BYOD Time Clock Policy: What to Write and What to Avoid

A BYOD time clock policy is a short written rule set that lets hourly employees clock in and out from their own phones or tablets, and spells out how those punches are made, checked, corrected and paid. If you run a small business, the policy does three jobs: it keeps your hours records accurate, it limits what you can see on a personal device, and it makes clear who pays for what. Below is how to write one, in plain language, with the federal wage-and-hour rules that sit behind it.

TL;DR

• A BYOD time clock policy covers how employees punch from personal devices, how breaks and missed punches are handled, and what the company can and cannot see on the phone.
• Under the FLSA, work that you allow or permit is compensable even if it was never recorded, so the policy must tell nonexempt staff not to work off the clock.
• Reimbursement matters: payments for personal device use must reasonably approximate actual costs, and some states add their own rules.
• Collect only what you need for timekeeping (punch time, and location only if you disclose it), and keep time records for the required period.
• Offer a shared kiosk or company device for anyone without a suitable phone, so no one is forced to buy one.

Table of Contents

• What a BYOD time clock policy is
• The legal ground your policy stands on
• What to put in the policy
• What if someone has no suitable phone?
• Exempt employees and the policy
• Perspective: keep the policy smaller than the technology
• Rolling the policy out
• Where Kloqk fits
• FAQ
• Sources

What a BYOD time clock policy is

BYOD means “bring your own device.” In a general sense it lets employees use personal devices for work, and employment lawyers point to familiarity for employees, lower hardware and maintenance costs, and flexibility for remote or hybrid work as the usual upsides. A BYOD time clock policy narrows that idea to one task: recording when hourly people start and stop work.

Most small businesses reach this point for practical reasons:

• A restaurant does not want a wall-mounted clock that three people queue at during a shift change.
• A construction crew starts at different job sites, miles from any office.
• A clinic or salon has staff who rotate between locations.
• A retail owner would rather not buy and maintain proprietary hardware for a team of eight.

In each case the phone in the employee’s pocket is already the most convenient clock. The risk is that without rules, the phone also becomes a way for work to creep into unrecorded time, and for the employer to collect more personal data than it needs.

If you are not sure whether staff need to install anything, our guide on whether employees need an app to clock in covers the options.

The legal ground your policy stands on

A policy cannot change what the law requires. Three federal points shape almost every clause.

You must keep accurate hours for nonexempt staff

The Fair Labor Standards Act requires employers to keep records of nonexempt employees’ hours and to pay overtime at not less than 1.5 times the regular rate for hours beyond 40 in a workweek, and more protective state or city standards apply where they exist. A phone punch is just a way of creating that record. The record itself is what matters.

Unrecorded work still counts

This is the clause that BYOD changes most. According to the Department of Labor, work an employer allows or permits is compensable even when it is not recorded, whether the employee volunteered or the work was requested. If a server answers a scheduling text at 10 p.m. or a crew lead checks a supplier’s email on a Sunday, that time may be hours worked.

There is a narrow exception. The DOL notes that infrequent, insignificant bits of time may be disregarded as de minimis when they cannot practically be recorded precisely, but identifiable work time that can be ascertained must be counted. A habit of a few minutes every evening on a work app is not something to bet on.

Records have a retention period

The DOL says employers must preserve payroll records for at least three years, and keep wage calculation records such as time cards and work schedules for two years. State rules can be longer. Our articles on timesheet retention by U.S. schedule and on FLSA retention requirements walk through what to keep and for how long.

What to put in the policy

Keep it to one or two pages. Employees will read a short document and ignore a long one. These are the sections that earn their place.

1. Purpose and scope

Say who it applies to (hourly, nonexempt staff, and anyone else you ask to clock) and that using a personal device is voluntary where a shared option exists. Name the approved time clock app or web punch page so there is no confusion about which tool counts.

2. Clock-in and clock-out rules

Be specific about what must be punched. Public-sector handbooks are a useful model of plain wording: one county’s policy requires employees to punch in and out for workday start and end times and unpaid meal breaks. Do the same for your shop:

• Punch in when you are ready to work at your station or site, not when you pull into the lot (unless you require travel or pre-shift tasks).
• Punch out for unpaid meal breaks and back in when the break ends.
• Punch out at the end of the shift before you leave, not on the drive home.

