What the app reads, and what it never does.

Every moment the app reads your position

• When the Clock screen opens — one reading, and one more each time you come back to the app on that screen, so the screen can tell you whether the venue check passes before you tap anything. That reading stays on the phone unless it becomes the one sent at clock-in.
• Once you have tapped to clock in at a locker venue — while the app waits for you to lay the phone on the holder, it keeps checking your distance to the venue until the clock-in goes through, so the reading sent the moment the phone lands on the holder is fresh. At a chip venue there is no wait: the tap uses the reading already in hand, or takes one if none has arrived. From app version 1.7.1, at any venue, once the Clock screen has told you that you are too far away, your next tap takes one fresh reading instead of reusing that one.
• At the moment you clock in — this is the one that is stored: the coordinates, how far that was from the venue, how accurate the phone said it was, and whether the check passed.
• While you are clocked in with the phone in the locker — an occasional check that the handset is still at the venue, for as long as the phone is awake on the Clock screen. About half a minute after docking the app lets the phone go to sleep, and while it sleeps no location is read at all. The phone is in the locker, so this is checking the locker, not you.
• While a shift is running with the phone on you — about once a minute, so the shift can close itself if you leave (and on the Clock screen the occasional check above runs alongside it). We are not going to describe that as anything smaller than it is. Those readings are compared on your phone and stay there, with one exception: if the phone concludes you have gone, that reading is sent to us so the server can check the claim instead of taking it on trust — normally once a shift, again only if the server refuses it or has a fault and the phone tries again. Even then, what is kept on your shift is how far from the venue you were and how accurate the reading was — not where you were.
• When you send a manual clock-in request — the app attaches a reading, and that one is stored too, as evidence for the manager who decides it. It is best-effort: if the phone cannot get a fix, the request goes anyway and is never refused for it.

Those two — the clock-in and the manual request — are the only readings whose coordinates we store, and both are erased after 90 days. Every other reading in the list is compared on the phone and discarded there. The one exception is the fix that ends a shift when you leave: it is sent so the server can check it, and what stays on the record is the distance, not the position.

And the moments it doesn't

• No coordinates are stored when your shift ends — not when you tap out, and not when the leaving check closes it. There is nowhere in the record for them to go.
• None on your days off or on your commute beyond the single reading the Clock screen takes when you open it, which stays on the phone — and on those days none while the app is closed or in the background.
• No trail of where you go, and nothing from your contacts, photos, messages or other apps. The only points ever held are your clock-ins, for 90 days — and the one thing done with two of them is a check that consecutive clock-ins are not an impossible journey apart, which raises a question for a manager and never blocks a clock-in.
• Clock-in coordinates are deleted after 90 days — the shift stays, the location doesn't. Manual clock-in requests carry the same kind of reading and are erased on the same schedule.
• Leave the venue mid-shift and the shift closes itself, timed from the reading that saw you go — and the app tells you, on screen, that it has. The judgement is made on your phone; the phone then asks our server to close the shift and hands over that reading, and the server refuses if the reading was too vague, too old, or not actually outside — in which case nothing closes, and from app build 74 the app tells you you're still clocked in. When your phone is docked on the holder in a locker the check is switched off; the phone isn't with you to check, and lifting it off the holder is what ends the shift. A duty manager's shift at a locker venue, where the phone stays with them, is checked like any other from app build 74.

Two things the app reads that are not location

• One camera frame, only at locker venues where your employer has set up the bay's colour (most have not), taken about 15 seconds after you clock in — the pause lets the phone settle in the bay — to record what the inside of that bay looks like. It is evidence for afterwards, not a gate: a clock-in is never refused because of what the camera saw or didn't. If the shift has already ended or the phone has come off the holder by then, the frame is never taken at all. A single colour is read from it; that colour, and whether it matched the colour your employer set up, is all that is recorded against the shift. If it did not match, or arrived late, a "locker undetected" note is raised for a manager. If the camera could not read a colour at all, nothing is sent and the shift simply carries no camera evidence. The frame is deleted immediately, never leaves the phone, and is never saved to your photo library. We say a picture is taken because that is the accurate description, and it is always the front (selfie) camera.
• The compass sensor, at locker venues, where the phone lies on a magnetic holder. The app reads only the strength of the magnetic field around the handset — not a position, not a direction — and that strength cannot be turned into either. That is what proves the phone is docked, and that lifting it off has ended the shift. With the app open it is read on the phone only, and the only thing that leaves the phone is a yes/no "resting" answer. From app version 1.4.0 there is one exception, the dock check: while a locker shift of yours is running, about every half hour our server sends your phone a silent message, and the phone wakes for about a second and a half to take one reading of the magnetic field and send back one of three answers — on the pad, off the pad, or no reading — with that field-strength number. Nothing else is read then, not your location, and no answer, or missing answer, ever changes your hours or your pay.

