Privacy policy
Last updated 29 September 2026
The short version. SimplHR records attendance, leave, expenses and client visits for the business you work for or run. We use that information only to provide the app. We don't sell it, we don't show ads, and we don't track anyone's location in the background.
Who this policy covers
This policy covers the SimplHR mobile app and the simplhr.app website. In it, "we" and "SimplHR" mean the team that runs SimplHR.
SimplHR has two kinds of users:
- Owners create a business in the app and add their staff.
- Staff are added by an owner and sign in with an employee ID and PIN.
For staff information, the business you work for decides what is recorded and how it is used. We store and process it for them. If you are a member of staff and have a question about your records, ask your employer first. You can also contact us.
What we collect
| Information | Why we need it |
|---|---|
| Owner's name, and the email address or phone number used to sign in (with a password, Google, Apple or a text message code). Passwords are stored only as a secure hash by our sign-in provider. | To create the owner's account and let them sign in |
| Business name, country, time zone and work locations (a point on the map and a radius) | To show times and dates correctly and to check whether a punch was made at work |
| Staff name, phone number and employee ID | So the owner can identify staff and send them their sign-in details |
| Staff PIN | To sign staff in. We store it in a scrambled (hashed) form that nobody, including us, can read back. |
| A random identifier created by the app on the staff member's phone | So each staff login works on one phone only |
| Punch records: time, location, location accuracy, whether the phone was faking its location, and whether the punch was inside a work location | To record attendance and help the owner trust the records |
| Client names and locations, and visit records: arrival and departure time and place, and notes | To record visits to clients |
| Leave requests: type, dates and reason | So staff can ask for leave and owners can approve it |
| Expense claims: amount, category, date and receipt photos | So staff can claim expenses and owners can check them |
| A notification token for each phone you sign in on, and the app's language | To send you notifications about leave and expense requests, in your language. Signing out removes the token. |
| Subscription status (which plan is active) | To apply the right plan limits. Payments are handled by Apple or Google. We never see card details. |
| Early access sign-ups on this website: email address, team size, language, approximate country and the date | To email you when SimplHR launches |
Location
SimplHR asks for location permission only while the app is open ("while using the app"). It reads the phone's location at these moments only:
- when a member of staff taps Punch In or Punch Out
- when they check in or check out at a client
- when an owner places a work location or client on the map
SimplHR does not track location in the background, between punches, or after the app is closed.
Camera and photos
The app uses the camera or photo library only when a member of staff chooses to attach a receipt to an expense claim. Only the photo they pick is uploaded.
What we don't do
- We don't sell or rent personal information.
- We don't use it for advertising, and the app contains no ads or ad trackers.
- We don't share one business's records with any other business.
Who can see the information
- The owner of a business can see the records of everyone in that business.
- Staff can see their own records and the business's work locations and clients. They can't see other staff members' records.
- Our service providers process information on our behalf, only to run SimplHR:
- Google Firebase and Google Cloud: sign-in, database, file storage and servers
- Google Maps: showing maps in the app
- Apple and Google: Sign in with Apple, Google Sign-In, push notifications, in-app purchases, and app integrity checks that block fake copies of the app
- RevenueCat: managing subscriptions
- Cloudflare: hosting this website and the early access list
- Authorities, if the law requires us to share information.
Where it is stored
App data is stored on Google Cloud servers in the United States. If you use SimplHR from another country, your information is transferred there. It is protected by the safeguards described in this policy and by our providers' data protection terms.
How long we keep it
- Exact locations on punches and client visits are kept for 90 days. After that we delete the map coordinates and keep only whether the punch was inside a work location, which location it was, and the times.
- Attendance, visits, leave and expense records, and receipt photos are kept for 3 years from the date they were created, then deleted automatically. Owners can export reports before then if they need records for longer.
- Notifications in the app's inbox are kept for 90 days.
- Inactive businesses: if the owner hasn't opened SimplHR for 2 years, we notify them in the app. If they still don't open it within 60 days, we delete the business and all its records.
- When an owner deletes their account, we delete the business and all its records straight away. That includes staff logins, punches, visits, requests and receipts.
- When a member of staff deletes their account, we delete their login, phone link and phone number. Their past attendance, visits and requests stay with the business until the 3-year limit above, because they are part of the employer's records.
- Early access emails are kept until we've told you about the launch, and for no more than 12 months after it. You can ask us to remove yours at any time.
See how to delete your account.
How we protect it
- Information is encrypted while it travels between the app and our servers, and while it is stored.
- Each business's data is separated, and access rules are checked on our servers.
- PINs are stored hashed. After 5 wrong PINs, the login is locked for 15 minutes.
- Punch times come from our servers, so they can't be changed from the phone.
Your choices and rights
Depending on where you live, you may have the right to see, correct, export or delete your personal information, or to object to how it is used. To use these rights:
- If you're a member of staff, ask your employer, who controls your records. You can also email us.
- Anyone can email support@simplhr.app. We'll reply within 30 days.
You can also complain to the data protection authority in your country.
Children
SimplHR is a tool for businesses and is not meant for anyone under 16. We don't knowingly collect information from children.
Changes to this policy
If we make a significant change, we'll update the date at the top of this page and let owners know before the change takes effect.
Contact
Questions about privacy: support@simplhr.app