Privacy Policy

1. Who is responsible

• Service: PocketWork
• Operator and privacy officer: GyeongGwan Nam
• Address: 4F, 26 Hancheon-ro 14-gil, Dongdaemun-gu, Seoul, Republic of Korea
• Questions and requests: [email protected]

2. What we process and how we collect it

• Member accounts: social sign-in provider, provider user ID, email, name, profile image, sign-in and last-use times
• Workplaces and employees: workplace name, address, coordinates and radius; employee name, sign-in ID, employee number, contact details, department, position, shift group, hire date, manager notes, hashed PIN
• Attendance and requests: schedules, clock-in and clock-out times, precise latitude, longitude, accuracy and distance, QR check results; dates, times, reasons and outcomes of leave, overtime and correction requests, and their change history
• Devices and security: cookies, hashed session tokens, device name, User-Agent, access and error logs, request IDs, web push endpoints and encryption keys
• Payments: account email, workplace and account IDs, plan, Paddle customer, subscription, price, transaction and event IDs, payment and cancellation status. Card numbers and other raw payment details are never stored on PocketWork's servers.

Information is collected when members and employees enter it, when workplace managers register it or upload a CSV, when clock-in and request features are used, and from responses from the browser and from sign-in and payment providers.

3. Why we process it

To verify identity and keep accounts secure, confirm workplace ownership and manager permissions, run employees and schedules, decide QR and GPS clock-ins, handle leave, overtime and corrections, provide records and Excel or PDF exports, send web push notifications, process subscription payments, cancellations and refunds, provide customer support, investigate outages and misuse, and keep the Service stable.

4. The workplace's role

When a member registers information about employees or other third parties, the member is the controller of that information and must have a lawful basis and give any required notices. PocketWork processes that information only as needed to provide the features the member chooses, keeps it logically separated from other workplaces' data, and checks the current account and workplace permissions.

5. How long we keep it

• Member accounts: until an account deletion request is processed or the service agreement ends
• Workplace, employee, attendance, location, request and audit data: until the workplace is deleted or the service agreement ends. Deleted data is removed from the live database, and copies in backups drop out of the restorable set when the backup retention period ends.
• Employee sign-in sessions: used for authentication until the employee signs out, the PIN changes, the employee is set to inactive, or a manager ends the session; the browser cookie lasts up to 400 days after last use
• Member and manager sign-in: up to 180 days from last use, or until sign-out or removal of permissions
• Payment and contract records: for the periods required by law where applicable, such as 5 years for contract, withdrawal, payment and supply records and 3 years for consumer complaint and dispute records

Electronic files are deleted so they can't easily be recovered. Records the law requires us to keep are stored separately from live data and used only for that purpose. You can currently request account deletion by email.

6. Sharing with third parties

PocketWork does not sell personal data and does not share it with third parties for other purposes without consent or a legal basis. If sharing becomes necessary, we will tell you in advance who receives it, what, why and for how long, and obtain any required consent.

7. Service providers

• Railway: application hosting and PostgreSQL data storage (Singapore region)
• GitHub: storage of encrypted database backup files (deleted automatically after 30 days)
• Google Firebase and Google Sign-In, Kakao, NAVER: social sign-in for members and employees
• Paddle (Paddle.com Market Limited and its affiliates): as Merchant of Record for paid subscriptions, provides checkout, payment method and subscription management, tax and receipts, and processes payments, cancellations and refunds. Payment details you enter are processed by Paddle under its own privacy policy.
• Browser web push providers: deliver notifications to devices that have opted in
• Weather and map providers: workplace location setup and weather display. Only the coordinates needed are sent, with no personal identifiers attached.

Each provider receives only the minimum information needed, over encrypted connections such as HTTPS, when the relevant feature runs, and deletes it when processing ends or according to its own contract or legal retention period. We will update provider entities, processing countries and regions, and retention periods when our contracts or deployment settings change.

8. Processing outside Korea

Overseas infrastructure operated by Railway, GitHub, Google, Paddle and browser push providers may be used. Service data (the application and its database) is stored in Railway's Singapore (Southeast Asia) region. What is transferred is the part of the information in Section 2 that each feature needs (account identifiers, workplace data, payment and subscription IDs, or push endpoints), at the time you sign in, save data, pay or receive notifications, over encrypted networks. We confirm the destination countries and retention periods based on the actual contracting entities and deployment regions and will announce changes. You may choose not to use these features or ask support to stop the processing, but sign-in, payment, notifications or other affected features may then be limited.

9. Your rights

You can ask to access, correct, delete or stop processing your personal data, and to receive a copy of your account and workplace data. Employees can first ask their workplace's manager, and may contact PocketWork directly if that isn't possible. Send requests to [email protected]; we will verify the requester's identity and authority and let you know the outcome.

10. Cookies and sessions

We may use cookies and local storage to keep you signed in, prevent CSRF, remember your language and support device-specific features. You can delete or block them in your browser settings, but sign-in, employee sessions, notifications and some screen states may then not be kept. We don't use third-party advertising cookies.

11. Security

We check both account authentication and workplace permissions, handle PINs and session tokens as hashes or signed values instead of plain text, and apply encryption in transit, access restrictions, rate limits, security headers, audit logs, backup and recovery procedures, vulnerability and incident response, and workplace isolation tests.

12. Children under 14

The Service is for workplace attendance management and is not provided to children under 14. Workplace managers must check the age of employees they register and complete any required guardian procedures.

13. Changes and remedies

If what we process, our service providers or how we store data changes, we will post the effective date and the changes on this page. You can send privacy questions to the officer above, and may also seek help from authorities such as the Korean Personal Information Infringement Report Center (dial 118 in Korea).

This English version is provided for convenience. If it conflicts with the Korean version, the Korean version prevails to the extent permitted by law.