and who has "View payroll."
• If your account is deactivated, you can't see anything.
• Our access: Only the founder can access customer data, through restricted admin tools, and only for support, security and maintenance. The AI-assisted development tools the founder uses for that work are listed in Section 11.

5. Location data

Only the mobile app collects location, and only to confirm where work happens. The web dashboard and kiosk never do.

When we collect it

• When you clock in and out: your phone's GPS position.
• While you're clocked in and the app is open: your position about every five minutes. Only the most recent one is kept on your time record. Each new one replaces the last.
• Never in the background (app version 2.0.7 and later). Nothing is collected while the app is closed. In app version 2.0.7 and later, nothing is collected while the app is in the background either; the app stops using location the moment it leaves the screen. Older versions may keep checking your location for up to five minutes after you leave the app; on some older Android phones (Android 9 and earlier), a position can be recorded during that time. While the app is open, it may also check your location on your phone to show your GPS signal strength or to remind you to clock in when you arrive. That position is not sent to us.
• Your say first. In app version 2.0.7 and later, before the app first uses your location, it explains all of this on screen ("Location while you work"). It uses no location unless you tap Continue.

What it's used for

• Left-site alerts: if you're clocked in and more than the location's radius plus 50 meters away, you and the admins and managers who cover that location get an alert, at most once every 30 minutes.
• Automatic clock-out: if your scheduled shift has ended and you've been away from the site for 5 minutes, our server checks the distance and may clock you out at that moment.
• Forgotten clock-outs: if you're still clocked in 2 hours after your shift was scheduled to end, we close the shift at the scheduled end. If your phone last recorded you at the site later than that, we close it at that later time instead. Any shift still open after 16 hours is closed.
• Every automatic clock-out is flagged on your time card for your manager to review, and you and your managers are notified. If one is wrong, ask your manager to correct it. You should be paid for all time you actually worked.
• We also check your distance from the site when you clock in. We record on your time record how far from the site you were at clock-in and clock-out, and how many minutes before or after your shift you clocked in and out. Clock-outs made away from the site are flagged for your manager to review, and this never cuts your paid time automatically. Your employer can set how early before a shift you may clock in (10 minutes unless changed).

Who sees it: you, your company's admins, and managers who cover your location. Alerts and notifications can show distances (Section 9).

How long we keep it: with the time record it belongs to, for as long as that record is kept (Section 13). If your account is deleted, the GPS coordinates and the distances from the site are removed from your time records.

Your choices: you can deny location permission in your phone's settings. Your employer may then ask you to clock in another way, such as at a kiosk. Your employer must tell you about these features before you use them.

6. How punch times are recorded

• When you clock in or out on the phone, the time comes from our server's clock, not your phone's.
• Clock-in and clock-out times are rounded to the nearest minute when they are saved: 30 seconds or more rounds up, and less rounds down. This applies to punches from the phone, kiosk and dashboard. Punches saved before 8:38 p.m. Eastern Time on August 4, 2026 kept their seconds.
• Late and early minutes are worked out from the rounded times.
• Edits to your time records are recorded in an audit history.

7. Kiosk PINs

If your employer uses the kiosk, you clock in there with a PIN. We store your PIN only as a keyed hash (HMAC-SHA256, using a secret key kept in our database provider's secure vault). That means nobody, not your employer and not ClockWork Pro, can see or look up your PIN. If you forget it, it can only be replaced. The kiosk keeps a log of PIN attempts (the time, whether the attempt worked, and which company's kiosk it was) to stop guessing. The kiosk does not collect your location or take photos.

8. Payroll estimates

Hours, overtime and estimated pay are worked out from your time records and the pay settings your employer enters (in app version 2.0.7 and later, on our servers). Payroll estimates are shown only to admins and managers, and the pay figures in them only to admins and to managers with the "View payroll" permission. Estimates are not paychecks; your employer's payroll decides what you are paid.

9. Push notifications

We send notifications about schedules, time card approvals, shift swaps, time off, missed clock-outs, breaks, messages and announcements, left-site alerts and automatic clock-outs. Managers also get attendance alerts about the people they cover. Arrival reminders are shown by the app itself and are not sent through our servers.

Notification text travels through Expo (our push relay), then through Apple Push Notification service (iPhone) or Google's Firebase Cloud Messaging (Android), to reach your phone. It can include names, a short excerpt of a message (up to about 120 characters), and distances, such as how far from the site someone was. Your phone may show notifications on the lock screen. You can hide previews or turn notifications off in your phone's settings, and your employer can turn some notification types on or off.

10. Photos and attachments

• Profile photos are stored at a web address that anyone with the link can open, without signing in. If that concerns you, don't upload a profile photo.
• Message attachments are not public. Only the person who sent a file and the people who can see the message it is attached to can open it, through links that expire after one hour.

11. Service providers and other sharing

We share information only as follows:

• With your employer, as described in Section 4.
• With service providers that run parts of the Service for us. They may use it only to provide their service to us.

