Work-time tracking without surveillance

When I say KlipTrack uses a phone’s location to record working hours, the first reaction is nearly always the same: “So the boss can see where I go?” It is a fair question. The boss cannot see the route, and the system has been designed that way from day one.

A work-time system has to work for two groups. The employer needs accurate, reliable records of who worked and for how long. Employees need to know that it will not turn into surveillance. These needs are compatible when the system makes the right choices during design, instead of collecting everything first and trying to hide it later.

Five decisions that make the difference

1. It tracks only during working hours. The phone records within a configured work-time window and stops outside it. The window can differ by person and day: office days can have different hours, and individual days can be set separately. The phone, server and reports all follow the same rule, so data is never collected just to be hidden later.

2. It uses company phones. The system runs on company equipment. Employees do not need to install anything on their personal phones, and their private life stays separate from work.

3. It shows attendance, not routes. The office interface shows when someone arrived at a site, when they left and how long they spent there. The employer does not get a route or a line drawn across a map. Exact location data stays on the server and is used only to calculate attendance. Two optional modules can show current location: a live map for the office wall, which rounds locations to a grid of roughly 270 metres, and a one-time location check. Both are off by default; if a company enables either, employees need to know.

4. A measurement and a correction stay separate. If someone later reports working longer than the phone recorded—for example, because there was no signal in a basement—the system records it as a correction. An approved correction counts towards paid hours, but the measured time and the correction are labelled and shown separately. If there is a dispute, both sides can refer to the same table.

5. Deleting an employee removes location data, not hours already worked. If a former colleague asks for their data to be deleted, their location data is removed. Their hours remain in a closed archive because the employer is legally required to retain them.

How do you answer, “Were they there?”

Recently, one colleague’s phone was unreachable for a little over half an hour at a site by Lake Balaton. The office saw “unreachable” and wondered whether the person had left. Management asked to see the full route.

I did not share the full route, but we could still give an accurate answer. On the server, I calculated how far each location reading was from the nearest site and how far the phone had moved since the previous reading. The coordinates never left the server. This showed that the colleague had stayed within the site’s radius; the phone kept recording during the outage but had no signal, and every reading arrived once it reconnected. The answer was just a few sentences: when they set off, arrived and left, and that they did not leave the site in between.

Most questions can be answered without giving anyone a full day’s movements.

Reliability protects employees too

Privacy does not mean the system is naive. If a phone reports a fake location—Android has apps that can do this—the phone flags it. KlipTrack records those readings but never counts them as attendance, and the office interface marks them. Differences between the phone’s clock and the server’s are logged too. If battery-saving mode delays a reading, the system reports that as well.

That protects employees too. In the case above, accurate records proved that the colleague had stayed where they were supposed to be. A handwritten attendance sheet could not have done that.

There are rules on the server too

When I investigate a problem, I access the server with read-only permission and normally do not query raw location data. I may check counts, times, statuses and distances because that is enough to debug the issue. I have written this rule down for myself. Privacy is not only about what an employer can see; it is also about what the person running the system can see.

If you are introducing location-based time tracking

• Tell colleagues in writing beforehand what the system records, when and who can see it.
• Track only during working hours and on company equipment.
• Ask the provider whether the employer can see routes and what happens when someone requests deletion.
• If there is a works council or employee representative, involve them early.

This is not legal advice. Ask a privacy professional or lawyer to review the requirements that apply to your situation.

In the next part, I explain how tracking stays reliable when a phone manufacturer tries to stop the app: Battery optimisation vs. a reliable background app.