Punchjar is a time clock and work hours tracker for hourly workers, made by RandomFuse LLC ("we", "us"). This policy explains what Punchjar collects, why, and the choices you have. It covers the Punchjar apps for iPhone, iPad and Android, and our account-deletion page.
The short version
- Punchjar works with no account. Your shifts, jobs, pay and notes stay on your device unless you sign in.
- No ads, no advertising ID, no tracking across apps or websites. We don't sell your data or share it for advertising.
- Signing in is optional. If you sign in, we store your email address (and, if you sign in with Google, the name on your Google profile) and the hours, pay and notes you sync, so that we can back them up and show them on your other devices.
- A few usage events and crash reports. We collect usage events (for example "the timesheet was opened") and crash reports so we can keep Punchjar working. They never include your job names, hours, pay, notes or name. You can turn them off in Settings.
- Schedule photos stay on your device. When you add shifts from a photo, Punchjar reads it on your device and doesn't keep it.
- Your data stays yours. You can export your hours as a PDF or a spreadsheet, for free, and delete your account and its data from inside the app or at randomfuse.com/punchjar/delete-account.
1. If you don't sign in
Everything you create stays on your device: your jobs, pay rates and pay rules, shifts and breaks, scheduled shifts, time off and balances, shift templates, notes, tips and mileage, take-home tax and deduction lines, your name for timesheets, and each shift's history. Even so, these things leave your device:
Usage events. These are short, fixed messages about how the app is used. The complete list:
- the app was opened for the first time (
first_open); - the first clock-in, or the first shifts added from a photo (
first_answer,first_clock_in); - the welcome screen was shown and finished (
onboarding_step,onboarding_done); - the timesheet was opened (
timesheet_viewed); - a PDF timesheet was shared or printed, with its number of pages and jobs as a range (for example "2-5"), and whether it included pay and small print (
pdf_exported); - a spreadsheet was exported, with its number of rows as a range (
csv_exported); - a spreadsheet was imported, with the number of rows added and skipped as ranges (
csv_imported); - shifts were added from a schedule photo, with how many were found, added, changed and flagged, as ranges (
schedule_photo_import; never the photo, its text, names or times); - a button on the running shift's Lock Screen view or notification was tapped: Break, End break or Clock out (
live_activity_action); - the Pro screen was shown, and from where (
paywall_view: "upgrade", "change plan", "add job", "PDF timesheet", "daily overtime", "time off", "take home", "advanced pay rules", "live sync", "themes", "tax lines" or "photo import"); - Pro was bought, which plan, and from where (
purchase); - the app is still in use after 7 or 30 days (
retention_ping); - the store's rating prompt was requested (
review_prompt_shown).
Each event carries:
- the time;
- the app version, build and platform (iOS or Android);
- a random ID created on your device when you install Punchjar.
That ID isn't linked to your account, your name or your email. Events never contain anything you typed, a job name, a time, a rate or an amount, and counts are only ever sent as ranges. We store them on our own server (see section 5) and use them only to understand, in aggregate, whether Punchjar works for people: for example, how many people clock in for the first time, or open the Pro screen.
Crash reports. When Punchjar crashes or hits an error, it sends a report to Sentry, our crash-reporting service. A report contains:
- the kind of error and where in the app it happened (never the error's message);
- the device model and operating-system version;
- the app version;
- the app's state at the time, such as memory use.
Before a report leaves your device, Punchjar removes email addresses, phone numbers, IP and street addresses, coordinates, access tokens and web-address parameters. It also drops device names and user details. Sentry is set not to store IP addresses or locations. Sentry also counts app sessions, using its own random ID, so that we can measure how often the app crashes. Crash reports aren't linked to you.
Purchases. If you buy Punchjar Pro or tap Restore purchases:
- Apple or Google handle the payment. We never see your card or payment details.
- RevenueCat (our purchase service) receives the store receipt and records that you have Pro, under a random customer ID.
- On iPhone and iPad, RevenueCat's software also sends Apple's "identifier for vendor", a device ID that is the same for all apps from one developer and is never used for advertising.
- Our server keeps a copy of whether you have Pro, so that it works on your other devices.
Google's own diagnostics on Android. Two Google components in Punchjar send Google their own diagnostics. Google collects them, and Punchjar can't see or change them:
- On Android, Google Play's billing library, which handles purchases, sends Google its own diagnostics (device and app version, how its calls went) each time the app starts. Punchjar can't turn this off.
- On Android, reading a schedule photo uses Google's ML Kit on your phone. The photo and its text never leave your phone, but ML Kit sends Google its own diagnostics (device model, app version, how long the read took and a random per-install id). Punchjar can't turn this off.
