Privacy

The short version

Gildhour has three ways to use it. Basic needs no account: everything stays on your device and we never see it. Premium adds an account that keeps a synced copy of your data so your devices match. Company accounts let an employer see the punches their team makes for them. We do not sell data, show ads or use tracking scripts.

Basic: on your device

Jobs, pay rates, shifts, breaks, tips, mileage, expenses, clients, invoices, saved places and settings are saved in your browser on the phone or computer you use. Invoice PDFs and CSV files are created on your device and shared through your device's own share sheet. Backups are files you save yourself.

Location

When you punch in or out, Gildhour records your device's location with that shift so it can show whether you were on site. Your browser asks before sharing location, and you can turn personal location stamps off in More, under Preferences. On Basic, locations stay on your device.

Gildhour reads your location only when you punch, save a place, press SOS, share it when asked, or, during a company shift while the app is open, every few minutes. A web app cannot read your location in the background, and Gildhour never tries.

Accounts

An account stores your name, the public half of your passkey and a sign-in session. A passkey is unlocked by Face ID, Touch ID or your device PIN; your fingerprint or face never leaves your device and we never receive it. Signed-in devices keep one essential cookie to stay signed in. There are no other cookies.

Premium sync

With Premium, a copy of your Gildhour data, including shift locations, is stored with your account so it can sync between your devices and survive a lost phone. Signing out keeps your data on the device. Deleting your account deletes the synced copy.

Working for a company

If you join a company in Gildhour, that company can see: your name; each punch you make for the company, with its time, site, location, how it was verified, and any flags (for example an off-site punch or a location that jumped); your location every few minutes while you are on one of its shifts with Gildhour open; your location when you choose to share it after a manager asks; and SOS alerts and missed check-ins with your location.

A company never sees your personal jobs, your tips or pay from other work, or your location when you are off its shifts. You can leave a company at any time from More. Your employer is responsible for telling you about this monitoring where the law requires it.

Notifications

If you turn on notifications, we keep the address your browser gives us for delivering them. Notifications are sent through Apple's, Google's or your browser maker's push service, but the message text is not included: your device fetches it from us over your own session. Delivered notification text is kept for 30 days.

Where it is stored

Gildhour runs on Cloudflare, which serves the site and stores account data in its database. Cloudflare also processes basic request data, such as IP addresses, to deliver pages and protect the site, under its own privacy policy. The team map that managers see loads map images from OpenStreetMap, which receives the manager's IP address when it does.

How long we keep it

Account and Premium data: until you delete your account. Company punch records and alerts: while the company exists, and deleted with your account or when the company is deleted. Sign-in sessions end after 180 days. Unused sign-in challenges and invite codes are deleted when they expire.

Deleting your data

Basic: clear this site's data in your browser settings, or remove the app from your home screen. Accounts: More, then Account, then Delete account, which deletes your account, its synced copy, your company punch history and your notifications. A company owner deletes the company first, which removes its sites, punches, alerts and messages for everyone.

Children

Gildhour is meant for working adults and is not directed at children under 13.

Changes

If this policy changes, the new version will be posted here with a new date.