Privacy policy
Last updated 18 October 2026
PunchClock is a personal time-tracking app made by Ali Al-Timimi (Belgium), who is responsible for your data. This page explains what the app collects, why, and what you can do about it. Questions: support@aa-it.org.
What we collect
- Your email address, to sign you in with a one-time code.
- The time you record: your sessions (start and end times), breaks and notes, and a log of the changes you make to them.
- Technical request data that our providers log to run and protect the service, such as your IP address and the time of a request.
That's all. The app doesn't ask for your name, location, contacts or photos. There are no ads, no analytics and no tracking, and your data is never sold or used for marketing.
On your phone
The app keeps your sign-in session, a copy of your recent hours (so it works offline), clock actions that haven't synced yet, and your settings (theme and week start). Signing out removes the session and any unsynced actions; deleting your account removes all of it.
Why we use it
To provide the app you signed up for: signing you in, storing your hours and showing them to you (performance of a contract). The technical logs are kept to keep the service secure and working (legitimate interest).
Who processes it for us
- Supabase: the database and sign-in. Your data is stored in the EU (Ireland).
- Cloudflare: hosts this website. When you visit these pages, Cloudflare sees your IP address and technical request data.
- Resend: sends the email with your sign-in code (EU region).
- Expo (EAS Update): delivers app updates. When the app checks for an update, Expo receives technical data such as your IP address, the app version, your phone's platform and a random installation ID that the app creates for update delivery; it doesn't receive your email or your hours.
These providers process data only on our instructions. Where a provider is based outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard. Apple and Google deliver the app under their own privacy policies.
How long we keep it
As long as you have an account. When you delete your account, your email address and all your time entries are deleted at once and permanently, together with the sign-in records we hold for you (which include your IP address). We keep nothing of it. Our providers' own short-lived technical logs (for example web access logs) and backups expire on their own schedules, usually within days.
Your rights
You can ask for a copy of your data, have it corrected or deleted, take it elsewhere, or object to how it is used: email support@aa-it.org. You can delete everything yourself in the app (Settings → Delete account), or see how to delete your account without the app. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).
Children
PunchClock isn't meant for children under 16.
Changes
If this policy changes, we update this page and the date at the top.