Punch O'Clock Get the app

Privacy policy

Last updated: September 5, 2026

Your privacy matters. Punch O'Clock is designed with privacy as a core principle. By default, all your data stays on your device. We offer an optional cloud sync feature that requires you to sign in with Apple or Google and explicitly enable sync in settings. You can disable cloud sync at any time, and your data will remain stored locally on your device.

1. Introduction

This privacy policy describes how Punch O'Clock (“we”, “our”, or “the app”) handles your information. Punch O'Clock is a time tracking application developed by Baan Software PTE. LTD. that helps you manage work sessions and projects. By using Punch O'Clock, you agree to the terms outlined in this policy.

2. Information we collect

2.1 Stored locally on your device

  • Project information. Names, hourly rates, currencies, billing rules, budgets, notes and other details of projects you create.
  • Work session data. Start times, end times, breaks, titles and notes for your work sessions.
  • Client records. The names, contact names, email addresses, phone numbers, postal addresses, tax or VAT identifiers, default rates and notes you enter for the clients you bill.
  • Your business profile. The company name, contact details, address, tax or VAT identifier, payment details, logo and invoice numbering you enter to appear on your own invoices.
  • Invoices and expenses. Invoice numbers, dates, lines, totals, tax and discount rates, status, and the expenses you record against a project — including a receipt image, which is kept as a file on your device.
  • App settings. Your preferences and configuration within the app.
  • Application state. What is needed to keep your app experience consistent between launches.

Client records and business profiles contain information about other people and organisations rather than about you. You choose what to put in them, and you remain responsible for having a lawful basis to hold it.

2.2 Synced to the cloud (optional)

If you choose to enable cloud sync by signing in with Apple or Google and enabling the sync toggle in settings, the following is synced to Firebase (Google Cloud Platform):

  • Project information. Project names, hourly rates, currency, notes, billing rules, budgets, creation dates and session status.
  • Work session data. Start times, end times, breaks, notes, titles and project associations.
  • Client records, invoices and expenses. The client, invoice and expense records described above. Receipt images are not synced: what is stored is a reference to a file on the device the expense was recorded on.
  • App settings. Your preferences and configuration, such as default period, theme mode, display preferences and your business profile.
  • User identifier. A unique user ID provided by Firebase Authentication from your Apple or Google account.
  • Sync metadata. Timestamps indicating when data was last synced.

Cloud sync is completely optional and disabled by default. Your data is only synced if you explicitly sign in and enable sync. You can disable it at any time, and your data will continue to be stored locally on your device.

2.3 Information we do not collect

  • Email addresses or other personal identification beyond what Apple or Google authentication provides.
  • Location data.
  • Device identifiers for tracking purposes.
  • Usage analytics or behavioural data.
  • Any information about your contacts or other apps.
  • Payment card numbers, bank credentials or any other payment instrument. The app takes no payments and processes none.

The payment details you type into your own business profile so they appear on an invoice — a bank account, a payment link, whatever you use — are content you entered, held like the rest of your data: on your device, and in your own synced copy only if you turned sync on. They are never read, used or shared by us.

3. How we use your information

Data collected by Punch O'Clock is used solely for:

  • Displaying your projects and work sessions.
  • Calculating work hours and earnings.
  • Generating session summaries and reports.
  • Building the invoices and exports you ask for, on your device.
  • Maintaining app functionality and your preferences.
  • Providing the core features of the time tracking application.
  • Cloud sync, when enabled: syncing your data across your devices through Firebase.

By default, all data remains on your device. Cloud sync only occurs when you explicitly enable it by signing in and turning on the sync toggle in settings.

4. Data storage and security

4.1 Local storage

All your data is stored locally on your device using the secure storage mechanisms provided by iOS and Android, protected by your device's built-in security features.

4.2 Optional cloud storage

If you enable cloud sync, your data is stored in Google Firebase (Cloud Firestore) in user-specific collections — users/{userId}/projects, users/{userId}/sessions and users/{userId}/settings. Data is isolated per account and can only be accessed by the authenticated user. Firebase encrypts data in transit and at rest, and access is protected by Firebase Authentication and Firestore security rules.

4.3 Security measures

  • Local storage: the platform's secure storage APIs, with your device's own encryption.
  • Cloud storage, when enabled: encrypted in transit and at rest by Firebase.
  • Authentication: cloud access requires Apple or Google sign-in.
  • Access control: each user's data is isolated to their own account.
  • Device security: your device's encryption and biometric locks protect your local data.

