Clocked Privacy Policy

Version 1.3.0 · Effective 2026-11-09

1. Who we are

HAJBL Pty Ltd (ABN 20 690 112 960) publishes Clocked and is responsible for your personal information in connection with it (the "controller" under the GDPR and UK GDPR). Contact: privacy@[your-domain].

[REVIEW: whether an EU/UK representative (GDPR Art 27), a Korean domestic agent or local representatives are required.]

2. The short version

There is no account and no sign-in: we hold no account data and run no server that holds your records. Your records stay on your device, and a copy encrypted on your device is backed up to your own iCloud so you do not lose them, unless you turn backup off in Settings → iCloud backup (section 5D). We have no access to your iCloud. Health data, names of people, contact details and precise locations never leave your device. We do not sell personal information, show ads, use advertising identifiers or track you across other companies’ apps or websites. Some features send limited data (such as a location) directly from your device to the services listed below.

If usage analytics is on, the App also sends pseudonymous usage events (which features are used, not what you record) to PostHog in the EU, under a random install ID. You can turn it off at any time in Settings. Section 5A explains what is sent and when it is on.

3. Information stored on your device

The App stores this information locally on your device so it can work:

• Trips: start and end times, start and end coordinates, distance, business/private classification, purpose, odometer readings.
• Vehicles (name, registration, make/model, fuel use and price, tax details and costs you enter), logbook periods, rideshare/delivery shifts and earnings, app settings and your acceptance of these terms.
• Fuel records: machines and vehicles, fuel purchases (date, litres, cost, supplier, invoice reference) and how each purchase was allocated to machines and uses.
• Trip tracking state: the latest motion activity reading (for example in a vehicle or walking, with its time), where the phone and the car were last parked, and trips held back as possible passenger trips until you review them.
• Your acceptance of these documents (version, date and time, app version).
• Your usage-analytics choice (on or off, date and time, region setting) and, only while analytics is on, a random install ID.
• The random anonymous ID RevenueCat uses to recognise your subscription, the key that encrypts your iCloud backup (also kept in your private iCloud database, in a CloudKit end-to-end encrypted field), the time of the last backup and your backup choices.

4. Device permissions

The App asks for these permissions. You can refuse or withdraw them in your device settings; some features will then not work.

• Location — Always (background): To detect and record trips automatically while the app is closed. Only used if you turn on automatic tracking; you can switch it off in Settings at any time.
• Location — While using: To record trips with the app open and to start routes from where you are.
• Motion & Fitness (iOS) or Physical activity (Android): To tell when you are in a vehicle, so GPS only runs while you drive and uses less battery. Motion readings stay on your device: the App keeps only the most recent one, to decide when to switch GPS on, and never uploads or shares them. Optional: without it, automatic tracking still works but keeps GPS on.

5. Services the App connects to

To provide its features, the App sends the following directly from your device to these organisations, which process it under their own privacy terms:

• openrouteservice (HeiGIT gGmbH) — Road distances, best stop order and address search for the Routes feature. Data sent: Start, end and stop coordinates of the routes you analyse or plan, and any address text you search for. Location: Germany (EEA). https://openrouteservice.org/terms-of-service/
• RevenueCat (subscription management) — Checks whether your subscription or free trial is active and restores purchases. Data sent: A random anonymous app user ID created by the App (not your email and not an account ID), App Store / Google Play purchase receipts and transaction details, device model, operating system and app version, country/region. Location: United States (cloud). https://www.revenuecat.com/privacy
• PostHog (usage analytics, only if analytics is on) — Counts how the App is used (screens reached, features used, errors, subscription steps) so we can improve it, and runs experiments on wording and onboarding. Data sent: A random install ID created by the App (not your Apple/Google advertising ID or any device identifier), the events listed in our analytics notice with short codes and counts, app version, operating system, language, the country from your device region setting, your plan and trial state, and the week you installed. Never your name, email, location, photos, notes or anything you type. No IP-based location lookup. Location: European Union (Frankfurt, Germany). https://posthog.com/privacy
• Apple iCloud (your own iCloud backup) — Stores the App’s backup in your own iCloud (CloudKit private database), under your agreement with Apple, so you can restore it on another iPhone or iPad signed in to the same Apple Account. We have no access to it. Data sent: Encrypted copies of the records listed in section 5D, and the key that encrypts them, in a CloudKit end-to-end encrypted field. Never health data, names of people, contact details or precise locations. Location: Apple’s data centres, as set out in Apple’s iCloud terms. https://www.apple.com/legal/privacy/ and https://www.apple.com/legal/internet-services/icloud/
• Apple (App Store) / Google (Google Play) — Process payments, free trials, renewals, cancellations and refunds. Data sent: Handled under your Apple or Google account; we do not receive your payment card details. Location: Per Apple / Google. https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

