One pin, at the punch
A single reading when the button is pressed, measured against the site radius. Off-site is flagged for a human to look at, never blocked.
Private pilot · iPhone
The clock stops at
the gate.
Our second product: workforce timekeeping that records when a shift starts and finishes, and nothing about where anyone has been in between.
- One location reading at each punch.
- No commute, because no path is ever drawn.
- No face template, on the phone or off it.
- A punch ledger nobody can rewrite.
When In Use onlyNo home coordinatesAppend-only ledgerUK hosted
- Event Clock in
- At 06:58:21
- Distance 38 m from site
- Photo Face present
- Route never recorded
- Home never known
- When In Use location only
- One reading per punch
- 0 background reads
- 0 face templates stored
- No home coordinates
- No commute trail
- Append-only punch ledger
- Corrections append, never overwrite
- Offline punches keep their real time
- One phone per person
What a punch records
Six things, and every one of them is legible to the person it is about.
A workforce clock is a surveillance product by default. This one was built by deciding what the job actually needs — that someone started a shift, at a site, at a time — and then refusing the permissions that would allow anything more.
01 02 The moment it happened
The time the person actually pressed it, not the time the phone found a signal. A punch queued in a basement keeps its real moment.
03 Words, not coordinates
On-my-way and running-late are typed, with an optional estimate. People see what was written. No location is accepted with a status.
04 An optional photo
Only if the employee has that switch on. The device checks whether a face is present in the frame and nothing further leaves the phone.
05 A shift nobody closed
Open past sixteen hours and it is surfaced to both the employee and People, who append a finish time rather than editing the clock-in.
06 A week of minutes
PAYE and NI estimated from clock-in to clock-out, tax codes read from settings. Marked an estimate on every line, because it is one.
- 0Location readingper punch, and no others
- 0Background readsthe permission is not requested
- 0Face templatesnone derived, none stored
- 0Editable punchesthe database refuses
What it never asks for
A boundary you can verify beats a policy you must trust.
A clock that could follow someone home and chooses not to is a promise, and a promise is only as durable as the next administrator. A clock that never requested the permission is a property of the build. The rows below are not features we have not got to yet; they are the ones we declined, and the app ships without the capability to change its mind.
Punch 4,812 · what was captured4 held · 4 refused
- Punch location 38 m from site
- Punch time 06:58:21
- Status, if sent on my way, 10 min
- Photo, if opted in face present
- Always-on location not requested
- Home coordinates not collected
- Commute path does not exist
- Face geometry never derived
Face ID unlocks the app on a phone the employee already set up. iOS performs the match and returns yes or no; the app never sees face data, it is never punch evidence, and a PIN always works instead.
How it is built
An append-only ledger, one tenant per row.
The database raises an exception on any attempt to update or delete a punch. A supervisor fixing a missing clock-out appends a correction that points at the punch it closes, so the original stands and “who changed this, and when” always has an answer. Every row has belonged to an organisation since the first migration rather than since the second customer. The service runs on its own box in London, separate from anything golf.
Where it sits
Honest about where the category wins.
Two kinds of product already own this space: cheap GPS punch clocks, and workforce suites that bundle rota, messaging and payroll. Cicada Clock is neither, and two of the rows below are losses.
| Cicada Clock | GPS punch-clock appsJibble, Buddy Punch, Timeero and similar | Workforce suitesDeputy, Homebase, 7shifts, Planday, RotaCloud and similar | |
|---|---|---|---|
| Location permission | When In Use only. Background location is not requested and the iOS key for it is not declared in the app. | Background or continuous tracking is commonly offered, and on some plans it is the headline feature. | Varies by product and plan; field and route tracking are commonly available options. |
| Between punches | Nothing. No path exists to draw, export, or subpoena. | Breadcrumb trails, routes and mileage are frequently sold as a feature. | Often available where the suite serves field or delivery work. |
| Face at clock-in | Optional photo, checked on the device for whether a face is present. No template stored, matched or transmitted. | Facial recognition that matches against an enrolled template is a common upsell. | Photo capture is common; recognition varies by product. |
| Editing a punch | Impossible. A correction is a new row pointing at the one it closes. | Administrators edit timesheets directly, usually with an audit log alongside. | Same, with approval workflows and richer audit trails. |
| Rota, swaps, breaks | Not built. Leave is in; scheduling is not. | Usually thin or absent — these are clocks. | Mature, and the main reason to buy one. |
| Platforms | iPhone. Android is planned and not yet shipped. | iOS, Android, tablet kiosk and web. | iOS, Android, kiosk, and a full web console. |
Category descriptions come from our own market review of September 2026 and describe what these categories typically offer, not a claim about any one product. Individual products differ and change — check a vendor’s current documentation before comparing on our word.
How someone starts
No password is generated, emailed, or read out over a counter.
01 People create the record
Including the work email. Nothing is sent to the person yet, and no password is generated.
02 The employee enters that email
The reply is the same either way: if an organisation has registered this address, a code is on its way.
03 A six-digit code arrives
In the work inbox. Five attempts, ten-minute life.
04 Only then is anyone named
The organisation, the site, the person and their People contact appear after the code is right, so a wrong address reveals nobody.
05 They set a PIN
And choose whether to use Face ID. From then on the app opens on that phone with no code each time.
06 One phone per person
Held on that phone. People can revoke it, and handing the phone back clears it locally.
In private pilot
A clock your people are not suspicious of.
The iOS app and its API are running with a first customer. If you run shift work and surveillance is not the answer you want, the product site has the detail and a way to reach us.