ML Kit starts only when you read a schedule photo. Google describes what ML Kit sends in its ML Kit data disclosure. On iPhone and iPad, Punchjar reads photos with Apple's own text recognition, which runs on the device and sends nothing.
Switching events and crash reports off. Go to Settings → Account and data → Share usage data and crash reports. It's on when you install Punchjar, and you can turn it off at any time:
- Usage events stop at once, and any events not yet sent are deleted from your device.
- Crash reports stop at once.
If you turn it back on, usage events resume straight away and crash reports from the next time you open Punchjar. The switch doesn't affect sign-in or sync, which only happen if you sign in (section 2), and it can't stop Google's own diagnostics above.
2. If you sign in
Signing in is optional. It lets Punchjar back up your hours and keep them in step across your devices. When you sign in, we also collect:
- Your email address, to sign you in: with a one-time code we send you, or through Sign in with Apple or Google. If you use Sign in with Apple, we receive the email address Apple shares with us (which may be a private relay address), never your name. If you use Google, we receive your email address and the name on your Google profile.
- An account ID, created by our sign-in service. Once you sign in, RevenueCat uses the same ID, so that Pro follows your account.
- Your synced data:
- your jobs (name, color, currency, week start, rounding, pay period, overtime and other pay rules, leave allowances);
- your pay: hourly rates and the dates they start, tips, flat amounts, mileage, and your take-home % and tax and deduction lines;
- your shifts (start and end, the time zone at each end, worked or scheduled, notes) and breaks;
- your time off (date, length, and whether it's vacation, sick, holiday, unpaid or other);
- your shift templates;
- your name as it prints on your timesheets;
- each shift's history: what changed, when, and the random ID of the device it was changed on;
- which of your devices syncs live: its random ID and the kind of device (such as "iPhone" or "Android tablet"), so that a free account syncs on one device at a time.
We use this only to provide the service you asked for: sign-in, backup and sync between your devices. We don't look at your hours or pay, and we never share them with other users or your employer. Punchjar has no sharing between users at all.
3. What stays on your device only
- Reminders and notifications. These are scheduled on your device; we don't use push notifications.
- Widgets, the Lock Screen and the running-shift notification. They show your shift (the job's name, the time on the clock, when you'll be done) from data on your device; nothing is sent to show them. Anyone who can see your screen can see them. On iPhone and iPad, if you turn off Lock Screen Widgets and Live Activities under Settings → Face ID & Passcode → Allow Access When Locked, the locked screen hides the job's name. Remove a widget or turn the notification off in your device's settings at any time.
- Exports. PDF timesheets and spreadsheets are made on your device and handed to your device's share sheet, printer or a folder you pick. Where they go is up to you.
- Imports. A spreadsheet you import is read on your device.
- Settings: clock format, week start, how hours and money read, theme and app icon.
Schedule photos. When you add shifts from a photo, you either pick one photo (Punchjar only receives that photo, never your library) or take one: on iPhone and iPad, the first time, your device asks whether Punchjar may use the camera; on Android, Punchjar opens your camera app and asks for no camera permission. Punchjar reads the photo on your device and shows you the shifts it found; nothing is saved until you add them, and then only the shifts are kept, like shifts you typed. Punchjar reads only the picture: it never reads a photo's location, and the photo is deleted from the app as soon as it's read. The photo and its text are never stored, logged or sent to us.
Punchjar doesn't ask for access to your location, contacts, microphone or photo library. It asks for notifications only when you turn a reminder on.
4. Support emails
When you tap Contact support, Punchjar opens your own email app with a message to support@randomfuse.com. If you switch on "Include diagnostics", the message also includes:
- your app version and device type;
- up to 30 recent lines from Punchjar's own log, with personal details removed.
You see the diagnostics before you send. We use what you send only to answer you, and we keep support emails for 24 months after the conversation ends.
5. Who processes your data for us
We use these service providers. They process data only on our instructions, to run Punchjar:
| Provider | What for | Data |
|---|---|---|
| Supabase | Sign-in, our database, and receiving usage events | Email, account ID, synced data, usage events, the Pro record |
| PowerSync | Keeping your data in step between your devices | Synced data |
| RevenueCat | In-app purchases | Purchase records, the RevenueCat customer ID; on Apple devices, the identifier for vendor |
| Sentry | Crash reports | Crash reports (scrubbed, as above) |
| Amazon Web Services (Amazon SES) | Sending sign-in and deletion codes by email | Your email address and the code |
| Apple, Google | App distribution and payments | Under their own privacy policies |
On Android, Google also receives its own diagnostics from Google Play's billing library and ML Kit, as section 1 explains, under Google's privacy policy.
