Acceptable Use Policy | Tick Tack Timetrack

DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as [LEGAL ENTITY NAME], is a placeholder that still has to be filled in.

This Acceptable Use Policy (“AUP”) is part of the Terms of Service. It applies to every company that has an account with Tick Tack Timetrack, which is operated by [LEGAL ENTITY NAME] (“we”, “us”), and to every person who signs in under that company’s account, including administrators, managers, employees, and anyone using a shared kiosk device or an API key. Capitalised words that are not defined here have the meaning given in the Terms.

1. Why this policy exists

Tick Tack Timetrack holds records that matter to people’s pay. Misuse of the service can harm the people whose time is recorded, other customers who share the same infrastructure, and us. This policy sets out the limits in plain terms.

2. Use the service only for lawful workforce management

You may use the service to record and manage working time, attendance, schedules, time off, job and location assignments, and the related pay calculations for people who work for your company. You must not use it:

to break any law, including wage-and-hour, anti-discrimination, labour, privacy, consumer protection, and export control laws;
to track the location of anyone who is not your worker, or to track a worker outside the times and purposes your own policies and applicable law allow;
to collect location data, photos, or other personal information from workers without giving any notice or obtaining any consent that the law requires of you as their employer;
to falsify, backdate, or alter time records in order to underpay anyone, or to conceal hours actually worked;
to store information unrelated to workforce management, in particular health records, government identification numbers, bank or card numbers, or other sensitive personal data in free-text fields such as notes, job names, or custom fields;
to harass, threaten, or discriminate against any person.

3. Keep accounts and devices secure

Each person signs in with their own credentials. Do not share passwords, one-time codes, recovery codes, or passkeys.
Do not punch in or out on behalf of another person, unless your company has deliberately set up a manager or kiosk workflow that allows it and your records show who made the entry.
Keep kiosk PINs private. Unlink a kiosk device promptly if it is lost or no longer used.
Treat API keys like passwords. Store them securely, give them only the access they need, and revoke them when they are no longer needed.
Tell us promptly at [SECURITY CONTACT EMAIL] if you believe an account, kiosk, or API key has been compromised.

4. Do not attack or overload the service

You must not:

probe, scan, or test the vulnerability of the service, or bypass any security or authentication measure, except under a written security-testing arrangement with us (see our Security page for how to report a vulnerability you found by accident);
access, or try to access, another company’s data or any account you are not authorised to use;
send traffic designed to exceed the published API rate limits, or use automated means to scrape the service other than through the public API;
upload malware, or content designed to exploit other users, such as malicious files disguised as punch photos;
point webhooks at endpoints you do not control, or use webhooks to send traffic to third parties who have not agreed to receive it;
copy, frame, reverse engineer, decompile, or create a competing product from the service, except to the extent the law expressly allows it despite this restriction.

5. Content you put in the service

You are responsible for everything your users upload or type into the service, including notes, names of jobs and locations, and punch photos. That content must not infringe anyone’s intellectual property, privacy, or publicity rights, and must not be unlawful, defamatory, obscene, or hateful.

If you believe content in the service infringes your copyright, write to [CONTACT EMAIL] with enough detail for us to find the content and with your contact details. [DMCA AGENT DETAILS]

6. What we may do

If we reasonably believe someone has broken this policy, we may, depending on how serious and urgent the problem is:

contact the company’s administrators and ask them to fix it;
remove or disable access to specific content;
revoke API keys, unlink kiosk devices, or disable webhooks;
suspend individual users or the whole company account, as described in the Terms;
report suspected unlawful activity to the appropriate authorities when the law requires or permits it.

Where practical, we will tell the company’s administrators before acting and give them a chance to respond. We may act first when there is an urgent risk to the service, to other customers, or to anyone’s safety.

7. Reporting misuse

Send reports of misuse to [CONTACT EMAIL]. A worker who has concerns about how their employer is using the service should usually raise them with the employer first, because the employer controls those records. We will still read reports from workers.

8. Changes

We may update this policy. Each version is published at its own address and the current version is always at /legal/acceptable-use. We will give notice of material changes as described in the Terms.