5A. Usage analytics

What is sent: a random install ID the App creates (it is not your Apple or Google advertising ID, and we never ask for App Tracking Transparency permission because we do not track you across other companies’ apps or websites); events such as app opened, onboarding step viewed, paywall viewed, trial started, feature used, record added, scan completed (with how well it matched, never the photo or the text read from it), export created, notification choice and errors, with short codes and counts; app version, operating system, language, the country from your device region setting (not GPS, and PostHog’s IP-based location lookup is switched off), your plan and trial state, and the week you installed. The App strips names, emails, phone numbers, addresses, coordinates, notes and anything you type before sending.

Subscriptions: the App links your anonymous RevenueCat ID to the same install ID, so renewals, cancellations and refunds reported by the app store appear in the same analytics. We use this to understand trial conversion and churn.

Experiments: we may show different wording or onboarding orders to different groups and compare the results. Prices are never varied through analytics experiments; price tests, if any, run through the app stores and RevenueCat.

When it is on: in the EEA, UK, Switzerland, Canada, Korea and any other region not listed here, analytics is off until you turn it on. In Australia, New Zealand, Japan and the United States it is on by default and you can turn it off; it is also off by default if your device’s time zone is in one of the opt-in regions. You can change it during setup or at any time in Settings → Legal & your data → Usage analytics. Turning it off stops sending immediately and removes the install ID from your device.

Retention and deletion: analytics events are kept for up to 24 months and then deleted [REVIEW: set the PostHog project retention]. Settings → Delete my data also asks PostHog to delete the analytics history for your install IDs and turns analytics off.

5D. No account, and your iCloud backup

No account: Clocked has no sign-in and does not ask for your name or email address. We hold no account data and run no server that holds your records.

Subscription: you buy it through the App Store with your Apple Account. RevenueCat recognises your purchase by a random anonymous app user ID created by the App (not your email address and not an account ID). “Restore purchases” restores it on another device signed in to the same Apple Account.

iCloud backup: on by default; you can change it in Settings → iCloud backup. The backup goes to your own iCloud (the App’s CloudKit private database, container iCloud.com.hajbl.clocked), under your agreement with Apple, and counts against your iCloud storage. What is backed up: trips (date, start and end time, distance, odometer readings, business or private, vehicle), vehicles (including the registration), logbook periods, rideshare shifts, fuel purchases and settings. What never leaves your device: the GPS route and start and end points of every trip, places the App has learned, and your trip purposes and notes unless you turn on “Include notes”.

Records are encrypted on your device (AES-256-GCM) before upload; the key is kept in the same private iCloud database, in a CloudKit end-to-end encrypted field. We have no access to your iCloud: we cannot see, restore or delete your backup for you.

Restore: on any iPhone or iPad signed in to the same Apple Account with iCloud on, the App restores your backup automatically; you can also use Settings → Restore. Signing out of iCloud, or turning iCloud off for the App, stops backup.

Deletion: Settings → Delete my data deletes the App’s data on this device and the App’s backup in your iCloud (records), and asks PostHog to delete your usage analytics history. If you are not signed in to iCloud at the time, only the copy on the device can be deleted, and the App tells you so. It does not cancel your App Store subscription; the App tells you how to cancel it.

6. Why we use information (legal bases)

We use information only to provide the App’s features you ask for, to manage subscriptions and free trials, to keep the App secure, and to comply with law.

For people in the EEA, UK and Switzerland, our legal bases are: performance of our contract with you (providing the App), your consent (for location permissions and for usage analytics, both of which you can withdraw at any time), our legitimate interests (managing subscriptions, preventing fraud and keeping the App working), and legal obligations.

Usage analytics is used only to improve the App and to measure onboarding, retention and subscriptions. It is never used for advertising, never sold or shared for targeted advertising, and never combined with data from other companies.

7. Overseas disclosure and international transfers

Your iCloud backup is stored by Apple in your own iCloud, in Apple’s data centres as set out in Apple’s iCloud terms, not by us.