Our servers and these providers are in the United States. If you live outside the US, your data is transferred to and processed in the US. Where the law requires it, these transfers rely on our providers' Standard Contractual Clauses (and, for the UK, the UK addendum to them).
Like any internet service, our providers see your device's IP address when Punchjar connects, and they keep it in server logs for security and troubleshooting, for up to 90 days. We don't use IP addresses to locate or identify you.
6. How long we keep data
| Data | How long |
|---|---|
| Data on your device | Until you delete it or the app. Deleted shifts can be restored for 30 days |
| Synced jobs, pay, shifts, time off, templates and history | Until you delete them or your account. Items you delete are removed from our servers 30 days later, so your other devices can catch up |
| Your account (email, account ID, Pro record) | Until you delete your account |
| The app stores' notices about your purchases (sent to us by RevenueCat) | Until you delete your account, or 24 months after we receive them, whichever comes first |
| Usage events | 24 months from when our server receives them, then deleted automatically |
| Crash reports | Up to 90 days |
| Backups made by our database provider | 7 days (daily backups are kept for 7 days), after which deleted data is gone from them too |
| Deletion receipt (see section 7) | 24 months |
7. Deleting your account
You can delete your account in two ways:
- in the app: Settings → Account → Delete account;
- on the web: randomfuse.com/punchjar/delete-account. We email you a code to confirm it's you.
What we delete:
- your account: your email address and sign-in methods;
- everything synced to it: jobs, pay rules and rates, shifts and breaks (worked and scheduled), shift templates, time off, your name for timesheets, each shift's history, and which device syncs live;
- the record that links your purchases to the account, at RevenueCat and on our server;
- Sign in with Apple's permission for Punchjar, if you used it (we revoke it).
Deleting in the app also removes that account's data from the device you're using.
What we keep:
- A deletion receipt for 24 months, as proof that we deleted your account. It holds a one-way hash of your account ID (it can't be turned back into your ID or email), the time, and which steps finished. After 24 months it is deleted too.
- Purchase records that Apple and Google keep under their own policies. Deleting your account doesn't cancel a subscription or refund a purchase: cancel a subscription in your App Store or Google Play settings.
- Data on your other devices. Deleting the account doesn't remove Punchjar's data from your other phones or tablets. Delete the app there to remove it.
If you bought Pro without ever signing in, the purchase record at RevenueCat isn't tied to an account. Write to us and we'll delete it.
8. Your choices and rights
- Export. Settings → Export my data gives you a PDF timesheet or a spreadsheet (CSV) of every shift, for any dates and jobs. It's free, always.
- Import. "Import from a spreadsheet" adds shifts from a CSV file. It adds what's missing and skips shifts already there.
- Delete a shift, job, time off or template at any time, or your whole account (section 7).
- Sign out and choose whether to keep a copy of your data on the device.
- Notifications can be turned off in Punchjar's settings or your device's settings.
- Usage events and crash reports: turn them off with Settings → Account and data → Share usage data and crash reports (section 1).
Depending on where you live, you may have the right to access, correct, delete or move your data, or to object to or restrict how we use it. To use any of these rights, write to support@randomfuse.com. We reply within one month (within 45 days for requests under California law). You can also complain to your data-protection authority.
Why we may use your data (legal bases). Where laws such as the EU and UK GDPR ask for a legal basis:
- sign-in, backup and sync: to provide the service you asked for (our contract with you);
- usage events and crash reports: our legitimate interest in keeping Punchjar working and improving it (you can turn them off at any time, section 1);
- anything the app asks your permission for (such as the camera or notifications): your consent, which you can withdraw in Punchjar's or your device's settings.
California. We don't sell or share personal information, as the CCPA/CPRA defines those terms, and we don't use it for targeted advertising.
9. Children
Punchjar isn't directed at children under 13, or the minimum age where you live (16 in some EU countries), and we don't knowingly collect personal information from them. If you think a child has given us personal information, write to us and we'll delete it.
10. Security
- All data travels encrypted (HTTPS/TLS).
- On your device, Punchjar's database is encrypted, with its key in the system's secure storage.
- On our servers, each account can reach only its own data.
No system is perfectly secure. If we learn of a breach that affects you, we'll tell you as the law requires.
11. Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll also say so in the app before it takes effect.
12. Contact
RandomFuse LLC, Hollywood, Florida, USA
Email: support@randomfuse.com