Shift work · iPhone · Private pilot
The clock stops at the gate.
Cicada Clock records when someone starts and finishes a shift — and nothing about where they have been. One location reading at clock-in, one at clock-out, and no permission to ask for more.
A shift clock, not a tracker
Everything below exists because a supervisor asked for it and a worker could live with it. Where those two pulled apart, the worker won.
One pin, checked against the site
A single reading at each punch, measured against the site radius. Off-site is flagged for a human to look at — never silently blocked, never a reason the shift cannot start.
Typed, not tracked
Running late? Send the words and an optional estimate. People see what was written, not a map, not a countdown of remaining metres.
OCR from the starter pack
Photograph the payroll pack and the fields lift themselves. Document text only — there is no face enrolment anywhere in hiring.
Nobody is quietly paid zero
A shift still open past sixteen hours is surfaced to the employee and to People. People record the finish time as a correction; the original clock-in is never edited.
A week, from minutes actually worked
PAYE and NI estimated from clock-in to clock-out, with UK tax codes read from settings rather than hard-coded. Labelled an estimate on every line, because it is one.
The answers people ask for
Annual stretches or a single day, requested and decided in the app. Ivy answers pay, hours and holiday questions from the ledger — the same ledger People see.
Privacy by design, stated as a boundary
Most workforce clocks treat location as something to collect and then promise to behave with. Cicada Clock does not hold the permission that would make misbehaving possible. This is the product rule, not a setting an administrator can quietly reverse.
What a punch records
- One location reading, at the moment the button is pressed
- How far that landed from the site, as a flag for a human
- The time, taken from when the person actually pressed it — a queued punch from a dead signal keeps its real moment
- An optional photo, if the employee has that switch on
- A status, only when the employee chooses to send one
What the app never asks for
- Always-on location. The permission is not requested and not declared
- Home coordinates. Employees have no home location on file
- A commute. There is no path between two punches to draw
- Face geometry. An optional clock-in photo is checked on the device for whether a face is present; no template is stored, matched or transmitted
- A password read out to anyone. Activation is a code to the work inbox and a PIN set on the employee's own phone
Face ID unlocks the app on a phone the employee already set up. iOS does the match and returns yes or no. It is never used as evidence for a punch, and a PIN always works instead.
Two rules run through the whole thing
Punches are append-only
- The database refuses any update or delete against a punch — not by convention, by a trigger that raises an exception
- A correction is a new row pointing at the punch it closes, so “who changed this, and when” always has an answer
- Re-sending a queued punch returns the original instead of creating a second one, so a bad signal never doubles a shift
Every row belongs to an organisation
- Multi-tenancy is in the schema from the first migration, not retrofitted when a second customer appears
- Organisations register themselves; People issue employee logins
- Employees cannot create their own account, and an email check answers identically whether or not an address is registered — so the screen cannot be used to find out where someone works
How someone starts, in order
No password is ever generated, emailed, or read out over a counter.
- People create the employee record, including the work email. Nothing is sent to the person yet.
- The employee opens the app and enters that email. The reply is the same either way: if an organisation has registered this address, a code is on its way.
- A six-digit code arrives in the work inbox. Five attempts, ten-minute life.
- Only once the code is right does the app name the organisation, the site, the person and their People contact — so a wrong address never reveals anyone.
- They set a PIN and choose whether to use Face ID. From then on the app opens on that phone, with no code each time.
- One phone per person, stored on that phone. People can revoke it, and handing the phone back clears it locally.
Cicada Clock is in private pilot with a first customer. If shift work is your problem and surveillance is not your answer, we would like to hear how you run it today.