If your state requires meal or rest breaks, state the rule and let the system record it. Our overtime and break rules by state page explains how automatic calculations handle this.

3. Personal accounts only

Each person punches with their own login. One university timekeeping procedure treats using another user’s credentials to access its systems as fraudulent. You do not need legal drama, but you do need a plain line: no punching for a coworker, ever, and discipline follows for “buddy punching.” Photo verification helps enforce this, and we cover the rules in our photo clock-in policy guide.

4. Missed punches and corrections

Phones die, apps crash, people forget. Decide the process now:

1. The employee reports the missed punch to a named manager by the end of the next shift.
2. The manager enters or approves a correction with a short reason.
3. The original punch and the edit both stay in the record, so the audit trail is intact.
4. The employee can see the corrected time before payroll closes.

Never let a correction quietly reduce hours without the employee knowing. If connectivity is the issue on remote sites, see how offline time clock mode lets managers verify punches before they post.

5. Rounding

If you round, say so. The DOL permits recording time to the nearest 5, 10 or 15 minutes, as long as the practice averages out so employees are fully paid for all time actually worked. If your rounding consistently favors the company, it is a problem, not a policy. The simplest approach for a small team is to pay to the minute.

6. Work outside scheduled hours

Tell nonexempt employees that they should not do work, including checking work messages, on their own device off the clock unless you have approved it, and that anything approved must be punched or reported. Pair this with a manager habit: do not text hourly staff after shifts about non-urgent things. A policy that forbids off-the-clock work while managers expect instant replies will not hold up.

7. Reimbursement

This is where BYOD gets expensive for the unprepared. The DOL’s 2024 opinion letter explains that payments excluded from the regular rate must be reasonable reimbursement of expenses employees actually incur for the employer’s benefit, and that such payments should reasonably approximate actual costs. A stipend that is far above or below real costs can raise questions about overtime calculations.

Some states also have their own expense reimbursement statutes, and they can apply to a phone or data plan used for work. Check your state labor department’s guidance before you set a flat number. Basic punching uses very little data, so many employers pair a modest stipend with a free alternative, such as a kiosk, for anyone who prefers not to use a personal phone.

8. Privacy and monitoring limits

This section protects you as much as employees. Say exactly what the app collects: punch times, break times, and, if you use it, a photo at punch and the phone’s location at the moment of punching. Also say what it does not collect: texts, photos, contacts, browsing, or location outside a punch. Sheppard Mullin’s guidance makes a point worth repeating: a work app does not authorize continuous surveillance of an employee’s personal device.

Biometric or photo features may trigger state laws, so read our summary of time tracking privacy laws before turning them on, and give written notice.

9. Device security

Keep requirements light. A screen lock, a current operating system, and a rule to report a lost phone the same day cover most small businesses. Do not ask staff to install management software that controls the whole phone just to clock in. A browser-based or single-purpose app that works with a login is enough. If you are weighing a custom-built app instead of an off-the-shelf one, plan the mobile app cost and the permissions it will request before you commit, because every permission is something you must justify to employees.

10. Separation and data deletion

When someone leaves, they should sign out of the app and you should deactivate the account. Sheppard Mullin’s guidance lists deletion of work data upon separation as part of an employee-facing policy. For timekeeping, that means removing app access while keeping the time records you are required to retain.

What if someone has no suitable phone?

A BYOD policy should never be a requirement to own a smartphone. Maryland’s official telework guidance notes that employers can allow personal technology, provide the necessary devices, or pay a technology stipend, and should communicate device expectations clearly. For a small business, that translates into three practical choices:

Most teams end up mixing these. Drivers and crew leads punch on their phones, counter staff use the kiosk. The policy should say the choice is available and who to ask.

Exempt employees and the policy

Salaried exempt employees usually do not punch, but nothing forces you to exclude them. The DOL has said the FLSA does not prohibit an employer from tracking working time, even for exempt employees. Some businesses track them for project costing or to catch misclassification risk. If you do, say so in the policy and apply the same privacy limits. More detail is in our piece on whether exempt employees need to track hours.

