Privacy Policy

1. Who we are

TimeTrack (“the app”, “we”) is a workforce management platform operated by Smart Patel Tech Solutions and made available at time-track.tech and via the TimeTrack iOS and Android applications. Employers (“company administrators”) use TimeTrack to record employee attendance, schedule shifts and produce payroll reports. This policy explains what personal information is processed, why, and the rights of the people whose data it holds. It is written to comply with the Protection of Personal Information Act (POPIA, South Africa) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Information we process

• Identity & employment records: name, work email address, role, employee number, position, branch, department, manager, hire date, contact number and hourly pay rate (used for attendance-cost reporting).
• Attendance & location data: clock-in/clock-out timestamps, break minutes, shift schedules, and device location used to verify presence within an assigned workplace geofence. Location is processed to record and validate attendance (including automatic clock-in/out) — it is not used to track employees continuously outside attendance events at assigned work locations.
• Device & notification data: push-notification tokens and basic device details so the app can confirm automatic punches and send shift reminders.
• Authentication data: email and a bcrypt-hashed password (never stored in plain text), session tokens, and password-reset metadata.
• Audit & security logs: records of administrative actions (who changed what, when) including IP addresses. IP addresses are redacted for non-administrative viewers. Audit logs are append-only and are never silently purged.

3. Why we process it (purposes & legal grounds)

• Employment contract / your employer's legitimate interest: recording attendance, scheduling, payroll and overtime computation, and attendance cost reporting.
• Consent (withdrawable at any time): precise and background location for automatic geofence clock-in/out, and push notifications. Permissions are requested in-app and can be revoked in your device settings; the app remains usable with manual clock-in/out.
• Legal obligation & security: audit trails, tenant isolation and abuse prevention.

4. Location permissions in the mobile app

On iOS and Android, TimeTrack may request “While Using” and “Always” location access. “Always” access enables automatic clock-in when you arrive at an assigned work location and clock-out when you leave, even when the app is closed or the device is locked. Location checks are limited to the geofence perimeters your employer assigns to you. Location data is transmitted to the TimeTrack server over TLS to create attendance records and is not sold, rented or used for advertising.

On Android, a prominent in-app disclosure is shown and your affirmative consent is requested before any location permission is requested and before any background location access begins. While background monitoring is active, Android displays a persistent “Monitoring work location” notification together with the system background-location indicator. Location fixes are used only to detect arrival at and departure from your assigned work locations; TimeTrack does not keep or share a history of your movements, and only the confirmed clock-in/clock-out events (place and time) are retained as attendance records. You can stop background location access at any time by turning off Auto Clock In/Out in TimeTrack, signing out, or revoking the location permission in your device settings — manual Clock In / Clock Out then remains fully available.

5. Who we share data with

We do not sell personal information. Data is shared only with: (a) your employer's TimeTrack administrators and managers, within their assigned branch/department scope; (b) service providers that host and operate the platform — Railway (application hosting and PostgreSQL database), Expo (push notification delivery), and Apple/Google (push transport) — each processing data solely to provide these services; and (c) authorities where legally compelled. Some processors operate infrastructure outside South Africa; transfers are limited to what is necessary to provide the service and are protected by applicable data-transfer safeguards.

6. Retention

Attendance and employment records are retained for the period configured by your employer's retention policy in TimeTrack, and as required by applicable labour and tax law. Security audit logs are retained on an append-only basis (with optional archival after long retention periods). When an employee account is terminated or deleted, identity records are removed or anonymised while historical attendance records required for payroll and legal purposes are retained for the configured period.

7. Security

We enforce HTTPS/TLS with HSTS, a strict Content-Security-Policy, hashed passwords, httpOnly session cookies with revocation on password change, CSRF and rate-limiting protections, role-based access control, and PostgreSQL row-level security with least-privilege database roles so each company's data is isolated from every other tenant. Weekly encrypted backups and restore drills are performed.

8. Your rights

Under POPIA (and the GDPR where applicable) you may request access to, correction of, or deletion of your personal information; object to or restrict certain processing; withdraw location/notification consent at any time via device settings; and lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority. Employees should ordinarily address attendance-record corrections to their company administrator first, who can amend records in-app (every amendment is audited).

9. Children

TimeTrack is a workforce tool and is not directed at children. We do not knowingly process personal information of children.

10. Changes & contact

We may update this policy; the “last updated” date above always reflects the current version. Questions about this policy or privacy requests can be sent to the app support and data-protection contact: ricardovsmart@gmail.com. See also our Support page.