5. Data sharing and third parties

We do not sell or share your data with third parties for marketing or advertising purposes. Punch O'Clock contains no analytics services, no advertising networks, no social media integrations and no third-party tracking tools.

5.1 Third-party services

  • Firebase (Google Cloud Platform). Used for optional cloud sync when you enable it: Firebase Authentication for Apple and Google sign-in, and Cloud Firestore for your synced projects, sessions and settings. When sync is enabled, your data is subject to Google's privacy policy for Firebase services in addition to this one. Firebase acts as a data processor; we act as the data controller.
  • Flutter. The cross-platform framework the app is built with. It does not collect user data.

6. Authentication

Authentication is only required if you choose to enable cloud sync. Without it you can use the whole app signed out, with all your data stored locally.

  • Apple Sign-In. Apple provides a unique user identifier. We do not receive your email address or other personal information unless you explicitly choose to share it.
  • Google Sign-In. Google provides a unique user identifier and may provide a display name. We do not access your email address or other personal information beyond what is provided for authentication.

Your authentication credentials are managed by Apple or Google, not by Punch O'Clock.

7. Children's privacy

Punch O'Clock does not knowingly collect any information from children under the age of 13. The app is designed for working professionals and does not target children.

8. Your data rights

  • Access. You can view all your data within the app at any time, whether stored locally or synced.
  • Modification. You can edit or update your projects and sessions in the app; changes are saved locally and, if sync is enabled, synced.
  • Local deletion. Delete individual projects and sessions in the app, or uninstall the app to remove all local data.
  • Cloud deletion. Disable cloud sync to stop syncing new data, use Delete Account in Settings to remove your cloud data, or contact us to request deletion.
  • Export. Your sessions can be exported from the app as CSV or PDF at any time.

9. Data retention

Local data is retained on your device for as long as the app is installed. Uninstalling removes it according to your operating system's normal app removal process.

Cloud data, where sync is enabled, is retained in Firebase for as long as your account is active. You can remove it with Delete Account in Settings, or by contacting us.

10. International data transfers

If you have not enabled cloud sync, all your data remains on your device and no international transfer occurs. If you have enabled it, your data is stored in Google's Firebase infrastructure, which operates globally and may store data in data centres outside your country of residence, with the safeguards Firebase provides for international transfers.

11. Changes to this policy

We may update this policy to reflect changes in the app or in legal requirements. We will update the date at the top, and significant changes will be communicated in the app or in the store's update notes.

12. Legal compliance

This policy is designed to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Apple App Store and Google Play privacy requirements, and other applicable data protection laws. Where cloud sync is enabled, Baan Software PTE. LTD. acts as the data controller and Google (Firebase) as the data processor.

13. Permissions

  • Storage. To save your project and session data on your device, and to write the files you export.
  • Notifications (optional). To show a notification or Live Activity while a work session is running, and the timer and end-of-day reminders, if you enable them.
  • Photo library (optional). To attach a receipt image to an expense, and to save an exported file where you choose. Only the image you pick is read.

All permissions are used solely for app functionality, never for data collection or tracking.

14. Contact us

Questions, concerns or requests about this policy or how the app handles your information: email punch.oclock@baansoftware.com, or use Contact Developer in the app's Settings screen. We will respond within a reasonable timeframe.

15. California privacy rights

  • Right to know. What we collect, use and share is set out in section 2.
  • Right to delete. Delete local data in the app or by uninstalling; delete cloud data with Delete Account, or by contacting us.
  • Right to opt out. Cloud sync is optional and off by default, and can be disabled at any time.
  • Non-discrimination. We will not discriminate against you for exercising your privacy rights.

We do not sell your personal information.

16. European Union users (GDPR)

  • Legal basis. Consent, and performance of our agreement to provide the app. Cloud sync requires your explicit consent through sign-in and the sync toggle.
  • Data controller. Baan Software PTE. LTD..
  • Data processor. Google (Firebase), when cloud sync is enabled.
  • Access, rectification and portability. All your data is visible and editable in the app, and exportable as CSV or PDF.
  • Erasure. Uninstall or delete in the app for local data; Delete Account, or a request to us, for cloud data.
  • Withdrawing consent. Disable cloud sync at any time in settings.

17. Consent

By using Punch O'Clock you consent to this privacy policy. If you do not agree with it, please do not use the app.

How to delete your account

The previous policy, from before cloud sync

This website

This site runs no analytics script, sets no cookies and makes no third-party requests. The web server records the ordinary access log every web server records, and nothing is shared with anyone.