Privacy policy

Last updated September 3, 2026

Kloqk is an employee time clock and HR platform for US businesses. This page says what we collect, why, who can see it, and what your choices are, in plain language. If anything here is unclear, write to [email protected] and a person will answer.

Two kinds of people use Kloqk

Business owners and managers create an account and enter information about their business and their team. Employees punch a clock and, if their employer invites them, sign in to see their own hours. For the employee records a business enters, that business is the owner of the data and decides what is collected; Kloqk stores and processes it on the business's behalf under our terms and, where one is signed, a data processing agreement.

What we collect

Account data

• Name, work email, mobile number, and a password (stored as a hash, never readable).
• Business name, address, industry, and payroll settings.
• Billing details for paid plans, handled by Stripe; card numbers never touch our servers.

Employee records entered by the employer

• Names, contact details, pay rates, worker classification, hire dates, and the documents an employer uploads or sends for signature. US wage law (the FLSA) requires employers to keep several of these fields.

Punch data

• The time and type of every punch: clock in, clock out, breaks, lunch.
• If the employer turns on photo verification, a webcam photo taken at the moment of the punch. Photos are stored privately and shown only to the employer's managers.
• For phone punches, a one-time location stamp captured at the moment of the punch. Nothing is recorded between punches or after clock-out; Kloqk is not a tracking app. A refused location permission still records the punch.

Usage data

• Standard analytics on our marketing site and app: pages visited, browser type, and events like signup, via Google Analytics and PostHog. We also keep our own first-party record of each visit to the website: the page you landed on, the site or campaign that sent you, your country and device type, the pages you viewed, and whether the visit led to a signup. It is stored on our servers, holds no IP address, and is used to understand where our customers come from. If we run ads, Meta or TikTok pixels may load on marketing pages only.
• Server logs and an audit trail of sensitive views and edits inside each workspace.

What we do with it

• Run the product: record punches, compute timesheets and overtime, produce exports.
• Send the emails the product needs: verification codes, invites, signature requests.
• Send SMS between an employer and their team when the employer turns that on.
• Bill paid plans and prevent abuse.
• Improve the product from aggregate usage.

We do not sell personal information, and we do not share it with anyone except the services below that we need to operate.

Who processes data for us

• DigitalOcean: US-hosted servers and private file storage.
• Stripe: payments for paid plans.
• Resend: transactional email.
• Twilio: SMS, when an employer enables it.
• Crisp: support chat, loaded only inside the signed-in dashboard.
• Google Analytics and PostHog: usage analytics.

Where it lives and how it is protected

Data is hosted in the United States, encrypted in transit and at rest, and separated per business: every record is scoped to the workspace it belongs to, enforced at the database layer. Kiosk PINs are stored as salted hashes. Uploaded documents and punch photos live in private storage and are served through short-lived signed links. Access to pay rates and identification documents is role-based and audit-logged.

How long we keep it

Time and payroll records exist to be kept: the FLSA expects timecards for two years and payroll records for three, so deactivating an employee preserves their history rather than deleting it. A business owner can export everything at any time and can ask us to delete their workspace outright, which removes it permanently after a short recovery window.

Your rights

You can ask us what we hold about you, ask for a copy, ask for corrections, or ask for deletion, and we will act on it without charging you or treating you differently. State privacy laws such as California's give many of these rights the force of law; we extend them to everyone. If you are an employee and the data was entered by your employer, we may need to route the request through them, since it is their employment record; we will tell you if so.

Cookies

The app uses cookies to keep you signed in and to remember your workspace. Two first-party cookies (kloqk_vid, one year; kloqk_sid, thirty minutes) tie the pages of a visit together for the record described above. Analytics cookies are described above. We do not use cookies to sell or broker data.

Children

Kloqk is a workplace tool and not directed at children. We do not knowingly collect data from anyone under 16 except as an employment record entered by an employer as the law allows.

Changes

When this policy changes in a way that matters, we will note it here with a new date and, for significant changes, tell account owners by email. Questions, requests, or complaints: [email protected]. See also our terms of service.