Other things worth saying plainly

• A manager can put hours on your timesheet when the dock missed a shift, and can correct the start and finish times of a shift the dock did record. Hours added by hand are marked as entered by hand, never as a dock event, and every change goes into the audit record with the manager's name against it — the typed times, and for a corrected shift the times the dock recorded as well — and a notification on your phone tells you it happened.
• No phone signal when you dock? At a locker with no chip paired to it the shift records on the handset and syncs for a manager to approve. A chip tap with no signal is refused rather than recorded, and the manual clock-in request is the route there.
• Privacy and DPIA documentation is provided to support your workplace rollout.

This website

Separate from the app, and shorter. There is no analytics on this site, no advertising or tracking cookies, and nothing that follows you to another site.

• The demo, question and order form stores what you type — your name, company or venue, email, phone, number of sites, staff on payroll and any note, for a question the question itself (company and phone optional), and for an order the delivery address and the number of venues — so we can call you back, answer you by email or confirm your order. Your IP address is hashed rather than stored: enough to recognise one source flooding the form, not enough to identify anyone who fills it in once. Enquiries and order requests are deleted automatically after about two years; once an order is paid you're a customer, and your account is covered by the company privacy policy below.
• Cloudflare Turnstile runs the "are you a person" check on that form and sees your connection metadata as part of it. It is there because this form was flooded with roughly eighteen thousand fake submissions in forty minutes on 28 August 2026.
• The typeface is served from our own site. Loading these pages contacts nobody but us — apart from Cloudflare Turnstile, which the home page loads for the demo form's security check.
• We use these details to arrange your demo, to answer your question, or to confirm and post your order — and once an order is paid, your email to set up your ClockIn Dock account and your details to arrange training and onboarding. Nothing else. No newsletter, no list, no sharing, no sale.

Buying the NFC tap plan online. The basket on our home page sends us only the number of venues, any discount code and your two ticks. You give your details on Stripe's payment page, not on ours.

• Stripe takes the payment. On Stripe's page you give your name, email, phone, company or venue name, the delivery address for the chip, and your card or wallet details. Your card details go only to Stripe: ClockIn Dock never sees or stores your card number. The Stripe company we contract with is Stripe Payments Europe, Limited, in Ireland; Stripe Payments UK, Ltd., authorised by the Financial Conduct Authority, provides its regulated payment services in the UK. Stripe handles your payment for us, and also uses your details for its own purposes, such as preventing fraud and meeting its legal duties, under Stripe's privacy policy. That policy also covers Onelink (formerly Link), if you choose to save your details with Stripe, and says where Stripe sends data outside the UK, including the United States, and how it protects it.
• What we keep. Once your payment goes through, Stripe tells us your name, email, phone, company name and delivery address. We keep them with your order, together with the number of venues, the amounts, any discount code, when you pressed Pay with both boxes ticked, and Stripe's references for your customer record and your monthly plan. Your email and name also become your account's first sign-in and its contact details.
• Why. To take your first and monthly payments, set up your account, post each venue's NFC chip, help you get started, and keep our tax and accounting records. The basis is our legitimate interest in selling to and setting up the business you buy for (or the contract itself, if you buy as a sole trader), our legal duty to keep tax records, and our legitimate interest in keeping the checkout safe from abuse.
• How long. We keep your order while your account is open. If your account is closed and erased, your name, email, phone and address are removed from the order. The amounts, dates and Stripe references stay, because UK tax law requires us to keep accounting records for at least six years. Stripe keeps its own record of your payments under its privacy policy.
• Your IP address is not stored with your order or anywhere in our database. To stop abuse of the checkout, such as someone guessing discount codes, our server counts your requests in its memory, and the count starts again after an hour. As with every visit, the address is also recorded, with the page asked for, in our web server's security log.