What we store, and who it belongs to.

Your account

When you sign up we store your name, email address and a hashed password. Passwords are never stored in a readable form. We use this only to sign you in, to show who recorded an attendance mark, and to contact you about the service.

Your organisation’s records

Participants, guardians, schedules, attendance marks, package credits and payment records belong to the organisation that entered them. Qlockin stores and processes them on that organisation’s behalf and under its instructions. We do not sell them, share them with other organisations, or use them to build a profile of anyone.

Each organisation’s data is isolated. Every request is checked against the signed-in user’s membership of that organisation before any record is returned.

Participants do not need an account

A participant never needs a phone, an app or an account to attend. If your organisation issues membership cards, the code printed on the card is a random identifier and nothing else — it contains no name, date of birth, phone number or any other personal detail. It is meaningful only to your organisation, and it can be reissued.

The camera

The mobile app asks for camera access only when you open the scanner, and uses it only to read a membership code. No photo or video is recorded, stored or transmitted. Declining the permission leaves every other part of attendance working — you can always check someone in by tapping their name.

Guardian links

A guardian sees their own child’s schedule, attendance and balances through a private link that expires and can be revoked at any time by the organisation. The link is the credential, so treating it as private matters; no password is created, and no account is required.

No tracking

The mobile apps contain no advertising SDKs, no third-party analytics and no cross-app or cross-site tracking. The typefaces the app uses are bundled with it, so it does not call out to a font service when you open it.

Where it is held

Data is stored on Cloudflare’s infrastructure. Attendance recorded while a device is offline is kept on that device until it syncs, and then removed from the device’s queue.

Keeping and deleting

Records are kept for as long as the organisation keeps its account, because attendance and payment history is exactly the kind of record a business needs to be able to look back on. An organisation can export its data at any time, and can ask us to delete its account and everything in it.

Children

Many participants are children. They do not interact with Qlockin at all — their records are entered and managed by the organisation teaching them, which is responsible for having the right to hold that information and for obtaining consent where the law requires it.

Asking us about your data

Write to admin@stakraf.com. If you are a parent or participant, your first point of contact is the organisation that holds your records; we will help them answer you.