Privacy Policy

GoPuncher ("we", "us") builds and operates a time tracking and work activity application that employers install for their employees. This policy explains what we do with personal information on this website and in the GoPuncher service.

We act in two different roles, and the rules are different for each:

• On this website, we are the business (controller). If you fill in our contact form, we decide how that information is used, and this policy governs it.
• In the GoPuncher service, we are a service provider (processor). Work session data belongs to the employer who subscribes to GoPuncher. They decide what is turned on, who may see it, and how long it is kept within the limits of the product. We process it only to provide the service to them.

If you are an employee whose employer uses GoPuncher and you want to know what is recorded about you, see "Employees: what your employer can see" below, and contact your employer for their own notice.

1. Information we collect on this website

The contact form. We ask for your first and last name, work email address, company name, and team size. You may also tell us your country and add a message. All of it goes to our team by email so we can answer you. We do not require a phone number.

Spam controls. The form includes a hidden field and a timing check that reject automated submissions. We do not use CAPTCHA, and we do not profile you.

Marketing email. The form has one optional, unchecked box for product updates. We send them only if you check it, and every message has an unsubscribe link. Your answer to the form does not depend on it.

Server logs. Our servers record the request itself: the time, the URL, the browser's user agent and the IP address, to keep the service available and to stop abuse. We do not log request bodies, passwords or tokens, and email addresses are masked in our application logs.

No cookies, no analytics, no third-party scripts. This website does not set cookies, does not use Google Analytics or any other analytics service, does not embed third-party fonts, videos, chat widgets or advertising pixels, and does not load any script from another company. There is nothing to consent to, which is why you will not see a cookie banner. If we ever change this, we will update this policy first and add the controls that the change requires.

How long we keep it. We keep your inquiry and our correspondence for as long as we are in contact with you and for up to 24 months after the last message, then delete it. Ask us earlier and we will delete it earlier. Server logs are kept for 30 days.

What we do not do with it. We do not sell your information. We do not share it for cross-context behavioral advertising. We do not buy contact lists, and we do not enrich what you give us with data from brokers.

2. Information in the GoPuncher service

An employer who subscribes to GoPuncher decides what their installation records. Depending on the settings they choose, the application can collect, only while an employee's timer is running:

• Work time, when the timer starts and stops, and the project or task selected.
• Activity level: the number of keystrokes and mouse actions per minute.
• Apps and websites: the name of the active application and its window title; for websites, the site name only, such as example.com.
• Screenshots: an image of the employee's screens at a random moment within each interval the employer configures. The employer can require that screenshots are blurred on the employee's computer before upload.
• Camera photos: a webcam photo on its own schedule. This is off unless the employer turns it on, the employee is told before it starts, and the camera indicator light turns on each time.
• Inactivity and time away, periods without keyboard or mouse activity, so that they are not counted as work time.
• Device details, application version, operating system, and when the computer last connected.
• Account information, name, work email address, company, team, role and permissions.

What the application never collects

• The content of what is typed. We count keystrokes; we never record which keys are pressed.
• Clipboard contents, documents, the text of email or chat messages.
• Audio or video recording, and no microphone access at any time.
• Full web addresses or page contents: the site name only.
• Facial recognition, face geometry or any other biometric identifier, including from camera photos.
• Anything at all while the timer is stopped or paused.

Who can see it

Employees see their own data. Managers see the employees of the teams they manage. Company admins and account owners see the whole company. Access is enforced by roles and by database-level isolation between companies. We do not read customer work data in the ordinary course of business; our staff access it only when a customer asks us for support or when we must investigate a security problem, and such access is logged.

How long it is kept

• Screenshots and camera photos: kept for the retention period set for the employer's company, then deleted automatically. The employer chooses that period; we do not keep the media longer than it.
• Time records, activity counts, and apps and websites: kept while the employer's account is active, because they are payroll and business records.
• When an employee deletes one of their own screenshots or camera photos, or deletes time they did not mean to track, the data is deleted and the minutes are removed from their tracked time; their manager sees that something was deleted and when, but not its content.
• Deleted data disappears from our encrypted backups within approximately 14 days.

Employees: what your employer can see

Your employer chooses the settings, so what is recorded differs between companies. In every case: nothing is recorded while your timer is stopped; the content of your typing is never recorded; you can see your own time, activity, apps and websites, screenshots and camera photos in your own dashboard; you can delete your own screenshots and camera photos while they are kept; and you can delete time you did not mean to track. The application shows your tracking status at all times and does not run hidden.

Your employer, not us, decides what is collected and answers requests about it. If you ask us for access to or deletion of your work data, we will refer you to your employer and tell them you asked.

3. Service providers we use

Each of them is bound by a data processing agreement to use the data only to provide their service to us. We will keep this list current; it is the complete list of companies that receive personal information from us.

We do not transfer personal information outside the United States.

4. Security

Data is encrypted in transit and at rest. Screenshots and camera photos are kept in private storage and are reachable only through short-lived signed links. Companies are isolated from each other at the database level. Access inside a customer's company follows the roles the customer sets. Access tokens on an employee's computer are stored with the operating system's own protection. Changes to company settings are written to an audit log the customer can read. No system is perfectly secure, and we do not claim certifications we do not hold.

5. Your California privacy rights

California residents have rights under the California Consumer Privacy Act, as amended. For website visitors we are the business; for employee work data the employer is, and requests should go to them.

Categories we collect from website visitors (CCPA categories): identifiers (name, work email address), professional information (company, team size), internet activity (server logs), and geolocation inferred only from the IP address in those logs. We collect it to answer your inquiry and, if you opted in, to send product updates. We do not collect sensitive personal information through this website.

Your rights. You may ask us to tell you what we hold about you, to give you a copy, to correct it, or to delete it, and you may ask us to limit our use of sensitive personal information. We will not retaliate against you for asking. To make a request, write to info@gopuncher.com or use the contact form on this site. We will verify your request by replying to the email address we hold and asking you to confirm details we already have; we never ask for a government ID. An authorized agent may act for you with written permission. We answer within 45 days and may extend once by another 45 days, and we will tell you if we do.

We do not sell personal information and we do not share it for cross-context behavioral advertising, including information about anyone under 16. Because this website sets no cookies and runs no advertising or analytics scripts, there is nothing for a browser opt-out signal to opt out of; we honor Global Privacy Control signals in any case.

Retention. We keep each category only as long as stated in sections 1 and 2.

6. Children

GoPuncher is a workplace tool sold to employers. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

7. Changes to this policy

If we change this policy we will post the new version here with a new effective date. If the change is material , for example, if we add analytics to this website, add a service provider, or change a retention period, we will say so at the top of the page for at least 30 days.

8. Contact us

Questions, requests or complaints: info@gopuncher.com. If you are an employee asking about your own work data, please contact your employer first; they decide what is collected and keep their own notice.