Privacy Policy
Effective September 21, 2026
The short version. CheckPunch stores what your staff check off, the notes and photos they attach, and the email address you sign up with. It is kept in the United States, it is never sold or shared with advertisers, and you can have all of it exported or deleted by asking.
Who runs this
CheckPunch is built and operated by Mason Barnocky in Bozeman, Montana. There is no support department; if you email masonbarnocky@gmail.com, you are emailing the person who wrote the software.
What we collect
Your account
Your email address and a password. Passwords are hashed by our authentication provider and are never visible to us in readable form.
Your business setup
The business name, its web address on CheckPunch, its time zone, the checklists you build, and the schedule you expect them to run on.
Your staff
The names you enter for the people who work shifts, and a PIN for each of them. PINs are hashed, so neither we nor anyone with database access can read them back. We do not ask for staff email addresses, phone numbers, addresses, or any employment records.
Shift activity
Which checklist items were completed, when, and under which staff name. Any notes typed in, and any issues flagged.
Photos
Where a checklist item asks for one, the photo your staff take. Photos are stored in a private bucket and are not publicly reachable: viewing one requires a signed link that expires. Please see the note about photos in the Terms of Service, because what ends up in the frame is something only you control.
Technical records
We record the IP address and browser of failed PIN attempts, in order to rate-limit them, and the IP address and browser recorded at signup as proof of which version of these documents was agreed to. We also collect anonymous, aggregated page performance data through Vercel Analytics and Speed Insights.
What we do not do
- We do not sell your data, and we do not share it with advertisers.
- We do not run advertising or marketing trackers of any kind.
- We do not follow you or your staff across other websites.
- We do not use your business data to train machine learning models.
- We do not track anyone’s location.
- We do not record hours worked. CheckPunch is not a timekeeping system.
Cookies
CheckPunch sets cookies for one purpose: keeping you signed in. There is a session cookie for owner and manager accounts, one for the shift device, and one for the admin tools. There are no advertising cookies, no analytics cookies, and no third-party cookies. The performance analytics named above are cookieless by design. This is why you are not being asked to dismiss a cookie banner.
Where it lives, and who else touches it
CheckPunch runs on services operated by other companies, and each of them necessarily handles some of your data in order to do its job:
- Supabase hosts the database, the photo storage, and account authentication.
- Vercel hosts and serves the application, and provides the anonymous performance analytics.
- Resend delivers email, including confirmation emails and the alert that tells you a checklist was missed.
Data is stored in the United States. We do not transfer it outside the United States.
Who can see your data
The people you invite to your business, and no other customer. Access between businesses is enforced at the database level, not just in the application.
We should be direct about one thing: as the operator, Mason has administrative access to the underlying database and can technically view any business’s data. This is used for support, debugging, and keeping the service running, not for browsing. Any infrastructure provider with a database is in the same position, and most privacy policies bury this. We would rather you hear it before you sign up than discover it later.
How long we keep it
Shift history is kept for as long as your account is open, because the point of the product is being able to look back. Checklists that were started but never touched are cleaned up automatically.
Getting your data out, or getting rid of it
You can delete your business from Settings. Deletion runs on a 30-day grace period: for 30 days it is hidden and recoverable, and after that it is permanently removed along with every photo attached to it. Closing your account works the same way. Neither is reversible once the 30 days are up.
If you want a copy of your data, in a readable format, email masonbarnocky@gmail.com and you will get one. If you want everything erased sooner than the grace period allows, say so and it will be done.
Security
Passwords and staff PINs are hashed. Photos are stored privately and served only through expiring links. Access between businesses is blocked at the database level. PIN entry is rate-limited against guessing. No system is perfectly secure, and anyone who tells you otherwise is selling something; if a breach affects your data, you will be told promptly and plainly.
Children
CheckPunch is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.
Changes
If this policy changes in a way that affects what we collect or what we do with it, account holders will be emailed before it takes effect. The date at the top always reflects the current version.
Contact
masonbarnocky@gmail.com. Questions about your data get a real answer, not a ticket number.