Punch

Privacy Policy for Punch

Last updated: May 6, 2026

Gomez Inc. (“we,” “us,” “our”) operates the Punch mobile application and the Punch web application (collectively, “the App”). This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data.

1. Information We Collect

When you use Punch, we collect the following categories of personal information:

Account information

  • Email address (required to sign in)
  • Name (display name shown to your team)
  • Phone number (optional, used for account recovery and contact)

Location information

  • Precise location (latitude/longitude) captured at the moment you punch in or out, used to verify you are within the geofenced work area set by your organization. We do not track your location continuously or in the background.

Identifiers

  • A unique user ID that links your account to your time entries and organization.

Purchase information

  • A record of subscription purchases and renewals. When you subscribe on iOS, the record is provided by Apple’s StoreKit; when you subscribe on web at punchapp.io, it’s provided by Stripe. In both cases the payment processor handles your card details directly — we never see your full card number, CVV, or provider-account credentials. We retain only the subscription identifier, plan tier, and billing status needed to grant access to paid features.

Work records

  • Timestamps of each punch-in and punch-out you perform, associated with the location and organization at the time.
  • Time-off requests you file, including the requested date range, an optional reason note, and the review decision (approved, denied, or pending) made by your organization’s manager or owner.

2. How We Use Your Information

We use your information solely to operate Punch, including:

  • Authenticating you and maintaining your account
  • Displaying your time entries and time-off requests to you, your managers, and your organization’s owner
  • Verifying punch-in/out events against your organization’s geofence
  • Processing and validating your subscription through Apple (when purchased on iOS) or Stripe (when purchased on the web at punchapp.io)
  • Communicating with you about your account, service changes, and support requests

We do not use your data for advertising, sell it, share it with data brokers, or use it to build profiles for third-party marketing.

3. How Your Information Is Shared

We share your information only as follows:

  • Within your organization.Your name, time entries, punch-in/out locations, and time-off requests are visible to your organization’s owner and managers. This is the intended behavior of a workforce timekeeping app.
  • With our infrastructure providers. We use Supabase (database and authentication), Apple (iOS in-app purchases, push notifications), and Stripe (web subscriptions) to operate the App. These providers process data on our behalf under contractual obligations.
  • When legally required. We will disclose information if compelled by law, subpoena, or a valid government request.

We do not share your information with advertisers, analytics networks, or third-party marketers.

4. Data Retention

  • Account data is retained for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g., tax records related to purchases).
  • Time entriesare retained as long as your organization retains them. Your organization’s owner controls this.
  • Time-off requestsare retained alongside the organization’s time entries and follow the same retention rule.
  • Location pings associated with punch-in/out events are retained alongside the time entry they verify.

5. Your Rights

Depending on where you live, you have rights that may include:

  • Access — Request a copy of the personal data we hold about you.
  • Correction — Ask us to correct inaccurate data.
  • Deletion — Ask us to delete your account and associated personal data.
  • Portability — Receive your data in a machine-readable format.
  • Objection — Object to certain processing activities.

To exercise any of these rights, email us at punchapp.support@gmail.com. We respond within 30 days.

California residentshave additional rights under the CCPA, including the right to know what categories of personal information we collect and the right to opt out of “sale” of personal information. We do not sell personal information.

EEA/UK residents have rights under the GDPR/UK GDPR, including the right to lodge a complaint with your local data protection authority.

6. Security

We protect your information with industry-standard measures, including TLS encryption in transit, encryption at rest, and row-level access controls that prevent users from viewing data outside their own organization. No system is perfectly secure, but we work to reduce risk continuously.

7. Children’s Privacy

Punch is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

8. International Data Transfers

Punch is operated from the United States, and our infrastructure providers store data in the United States. If you use Punch from outside the U.S., your information will be transferred to and processed in the U.S. under applicable data-transfer safeguards.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the App or by email. The “Last updated” date at the top reflects the most recent revision.

10. Contact

For privacy questions, data requests, or any concerns: