Privacy Policy
This is the privacy policy for Gildhour, published by iMix Labs (Uppervox LLC). The same text is at gildhour.com/privacy.
Effective October 13, 2026
Gildhour is made by Uppervox, the studio of Alexander Costa, an individual in Massachusetts, United States. Questions or requests: hello@uppervox.com.
The short version
Gildhour has three ways to use it.
-
Basic. No account. Your data stays on your device and we never see it.
-
Premium. An account that keeps a synced copy of your data on our server.
-
Company. An account that joins a company. The company's managers see the punches you make for it.
We do not sell your data, show ads, or run analytics or tracking scripts.
What is stored on your device (web app)
In your browser's storage (IndexedDB, with a copy in local storage while it fits) on the phone or computer you use: jobs, pay rates, shifts, breaks, tips, flat fees, mileage, expenses, clients, invoices, saved places, your business details (name, email, phone, address and payment instructions, if you type them), settings, and any location stamps recorded with shifts. Company and sync state (a queue of company punches not yet sent, the last message you dismissed, the last sync version) is stored the same way.
Invoice PDFs and CSV files are made on your device and passed to your device's share sheet or downloaded. Backups are JSON files you save yourself. We do not receive them.
The installed app uses a service worker, which keeps a copy of the app's own files so it opens offline. It does not store your data on our servers.
iPhone and Apple Watch app
The iPhone app has no account and never sends your data to us. Your jobs, shifts, breaks, tips, mileage, expenses and settings are kept in the app's own storage on your iPhone. If you use the Apple Watch app, your iPhone sends your settings, active jobs, and shifts from the last two weeks to your paired watch through Apple's WatchConnectivity, and what you do on the watch (clock in or out, breaks, tips) is sent back to your iPhone the same way. Shift reminders are notifications scheduled on your device. Backups are files you save yourself. The iPhone app does not use your location or camera. Links in the app open gildhour.com in your browser, where this policy's web sections apply.
Location
By default the app records your device's location (latitude, longitude, accuracy, time) with a shift when you punch in or out, to show whether you were at your saved place. You can turn this off under More, Preferences. Your browser asks permission first.
The app reads your location only when you punch, save a place, press SOS, share your location when a manager asks, or, during a company shift while the app is open and visible, about every 5 minutes. A web app cannot read location in the background and Gildhour does not try.
On Basic, location stays on your device. It leaves your device only if you use Premium sync (it is part of your synced data) or you punch for a company (see below).
If you tap a map link on a shift or alert, your location is passed to Apple Maps (maps.apple.com), which receives it under Apple's privacy policy.
Camera
The camera is used only when you choose to scan a company site's QR code. Video frames are read on your device to find the code. Nothing is recorded, saved or uploaded. Allow or revoke access in your browser or phone settings.
Accounts and passkeys
Accounts are optional. You create one with a display name and a passkey (Face ID, Touch ID or a device PIN). We store: your display name, a random account ID, the date it was created, your plan, any company and role you hold, and for each passkey its ID, its public key, a sign-in counter and its transport types. Your fingerprint or face never leaves your device. We do not ask for an email address or password.
Signing in sets one essential cookie (punch_s, HttpOnly, Secure, SameSite=Strict) holding a random session token. We store only a hash of the token. There are no other cookies.
Premium sync
A copy of your Gildhour data (jobs, shifts, tips, mileage, expenses, clients, invoices, settings including your business details, and location stamps) is stored in our database against your account, so it syncs between your devices and survives a lost phone. Signing out keeps your data on the device. Deleting your account deletes the synced copy.
If you buy Premium, Stripe runs the checkout and receives your card details, email and billing address directly; we never see your card. We store your Stripe customer ID and your subscription's status, to turn Premium on and off. Premium granted by hand has no payment details at all.
Working for a company
If you join a company, it can see:
-
your display name and role;
-
each punch you make for it, with time, site, location, how it was verified (location, printed poster, QR or code), whether you were on site, and flags such as off-site, no location, location jumped or late sync;
-
your location about every 5 minutes while you are on one of its shifts with the app open (the server keeps only your latest position for this, not a trail);
-
your location when you choose to share it after a manager asks;
-
SOS alerts and missed check-ins, with your last known location;
-
messages managers send you, and your replies to check-ins.
