Privacy Policy
1Who this covers
This policy explains how SINCT (the time clock, payroll and administration tools at sinct.app, operated by Michael Duffy, the "Owner") handles personal information about the people who use it and the employees it keeps records for.
The Service is run for the organization those people work for (the "Organization"). The Organization is the employer and decides what the Service is used for. The Owner handles personal information on the Organization's behalf, as its service provider, and only to run the Service. The Organization's own privacy notices to its employees also apply.
2What we collect
| Kind | Examples | Where it comes from |
|---|---|---|
| Identity and account | Name, employee number, work or personal email, job role, which pages someone may use | The Organization's administrators and scheduling system |
| Work and time records | Shifts and venues, clock-in and clock-out times, meal and rest breaks, correction requests and the reasons given, approvals | Employees using the Service, and the Organization's scheduling system |
| Payroll problem records | Hours, pay rates and amounts owed on payroll worksheets; attached check stubs, screenshots and email messages used as proof | The Organization's payroll staff |
| Pay card and stub information | Name, employee number, whether paid by check or pay card, number of stubs | Pay stub files the Organization's payroll staff upload |
| Electronic signatures | The signature picture a person adopts, and for each signing their name, email, date and time, type of device and browser, the terms version agreed to, and a fingerprint of the form | The person signing |
| Agreement records | When a person agreed to these Terms and this Privacy Policy, which versions, and the type of device and browser | The person agreeing |
| Preferences | The dashboard colour a person picks | The person |
| Notifications | A browser notification address, if a person turns on notifications | The person's browser |
| Activity records | Who did what and when in the dashboard (for example, who approved a correction) | Created by the Service |
Under California law, an account login together with its password counts as sensitive personal information; passwords are held by the sign-in provider and are never readable by the Owner. Attached email messages and documents can contain information about other people. Payroll staff should attach only what is needed.
3What we do not collect
- Social Security numbers, bank account or routing numbers, or government ID numbers.
- IP addresses. The Service does not store them. While a request is being handled, the address may be held briefly in memory to slow down floods of requests, then discarded. Our hosting providers keep their own short-lived technical logs, which can include IP addresses.
- Biometric information, such as fingerprints or face scans.
- Information for advertising. There are no analytics, advertising or tracking tools on the Service.
4How it is used
- To run the Service: recording time, breaks and corrections; preparing payroll problem forms and weekly files; sending clock-in links and account emails; sending notifications people turned on.
- To send time records to the Organization's scheduling and payroll system, as the Organization directs.
- To keep the Service secure, prevent misuse, and fix problems.
- To keep records the Organization needs and the law requires.
The Owner does not sell personal information and does not share it for cross-context behavioral advertising. It is not used for any purpose unrelated to running the Service for the Organization.
5Who it is shared with
- The Organization. Its authorized staff see the records their role allows.
- Service providers who host or deliver the Service under their own privacy and security terms: Vercel (website hosting), Supabase (database, file storage and sign-in), Resend (email delivery) and Fly.io (background processing). Data is stored in the United States.
- The Organization's own systems, such as its scheduling and payroll system, when the Service syncs records to them.
- When the law requires it, for example a valid subpoena or court order, or to protect someone's safety.
- If the Service is transferred, to a company the Owner controls or a buyer, who must keep following this policy.
6Cookies and device storage
The Service uses only what it needs to work: a sign-in cookie that keeps you logged in, and storage on your device that holds clock punches made without a connection until they can upload, your dashboard colour, and a few display preferences. There are no advertising or tracking cookies, so there is nothing to opt out of.
7How long it is kept
Records are kept for as long as the Organization uses the Service and as long as the Organization's legal record-keeping duties require. California generally requires employers to keep payroll and time records for at least three years, and some records longer. Signed payroll problem forms are kept with their signing records. When the Service ends for the Organization, its data is exported to the Organization and then deleted, as the Terms of Service describe.
8Security
The Service uses encrypted connections, passwords stored by the sign-in provider (never readable by the Owner), role-based access so people see only what their job needs, and database rules that block direct access from browsers. No system is perfectly secure. If a security breach affects personal information, the Owner will tell the Organization without unreasonable delay so that the people affected can be notified as California Civil Code section 1798.82 requires.
9Your California privacy rights
If you are a California resident, the California Consumer Privacy Act may give you the right to know what personal information is held about you, to have it corrected or deleted, and to limit the use of sensitive personal information, without being treated differently for asking. Employees may also inspect their own payroll and personnel records under the California Labor Code.
Because the Service holds this information for your employer, send requests to your employer's payroll department. You may also contact the Owner, who will pass the request to the Organization and help it respond. Some records cannot be deleted while the law requires them to be kept.
10Children
The Service is for the Organization's workforce. It is not directed to children under 16 and does not knowingly collect information about children under 13.
11Changes
When this policy changes, it gets a new version date. Dashboard users are asked to confirm they have read the new version the next time they use the dashboard.
12Contact
Privacy questions and requests: Michael Duffy, michael220990266@gmail.com.