Privacy Policy
This Privacy Policy explains what information Clock In Business (the "App") collects, why we collect it, and the choices you have. We keep the app focused on doing one job — tracking work time — and we collect only the data that job requires.
1. Who we are
Clock In Business is operated by Derou Biglari ("we", "us"), the data controller for the personal data described below.
Contact for privacy questions: derou@me.com.
2. What we collect
| Category | Data | Why |
|---|---|---|
| Employer account | Full name, company name, company phone number, email address, password (hashed by Firebase Authentication) | Create and secure your employer account |
| Employee account | Full name (entered by the employer), 8-character sign-in code | Sign employees in without requiring an email address or password |
| Work data | Clock-in and clock-out timestamps, hourly pay rate, weekly schedule, workday date, time-edit requests and reasons | Core functionality — recording hours and pay |
| Messages | Text messages exchanged between an employer and an employee, plus sender identity and send timestamp | In-app messaging feature |
| Device identifiers | Firebase Cloud Messaging (FCM) push token | Deliver reminder, request, and message notifications to your device |
| Abuse prevention | IP address, briefly, during unauthenticated sign-in-with-code attempts | Rate-limit brute-force attempts on employee sign-in codes. Not stored long-term and not linked to a user profile. |
| App preferences (device-local) | Chosen appearance mode (light, dark, or system) | Remember your appearance choice. Stored only on your device; never transmitted. |
| Advertising | Advertising identifier (Apple IDFA on iOS if you allow tracking; Android Advertising ID), approximate location derived from IP, device model and OS, ad-interaction events (which ads were shown or tapped) | Serve banner ads on the Clock, Reports, and My Report screens through Google AdMob. See Section 4 for details and your choices. |
3. What we do not collect
- No precise location data. The App does not request location permission on either Android or iOS. (Approximate location is derived by our ad partner from your IP address — see Section 4.)
- No camera or photo-library access.
- No contacts, calendar, health, or biometric data.
- No third-party analytics or crash-reporting SDKs. The only third- party SDK that collects data about you is Google AdMob, described in Section 4.
4. Advertising
The App shows banner ads on the Clock, Reports, and My Report screens, served through Google AdMob. When an ad loads, Google may collect and process the following about your device and your interaction with the ad:
- Approximate location, derived from your IP address
- Device information (model, operating system, language, screen size)
- Ad and app interaction events (which ads were shown or tapped)
- Advertising identifier — Apple's IDFA on iOS if you allow tracking, or Android's Advertising ID
- IP address
Google's use of this data is governed by the Google Privacy Policy and How Google uses information from sites or apps that use our services.
Your ad-personalization choices
- European Economic Area, United Kingdom, Switzerland: on first launch you will see a consent form asking whether Google may use your data for personalized ads. You can change your answer later from within the App.
- iOS: the first time you reach a screen that shows ads, you will see a brief explanation followed by Apple's system prompt asking whether apps may track you. Choosing Ask App Not to Track causes ads to be non-personalized only. You can change your answer any time in Settings → Privacy & Security → Tracking.
- Android: you can reset or delete your Advertising ID from Settings → Google → Ads.
- Everywhere: declining personalized ads does not remove ads — ads are still shown, they are just chosen based on general context (screen, country, language) rather than your interests.
We do not sell your personal data. We do not share your personal data with advertisers or data brokers other than Google AdMob for the ad-serving purpose described here.
5. Legal basis (GDPR / UK GDPR users)
- Performance of a contract — for account data, work data, and messages, which are necessary to provide the service you asked for.
- Legitimate interests — for short-term IP logging used to prevent abuse of the sign-in flow.
- Consent — for push notifications on iOS and Android 13+, and for personalized advertising (through the on-device consent form described in Section 4). Both are opt-in.
6. How we store data
Data is stored on Google Firebase services (Cloud Firestore, Firebase Authentication, Cloud Functions, Firebase Cloud Messaging), operated by Google LLC. Google acts as our data processor. All traffic between your device and our backend is encrypted in transit using HTTPS/TLS.
Data is stored in Google's us-central1 region.
7. How we share data
- Within your company: your employer can see your name, schedule, punches, pay rate, edit requests, and messages you send them. Employees can see their own data and messages exchanged with the employer.
- With processors: Google (Firebase infrastructure) processes data on our behalf under Google's Data Processing Addendum.
- With Google AdMob: when an ad loads, the device and ad-interaction data listed in Section 4 is shared with Google AdMob for the purpose of serving and measuring ads. AdMob is a joint controller for that specific data, not a processor.
- We do not sell your data. We do not share your work data, messages, or account information with advertisers or data brokers.
- Legal disclosure: we may disclose data if required by law, valid legal process, or to protect rights and safety.
8. Data retention
- Employer accounts and all associated company data (employees, schedules, punches, requests, messages) are retained until the employer requests deletion.
- Deactivated employee records are retained as part of the company's payroll history until the employer deletes them.
- Rate-limit counters are automatically discarded after their time window (hours, not days).
9. Your rights
Subject to your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email derou@me.com. Employees may also ask their employer to update or remove data held in the company account.
We will respond within 30 days. To request full deletion of your account and associated data, see the Delete Your Account & Data page.
10. Children
The App is intended for use by adults in an employment context. It is not directed at children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children.
11. International transfers
Because our processor and our ad partner are both Google LLC, personal data may be transferred to and processed in the United States and other countries where Google operates infrastructure. Google's Standard Contractual Clauses apply where required.
12. Changes to this policy
We will update this page when the policy changes and revise the "Last updated" date at the top. Material changes will also be surfaced in the App.
13. Contact
Derou Biglari
Email:
derou@me.com