Cookie Policy
DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as
[LEGAL ENTITY NAME], is a placeholder that still has to be filled in.
This policy explains the cookies and similar browser storage used by Tick Tack Timetrack, operated
by [LEGAL ENTITY NAME]. Cookies are small text files a website asks your browser to keep.
“Local storage” is a similar browser feature that keeps data on your device.
1. The marketing website
Our marketing website does not set analytics, advertising, social media, or other tracking cookies, and does not load third-party tracking scripts. For that reason it does not show a cookie banner. If we ever add non-essential cookies, we will update this policy first and ask for any consent the law requires.
2. The Tick Tack Timetrack app
The app uses only cookies that are strictly necessary to sign you in and keep your account secure.
They are first-party (set by us, not by anyone else), cannot be read by scripts on the page
(HttpOnly), are sent only over encrypted connections, and are restricted so that other websites
cannot make your browser send them.
| Name | Purpose | How long it lasts |
|---|---|---|
tt_refresh |
Keeps you signed in. Holds a token that is exchanged for a short-lived access token and replaced each time it is used | Up to 30 days, or until you sign out |
tt_mfa_remember |
Remembers that this browser passed two-factor authentication, if you chose “remember this device” | 14 days |
tt_oauth_state |
Protects single sign-on with Google, Microsoft or Apple against forged sign-in attempts (only if that sign-in option is used) | 10 minutes |
tt_device |
Identifies a browser that an administrator has approved, if the company limits sign-in to approved devices | Up to 400 days |
3. Browser storage in the app
| Item | Purpose | How long it lasts |
|---|---|---|
Kiosk device token (kiosk_device_token) |
Lets a shared kiosk device stay linked to the company. Stored encrypted in the browser | Until the kiosk is unlinked or the browser data is cleared |
Offline punch queue (punch.offline_queue.v1…) |
Holds punches made without a connection, including time, notes and any location reading, until they can be sent | Until sent; the company decides how old an offline punch may be (72 hours by default) |
Punch status snapshot (punch.status_snapshot.v1…) |
Shows whether you are punched in while offline | Until replaced or browser data is cleared |
The app does not use local storage for advertising or analytics. Your sign-in access token is held only in memory and is gone when you close the tab. Language and theme preferences are saved to your account on our servers, not in your browser.
4. Maps and error reports
When the app shows a map, your browser downloads map images directly from our mapping provider (see Subprocessors). That provider receives your IP address and the area shown but does not set cookies through our app. If error monitoring is turned on, crash reports are sent without cookies or personal contact details.
5. Your choices
Because these cookies and storage items are needed for the app to work, there is no setting to turn them off inside the app. You can delete them in your browser settings at any time; you will then be signed out, a kiosk will need to be linked again, and any punches waiting in the offline queue will be lost.
6. Changes and contact
Each version of this policy is published at /legal/cookies/<version>/. Questions:
[DPO/PRIVACY CONTACT].