Privacy policy
Last updated 10 November 2026
PunchHQ is an attendance app. This page explains, in plain language, what we collect, why, and what control you have. It is written with India's Digital Personal Data Protection Act, 2023 in mind.
Who is responsible
When a business uses PunchHQ for its team, that business decides what attendance data it needs and is responsible for it. PunchHQ stores and processes that data for the business, only to run the service.
What we collect
- Account details: name, email, mobile number, employee ID, job title, joining date and, if your employer adds it, your birth date.
- Attendance: check-in and check-out times, and your location at that moment only, to confirm you are at the office.
- Device: a random ID stored in your browser so your account is tied to one trusted phone. It is not your phone's hardware ID.
- Requests: leave, work from home and punch corrections you submit, and their approval.
- Security logs: sign-in attempts and changes made by admins, to protect accounts and investigate problems.
What we do not collect
- No photos, selfies, face scans or other biometric data.
- No location tracking during the day. Location is read only when you check in or out.
- No advertising trackers, and we never sell personal data.
Cookies and storage
We use one essential cookie to keep you signed in. Your browser also stores your light/dark choice and the trusted-device ID. We use no analytics or advertising cookies.
Where data is stored
Data is stored with our hosting providers in Singapore (application and database) and is encrypted in transit. We use these service providers: Vercel (hosting), Neon (database), Resend (sign-in and notification emails) and Cloudflare (DNS and a bot check on the sign-in page). They process data only to provide their service to us.
How long we keep it
Attendance records are kept while the organisation's account is active, because they are needed for salary and compliance. When an organisation removes a person, that person's account and records are deleted. Expired sign-in codes are deleted automatically.
Your rights
You can ask to see, correct or delete your personal data, and to withdraw consent. Most details can be corrected by your organisation's HR team directly in PunchHQ. If you have a complaint, raise it with them first, or contact us below.
Contact
Contact the HR or admin team of the organisation that gave you your PunchHQ login. They can reach us on your behalf.
Changes
If we change this policy in a meaningful way, we will update the date at the top and tell admins inside the app.