Perspective: keep the policy smaller than the technology

We build time clock software for hourly teams, and the pattern we see is consistent: owners overbuild the policy because the technology can do so much. GPS, photos, geofences, alerts. Then they write a ten-page document nobody reads and collect data they have no use for.

Our view is simple. Start with the question “what do I need to prove about hours worked?” The answer is usually who worked, when they started and stopped, what breaks they took, and who approved any change. Everything else is optional, and each optional feature should have a reason you can say out loud to an employee. If you use GPS at punch, tell people. If you use photos, tell people and say who can see them. If you cannot explain why you collect something in one sentence, do not collect it.

We also think the free tier of any time clock should be enough to run a compliant operation. Overtime math, break tracking and payroll-ready exports are not luxuries, so they should not be what you pay extra for.

Saad

Rolling the policy out

A policy only works if people know it exists. A simple rollout for a team of five to fifty:

1. Draft it from the sections above and have your state’s labor guidance or an employment attorney check the reimbursement and privacy parts.
2. Pick the tool and test it on a few staff for a pay period before everyone switches.
3. Hold a ten-minute huddle, show how to punch, how to flag a missed punch and where the kiosk is.
4. Get written acknowledgment, on paper or in the app, and keep it with personnel records.
5. Review each payroll run for missing punches, long shifts without breaks and overtime surprises, and fix them within the pay period.
6. Revisit yearly, or whenever you add a feature such as location or photo capture.

Add managers to the training. Most BYOD problems come from a supervisor who texts a cook at home or edits a punch without telling anyone, not from the employees.

Where Kloqk fits

Kloqk is a time clock built for small hourly teams. The free plan covers payroll-ready timesheets, overtime and break calculations, photo verification, mobile and kiosk punching, and payroll exports, so staff can punch from their own phones or a shared device. If you want a closer look at the basics, see our free employee time tracking page. For crews working across sites, our remote employee time tracking page explains how punches work away from the office.

Paid plans are optional: Pro is $29 per month per location and Premium is $59 per month per location, with the details on our pricing page. You can write and run a BYOD policy on the free plan and upgrade only if you need scheduling, PTO or the other add-ons.

FAQ

What should a BYOD policy include?

For time clock use, include who it covers, which app counts as the official clock, punch and break rules, how missed punches are corrected, a ban on punching for others, a reimbursement rule, what data the app collects, basic device security and what happens when someone leaves. Add a no-off-the-clock-work clause for nonexempt staff. Keep it short enough that people will read it.

Can I require employees to use their personal phone to clock in?

You can, but it is risky and often unnecessary. Requiring personal phone use raises reimbursement questions under federal overtime rules and some state laws, and it creates friction for anyone without a suitable device. A voluntary policy with a shared kiosk or company device as the alternative is safer and easier to defend.

Can an exempt employee be required to punch a time clock?

Generally yes. The DOL has stated that the FLSA does not prohibit tracking working time for exempt employees. Make sure the requirement is in writing and applied consistently, and keep in mind that punching a clock does not by itself change an employee’s exempt status.

Can I track an employee’s location through a BYOD time clock?

Only within clear limits. Limit location capture to the moment of a punch, tell employees in writing, and do not track them off the clock. Check your state’s privacy and biometric rules before you collect location or photos.

Sources

• Sheppard Mullin: Employer tips for wise use of workers’ biometrics and tech
• U.S. Department of Labor: Small Entity Compliance Guide
• U.S. Department of Labor: Hours Worked Advisor, off-the-clock work
• U.S. Department of Labor: Hours Worked Advisor, rounding and de minimis time
• U.S. Department of Labor: Recordkeeping
• U.S. Department of Labor: Opinion letter FLSA2024-01
• U.S. Department of Labor: Opinion letter FLSA2004-4NA
• Box Elder County: Timeclock guidelines
• UA Little Rock: Timekeeping procedures
• Maryland Department of Commerce: Telework policy best practices
• NULLBIT: Mobile app cost

Recommended

• Photo Clock-In Policy: U.S. Employers Need Privacy Rules
• How to Choose a Time Clock App: 7 Criteria for SMBs
• Best Time Clock Apps for Small Business in 2026
• Stop Buddy Punching: Free Selfie Clock In Setup for Small