• Push notification text passes through Expo, Apple and Google (Section 9).
• For legal reasons: when required by law, court order or a government request, or to protect people's safety or the Service.
• Business transfer: if ClockWork Pro is merged or sold, information may move to the new owner under this policy.

We do not sell personal information.

12. Cookies, browser storage and Google services

• Signing in: the web dashboard keeps your login session and a few preferences (for example, whether you finished the tutorial) in your browser's storage. The dashboard needs these to work. Signing out clears your session.
• Google Ads tag: our public marketing pages and sign-up pages load Google's Ads conversion tag (gtag.js) to measure whether our ads work. The sign-in page, the web dashboard and the mobile app don't. Google may set cookies and receives your IP address, browser details, the page you're on and the page you came from.
• Google Fonts: some pages (the website, the deletion page and the kiosk page) load fonts from Google, which sends your IP address to Google.
• Google Maps: the Locations page in the dashboard uses Google Maps and Google's address lookup, which sends the addresses being looked up, and your IP address, to Google.
• jsDelivr: the kiosk page loads a code library from jsDelivr, which receives the device's IP address.
• No cookie banner today. You can block third-party cookies in your browser, or turn off personalized Google ads at adssettings.google.com.
• Mobile app: the app has no advertising or analytics tools, and none of the above applies to it.

13. How long we keep information

• While your employer's account is open, we keep your information for as long as you have an account, unless your employer deletes it sooner.
• If your employer deactivates you, you can no longer sign in or see anything. Your records stay in your employer's account.
• Location data stays with the time record it belongs to, for as long as that record is kept, unless your account is deleted (below).
• If your employer closes its company account, the account becomes read-only. Nobody can clock in or change records, and your employer can still sign in to export them. Your employer can reopen the account within 90 days (after that, by contacting us). Time, break, pay and related employment records are kept for three years from the closing date. They are then permanently deleted within 90 days, unless the law requires us to keep them longer (for example, because of a dispute).
• If your account is deleted (by your employer, or after a verified request at clockworkpro.app/delete-data), we delete or remove your login, name, contact details, photo, PIN, schedules, the messages you wrote, your attachments, your time-off requests, the notifications sent to you, your feedback, and the GPS coordinates and distances from the site on your time records. We keep your time and break records, your hourly rate and your payroll ID under the name "Deleted employee," because they are wage records your employer must keep by law. They stay linked to an internal ID and to your employer's payroll ID for you, so your employer can match them in its own records. They are kept as long as your employer's account exists and, if it closes, for three years after that. The full list of what is removed and what is kept is on the deletion page.
• App version records (platform, version, and first and last seen) are deleted when your account is deleted.
• Deletion requests: we keep a record of each request and what we did, as proof that we handled it, for 3 years.
• Backups: we back up our database, profile photos and message attachments every day at 07:00 UTC. The backups are encrypted and stored with GitHub. Weekday copies are kept for 14 days and Sunday copies for 90 days; after that they are deleted automatically. Our database provider, Supabase, also keeps its own database backups for 7 days. So deleted information, photos and attachments included, can stay in a backup for up to 90 days. If we ever restore from a backup, we don't bring back information or files that were deleted after that backup was made.

14. Your rights and choices

Depending on where you live, you may have the right to: know what information we have about you and get a copy; correct it; delete it (subject to the wage-record exception in Section 13); and not be treated differently for using these rights.

• Employees: most of your information is part of your employer's records, so please ask your employer's ClockWork Pro admin first. They can view and correct your records, and on paid plans export them. You can also email privacy@clockworkpro.app, and we will work with your employer.
• Deleting your account: use the form at clockworkpro.app/delete-data (also linked in the app under Menu → Privacy & data, version 2.0.7 and later). Once your account is deleted, your employer's ClockWork Pro admins are told it was deleted at your request, with the name you gave and your reference number (not your email or your reason).
• Checking it's you: before we act, we confirm the request came from you, usually by matching it to your account and confirming by email. We may ask your employer to confirm. Where the law allows, someone you authorize can make a request for you; we will ask for proof.
• Timing: we respond within 30 days.
• If we say no: we will explain why. You can ask us to reconsider by replying to our answer.
• Choices on your phone: location permission, notifications and your profile photo are always up to you.

15. Children and teen workers

The Service is for businesses and their workers. It is not directed to children, and we do not knowingly collect information from children under 13. Workers under 18 may use the Service only when their employer adds them. The employer is responsible for complying with child labor laws and for any parental consent the law requires. Admins must be 18 or older. If we learn that a child under 13 has an account, we will delete it.

16. Where we operate

ClockWork Pro is offered only to businesses in the United States, for their workers in the United States. Your information is stored and processed in the United States.

17. Changes to this policy

We will post any new version here and update the date. For material changes, we will also email Admins at least 30 days before the change takes effect and ask them to tell their Employees. Admins also see a notice on the website the next time they sign in.

18. Contact us

ClockWork Pro LLC, 4352 Bay Road, PMB 500, Saginaw, MI 48603

Privacy questions and requests: privacy@clockworkpro.app
Deleting your account: clockworkpro.app/delete-data