Information sent to the services above may be processed outside your country, including in Norway, Germany (PostHog EU, for usage analytics) and the United States, and by Apple or Google in the countries where they operate. Where the GDPR or UK GDPR applies, transfers outside the EEA/UK rely on adequacy decisions or the safeguards those providers put in place (such as Standard Contractual Clauses). [REVIEW]

For Australia: we may disclose personal information to overseas recipients as described here; we take reasonable steps under Australian Privacy Principle 8. For Japan (APPI) and Korea (PIPA), see section 11.

8. How long information is kept

We hold no account data. Your iCloud backup stays in your iCloud until you delete it with Settings → Delete my data (or Apple deletes it under your iCloud terms); we keep no copy of it.

Information on your device stays until you delete it in the App (Settings → Delete my data), clear the App’s data or delete the App. Usage analytics is kept as described in section 5A. Third-party services keep request data according to their own policies; RevenueCat and the app stores keep purchase records as required for billing, tax and fraud prevention.

9. Your rights

Settings → Delete my data deletes the data on this device and the App’s backup in your iCloud. Because we have no access to your iCloud and hold no account data, we cannot find, export or delete your records for you on request; use the App’s Export my data and Delete my data.

You can access and export your data at any time (Settings → Export my data) and delete it (Settings → Delete my data, which also asks PostHog to delete your usage analytics). You can withdraw analytics consent at any time (Settings → Usage analytics). Depending on where you live, you may also have rights to correct, restrict or object to processing, to data portability, to withdraw consent, and to complain to your privacy regulator — for example the OAIC (Australia), the Privacy Commissioner (New Zealand), the ICO (UK), your EU/EEA data protection authority (in Norway, Datatilsynet), the FDPIC (Switzerland), the PPC (Japan), the PIPC (Korea), the PDPC (Singapore) or the PCPD (Hong Kong).

To make a request about information held by us or by RevenueCat in connection with your subscription, email privacy@[your-domain]. We will respond within the time the law requires.

10. Children

The App is not directed at children under 16. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK).

11. Country-specific information

Japan (APPI): the purposes of use are those in section 6. Personal data is provided to the third parties in section 5 at your instruction when you use the related feature, including to recipients in the countries listed in section 7. [REVIEW: APPI cross-border transfer disclosures and consent]

Korea (PIPA): items processed are those in sections 3–5; purposes are in section 6; retention is in section 8. Overseas transfers: the recipients, countries, items and purposes are listed in section 5, and transfer happens over the internet when you use the related feature. You may refuse, but the related feature will not work. [REVIEW: separate consent screens may be required for overseas transfer and location information under PIPA and the Location Information Act]

Usage analytics by country: Japan — this notice is also our public notice of external transmission under the Telecommunications Business Act (recipient PostHog, items and purposes in section 5A), and you can stop it in Settings. Korea — analytics is collected only with your consent, which you can refuse without losing any feature; the overseas recipient is PostHog Inc., Germany (EU), items and purposes in section 5A, retention as stated there. Quebec (Law 25) and the rest of Canada — analytics is off unless you turn it on. United States — we do not sell personal information or share it for cross-context behavioural advertising. Australia and New Zealand — analytics is on by default under this notice and you can turn it off at any time. [REVIEW]

Other jurisdictions: we handle personal information consistently with the New Zealand Privacy Act 2020, Canada’s PIPEDA, Singapore’s PDPA, Hong Kong’s PDPO, Taiwan’s PDPA, Israel’s Privacy Protection Law, the UAE PDPL and Swiss FADP to the extent they apply.

12. Security

Data on your device is protected by your device’s own security (passcode, encryption). Connections to the services above use encrypted HTTPS. No method is perfectly secure, so please keep your device protected and export backups.

Your iCloud backup is encrypted on your device (AES-256-GCM) before upload, and the key is kept in your private iCloud database, in a CloudKit end-to-end encrypted field. Anyone with access to your Apple Account and a device signed in to it can restore the backup, so keep your Apple Account secure. [REVIEW]

13. Changes to this policy

We may update this policy. If a change is material we will ask you to acknowledge the new version in the App. The version and effective date are shown at the top.

14. Contact and complaints

HAJBL Pty Ltd, Fremantle, Western Australia 6160, Australia. Privacy contact: privacy@[your-domain]. If you are not satisfied with our response you can complain to your local privacy regulator (section 9).