Effective October 15, 2026. Crew Timesheets, listed as Timesheet: Work Hours & Crew, is operated by Pondir Studio LLC. Contact support@pondir.com about this policy or a privacy request.
Your local records
Worker profiles, jobs, shifts, breaks, configured pay rates and rules, notes, saved reports, original timecard images and crops are stored in the app’s library on your device. Manual Free use does not require an account. Worker profiles are local records, not employee accounts. The app does not provide GPS attendance tracking or automatic crew-library cloud sync.
Timecard text recognition runs on your device. The current release does not upload timecard images or your local library to Pondir for text recognition. Apple device backups may include app data depending on your settings; Apple handles those copies under its own policies.
Sharing and backups are your choice
You choose when to create and share PDF/CSV reports or portable backups, and where to save them. Reports can contain names, hours and pay estimates. Source images are excluded from portable backups by default. You can choose password-protected encrypted backups or an unencrypted backup. Protect these files and the password: the app cannot recover a forgotten backup password.
Files you share or save elsewhere are outside the app’s control. Deleting an app record does not delete copies held by recipients, Files, cloud storage or device backups.
Apple sign-in and subscriptions
Before a Pro purchase, the owner links through Sign in with Apple. Our separate owner service receives an Apple identity token, a one-time authorization code and a challenge to verify the sign-in. It stores a protected hash of the Apple user identifier, an internal owner identifier, a purchase-account token and protected session records for ownership and recovery. It does not require a worker’s Apple login or store the identity token as an account profile. The service exchanges the one-time code with Apple and stores the resulting refresh token encrypted so it can revoke authorization when you delete the owner account. Apple processes payments; Pondir does not receive payment-card details.
The app uses Apple’s StoreKit to check Pro access. The service can also keep pseudonymous transaction ownership, subscription, device-verification and allowance records for protected services when configured. Connection information such as IP addresses is processed for hosting and abuse prevention. Apple and Railway provide identity/payment and service-hosting infrastructure respectively. The owner service is hosted in the United States.
Hosted AI is disabled
Hosted text assistance is unavailable in the current release. The app does not send your timecard text or images to an AI provider in this release. Local scanning, review and manual tools work independently. If hosted assistance becomes available, we will update the disclosures and ask for consent to the selected text and disclosed processors before sending a request.
Retention and deletion
Your local library remains until you delete its records, erase the workspace or remove the app. Save a backup first. You can remove local source images separately while keeping recorded hours and report history.
You can delete the hosted owner account through the app’s Settings. After fresh Apple sign-in confirmation, the service revokes the stored Apple authorization and removes its encrypted refresh token. A failed revocation leaves the account available to retry. Deletion revokes sessions and device access and removes transient hosted content. Minimal pseudonymous ownership and purchase-binding records remain to prevent subscription reassignment and support recovery; these records are retained without an automatic expiry. Deleting the hosted account does not erase your local library or cancel an Apple subscription. Manage those separately.
Sessions expire after 24 hours and authentication challenges after five minutes. Expired session and challenge records are cleaned up while the service runs and at startup. Hosting logs or infrastructure copies may have separate retention. We do not promise immediate physical removal of every backup or infrastructure copy. Contact us to request access, correction or deletion of information we hold; we will handle requests subject to applicable requirements and necessary ownership/security records.
Permissions, diagnostics and support
Camera access is requested when you choose to scan. Optional reminders use notification permission. Change permissions in iPhone Settings. The app has no advertising or remote analytics SDK and does not track you across other apps. Its bounded local action/status log excludes timecard text, names, hours, rates and notes. Apple may provide diagnostics according to your Apple sharing settings.
If you email support, we receive the message and attachments you deliberately send. Include only what is needed and redact employee or pay information. The app does not silently attach your library. Visiting these web pages is separate from using the app: the website’s analytics, advertising and consent practices are described in the Pondir website privacy policy.
Updates and contact
We will update the effective date when this policy changes. For privacy questions, requests or support, email support@pondir.com. See also Terms and Support.