A company does not see your personal jobs, tips, or pay from other work, and does not see your location when you are not on one of its shifts. You can leave a company at any time from More. Your employer is responsible for telling you about this monitoring where the law requires.
Punch times are recorded in UTC on the server. Company managers can export punches as a CSV.
Notifications
If you turn notifications on we store the address your browser gives us for delivering them (a push endpoint). Delivery goes through Apple's, Google's, Mozilla's or Microsoft's push service, which sees the endpoint and your IP address. The push itself carries no message text: your device fetches the text from us over your signed-in session. Delivered notification text is deleted after 30 days.
Other services that receive data
-
Cloudflare hosts the site and stores account data. It processes request data such as IP addresses to deliver pages and protect the site. We do not store IP addresses in our database. Cloudflare keeps its own service logs under its privacy policy.
-
OpenStreetMap tile servers supply the map image on the team board that managers see. They receive the manager's IP address and the map area requested, and your browser's origin as referrer.
-
Stripe processes Premium payments (above) under its own privacy policy, and keeps payment records as the law requires.
-
Push services (above) and Apple Maps (above, only if you tap a map link).
-
Fonts and scripts are served from gildhour.com itself. No ad, analytics or social network is loaded.
We do not sell or share personal information for advertising.
How long we keep data
-
Account, passkeys, Premium sync copy and Stripe customer ID: until you delete your account.
-
Sign-in sessions: 180 days, or until you sign out.
-
Sign-in challenges: 5 minutes. Company invite codes: 14 days. Expired ones are deleted hourly.
-
Notification text: 30 days.
-
Push address: until you delete your account, or the push service reports it gone.
-
Company punches, alerts, messages and sites: while the company exists; deleted when the company is deleted. Your punches and alerts are also deleted when you delete your account.
-
Latest company location (for the live map): kept only while you are on shift and cleared when you clock out. Each punch keeps the location recorded at that punch.
-
Database backups held by Cloudflare: up to 30 days, then overwritten.
Your choices and rights
-
Access and export. Basic: your data is already yours, use More, Save backup. Premium: the same backup includes your synced data. For a copy of server records (account, company punches), email hello@uppervox.com.
-
Delete. Basic: More, Your data, Erase everything, or clear this site's data in your browser, or remove the app. Account: More, Account, Delete account. This deletes your account, passkeys, sessions, synced copy, company punches and alerts, location, notifications and push address. Deleting your account also cancels a Premium subscription. A company owner must delete the company first. It also deletes messages you sent or received, invite codes you created and your correction requests, and removes your name from alerts, reviews and decisions you made for a company.
-
Correct, object, restrict. Email us. Most data is edited in the app itself.
-
If you are in the EU/UK, you have GDPR rights (access, rectification, erasure, restriction, portability, objection) and may complain to your supervisory authority. If you are in California or another US state with privacy law, you have rights to know, delete and correct, and not to be discriminated against for using them. We do not sell or share data for advertising. We respond within 30 days.
-
Company data. For a company, the company decides what to collect and is the controller of its employees' punch records; Uppervox runs the service for it. Employees should ask their employer first for access or correction of punch records.
Where data is processed
Cloudflare operates globally. Our database is hosted by Cloudflare and your data may be processed in the United States and other countries where Cloudflare operates. For EU/UK users, transfers rely on Cloudflare's data processing addendum, which includes the EU Standard Contractual Clauses.
Children
Gildhour is meant for working adults and is not directed to children under 13 (or under 16 where local law sets that age). We do not knowingly collect their data. If you believe a child has an account, email us and we will delete it.
Security
Data is sent over HTTPS. Sessions use HttpOnly, SameSite=Strict cookies. Write requests are accepted only from gildhour.com. No system is perfectly secure; keep your device and passkey provider secure. If a breach affects you, we will notify you as the law requires.
Changes
If this policy changes, the new version is posted here with a new date. For material changes affecting account holders we will also post a notice on gildhour.com.