What the app reads, and what it never does.

Every moment the app reads your position

• When the Clock screen opens — one reading, and one more each time you come back to the app on that screen, so the screen can tell you whether the venue check passes before you tap anything. That reading stays on the phone unless it becomes the one sent at clock-in.
• Once you have tapped to clock in at a locker venue — while the app waits for you to lay the phone on the holder, it keeps checking your distance to the venue until the clock-in goes through, so the reading sent the moment the phone lands on the holder is fresh. At a chip venue there is no wait: the tap uses the reading already in hand, or takes one if none has arrived.
• At the moment you clock in — this is the one that is stored: the coordinates, how far that was from the venue, how accurate the phone said it was, and whether the check passed.
• While you are clocked in with the phone in the locker — an occasional check that the handset is still at the venue, for as long as the phone is awake on the Clock screen. About half a minute after docking the app lets the phone go to sleep, and while it sleeps nothing is read at all. The phone is in the locker, so this is checking the locker, not you.
• While a shift is running with the phone on you — about once a minute, so the shift can close itself if you leave (and on the Clock screen the occasional check above runs alongside it). We are not going to describe that as anything smaller than it is. Those readings are compared on your phone and stay there, with one exception: if the phone concludes you have gone, that single fix is sent to us so the server can check the claim instead of taking it on trust. Even then, what is kept on your shift is how far from the venue you were and how accurate the reading was — not where you were.
• When you send a manual clock-in request — the app attaches a reading, and that one is stored too, as evidence for the manager who decides it. It is best-effort: if the phone cannot get a fix, the request goes anyway and is never refused for it.

Those two — the clock-in and the manual request — are the only readings whose coordinates we store, and both are erased after 90 days. Every other reading in the list is compared on the phone and discarded there. The one exception is the fix that ends a shift when you leave: it is sent so the server can check it, and what stays on the record is the distance, not the position.

And the moments it doesn't

• No coordinates are stored when your shift ends — not when you tap out, and not when the leaving check closes it. There is nowhere in the record for them to go.
• None on your days off or on your commute beyond the single reading the Clock screen takes when you open it, which stays on the phone — and none while the app is closed or in the background.
• No trail of where you go, and nothing from your contacts, photos, messages or other apps. The only points ever held are your clock-ins, for 90 days — and the one thing done with two of them is a check that consecutive clock-ins are not an impossible journey apart, which raises a question for a manager and never blocks a clock-in.
• Clock-in coordinates are deleted after 90 days — the shift stays, the location doesn't. Manual clock-in requests carry the same kind of reading and are erased on the same schedule.
• Leave the venue mid-shift and the shift closes itself, timed from the reading that saw you go — and the app tells you, on screen, that it has. The judgement is made on your phone; the phone then asks our server to close the shift and hands over that one fix, and the server refuses if the reading was too vague, too old, or not actually outside. At locker venues the whole check is switched off for the shift; the phone isn't with you to check, and lifting it off the holder is what ends the shift there.

Two things the app reads that are not location

• One camera frame, only at locker venues where your employer has set up the bay's colour (most have not), taken about 15 seconds after you clock in — the pause lets the phone settle in the bay — to record what the inside of that bay looks like. It is evidence for afterwards, not a gate: a clock-in is never refused because of what the camera saw or didn't. If the shift has already ended or the phone has come off the holder by then, the frame is never taken at all. A single colour is read from it; that colour, and whether it matched the colour your employer set up, is all that is recorded against the shift. If it did not match, or arrived late, a "locker undetected" note is raised for a manager. If the camera could not read a colour at all, nothing is sent and the shift simply carries no camera evidence. The frame is deleted immediately, never leaves the phone, and is never saved to your photo library. We say a picture is taken because that is the accurate description, and it is always the front (selfie) camera.
• The compass sensor, at locker venues, where the phone lies on a magnetic holder. The app reads only the strength of the magnetic field around the handset — not a position, not a direction — and that strength cannot be turned into either. That is what proves the phone is docked, and that lifting it off has ended the shift. It is read only while the app is open in front of you — never in the background, and not while the phone sleeps on the holder. Read on the phone only; the numbers are never sent to us. The only thing that leaves the phone is a yes/no "resting" answer.

Other things worth saying plainly

• A manager can put hours on your timesheet when the dock missed a shift, and can correct the start and finish times of a shift the dock did record. Hours added by hand are marked as entered by hand, never as a dock event, and every change goes into the audit record with the manager's name against it — the typed times, and for a corrected shift the times the dock recorded as well — and a notification on your phone tells you it happened.
• No phone signal when you dock? At a locker with no chip paired to it the shift records on the handset and syncs for a manager to approve. A chip tap with no signal is refused rather than recorded, and the manual clock-in request is the route there.
• Privacy and DPIA documentation is provided to support your workplace rollout.

This website

Separate from the app, and shorter. There is no analytics on this site, no advertising or tracking cookies, and nothing that follows you to another site.

• The demo form stores what you type — your name, company or venue, email, phone, number of sites, staff on payroll and any note — so we can call you back. Your IP address is hashed rather than stored: enough to recognise one source flooding the form, not enough to identify anyone who fills it in once. Enquiries are deleted automatically after about two years.
• Cloudflare Turnstile runs the "are you a person" check on that form and sees your connection metadata as part of it. It is there because this form was flooded with roughly eighteen thousand fake submissions in forty minutes on 28 August 2026.
• The typeface is served from our own site. Loading these pages contacts nobody but us — apart from Cloudflare Turnstile, which the home page loads for the demo form's security check.
• We use these details to arrange your demo and nothing else. No newsletter, no list, no sharing, no sale.