Privacy policy

This page is a draft that has not yet been reviewed by a lawyer. It describes how the service works today, but it may change before it is final.

ClockZone records when people are at their workplace so that working time can be counted without anyone clocking in or out. Because that involves location, we explain exactly what is collected and what is not. Short version: managers see recorded hours, never where a person is.

1. Who is responsible

ClockZone is run by [operator name not set] , [operator address not set] ("we").

If you use ClockZone because your employer set it up, your employer decides that your working time is recorded with ClockZone and is responsible for telling you about it and for having a legal basis for it. We process your data on your employer's behalf and only to provide the service. Questions about whether and why you are recorded belong to your employer first.

For managers who sign up (your own name, email and company), we are responsible for that account data ourselves.

2. What we collect

Data	What it is	Why
Account	Name, email address, a password (stored only as a one-way hash), your role (manager or employee) and which company you belong to.	To sign you in and show you the right data.
Company set-up	Company name, time zone, hours targets, and the work zones a manager draws (a name and the corner points of the outline), and who is assigned to which zone.	To know where to record time and for whom.
Location readings	A latitude and longitude, how accurate it was, the time on the phone, and whether it was recorded on arriving, on leaving, or as a regular check. See the next section.	To work out when you were inside a work zone.
Work records	Visits: which zone, start time, end time, whether a time was estimated, and whether it needs review. Time a manager added or changed, with the reason, who did it and when.	To produce timesheets and keep corrections accountable.
Sign-in sessions	A token that keeps you signed in on your phone, stored hashed on our server until you sign out. On the manager website, a session cookie in your browser and the matching session on our server.	So you do not have to type your password every time.
Password reset codes	A one-time code sent to your email address, stored hashed, valid for an hour, deleted after use.	To let you set a new password.
Server logs	Your IP address, the time and the address of each request to our server, the name of the software that made it, and error messages. Kept for about two weeks.	To keep the service running, find faults and block abuse.

We do not collect your phone's identifiers, your contacts, your photos, your advertising ID or your browsing. The public pages of this website set no cookies and load nothing from other websites. The manager sign-in sets one cookie, which is needed to keep you signed in; it is removed when you sign out or after a period of inactivity, and it is not used for tracking.

3. Location, in detail

When it is recorded. The app registers each work zone you are assigned to with your phone's location service. When you come close to a zone (inside it, or in a margin around it that is at least 75 metres wide and wider for long or narrow zones), the phone wakes the app. While you stay near the zone, the app takes a reading every few minutes and sends it to us. When you leave, a last reading is sent.
When it is not. Away from your work zones, no reading is sent to us. The app may check your position on the phone itself, for example to show you on your zone map, but that stays on your phone.
The map in the app. The map on your home screen, showing your zone and your own position, is drawn on your phone. Your position for that map is not sent to us or to your manager.
What managers see. Managers see the visits computed from the readings (zone, start, end, total hours). They do not receive the readings, there is no screen showing where anyone is, and there is no live location.
Your phone's settings. Recording while the app is closed needs the Android permission "Allow all the time". You can withdraw it at any time in your phone's settings; then time is recorded only while the app is open. We never ask for more than this.

4. What we do not do

We do not sell your data and we do not use it for advertising.
We do not include advertising or analytics software in the app or on this website.
We do not track you away from your work zones, and we do not build a movement history outside them.
We do not make decisions about you automatically beyond computing your hours; a manager can always review and correct them.

We use a small number of providers. They receive only what they need and may not use it for their own purposes.

Who	What they receive	Why
Our hosting provider	All data on our servers (they host the machines but do not use the data).	To run the service.
Our email delivery provider	Your email address and the text of the password reset email.	To send password reset codes. No other emails are sent.
OpenStreetMap (map images)	When a map is shown in the app, the app downloads map pictures from servers run by the OpenStreetMap Foundation. They see your IP address and which part of the map was requested.	To show the zone editor and your zone map. See the OpenStreetMap privacy policy.
Google (on Android)	Your phone's location service, part of Android and Google Play services, determines your position and detects entering and leaving a zone. Google's own terms apply to that service.	To detect arrivals and departures efficiently without draining the battery.

Within a company, other people can see your data as described above: your managers see your hours and visits; you see only your own. We may disclose data if the law requires it.

6. How long we keep it

Location readings and the work records built from them are kept as long as the employer's company account exists.
When an employer closes the company, or asks us to delete data, we delete it. You can also ask us directly (see your rights).
A person an employer switches off can no longer sign in; their past records remain with the company, because employers have to keep working-time records.
Server logs: about two weeks. Password reset codes: an hour, or until used.
Backups of our database are kept for about two weeks, after which deleted data disappears from them as well.

7. Security

All traffic between the app and our server is encrypted (HTTPS).
Passwords are stored only as one-way hashes.
Every company's data is separated from every other company's, and this is checked by automated tests.
Repeated wrong passwords and too many requests are blocked.
Our servers are kept updated, and access to them is limited to the people who run the service.

No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

8. Your rights

Depending on where you live (for example under the EU and UK GDPR) you may have the right to see the data we hold about you, have it corrected, deleted or restricted, object to its use, receive a copy in a usable format, and complain to your data protection authority.

Write to [privacy email not set] from the email address of your account. We may need to confirm it is you. We answer within one month. To delete your account, see Delete your account.

Because we process employee data for the employer, we may pass your request on to your employer, or ask them to decide on it, for example when it concerns working-time records they must keep.

9. Where data is processed

Our servers are located in [hosting location not set]. If data is processed outside your country, we rely on the legal safeguards the law provides for such transfers.

10. Children

ClockZone is a workplace tool and is not meant for people under 16. We do not knowingly collect data from them.

11. Changes to this policy

If we change how we handle data, we update this page and its date. If a change matters to you (for example a new kind of data), we tell you in the app or by email before it applies.

12. Contact

[operator name not set]
[operator address not set]
Privacy questions and requests: [privacy email not set]