Privacy policy
Last updated October 22, 2026
This policy explains what information XpressBase Inc ("XpressBase", "we") handles when organizations and their workers use xpressWorks: the web app, the kiosk time clock, the XpressWorks Desktop app for Windows and macOS, and this website.
Who is responsible
xpressWorks is used by employers ("customers") to record their workers' time. For time records, the customer decides what is collected and how it is used, and we process that information on the customer's behalf. Workers with questions about their own records should contact their employer first; we will help the employer answer.
What we collect
- Account details: names, work email addresses, roles, and the organization a person belongs to.
- Time records: clock-ins and clock-outs, start, stop, and switch events, breaks, the project or task selected, notes a worker types, edits, and approvals, each with its time and source (web, kiosk, or desktop).
- Kiosk data: the kiosk device's registration and a worker's PIN, which is stored only in hashed form.
- Desktop app data: an installation ID, the worker label it was paired with, the operating system, processor type, and app version, plus the time events the worker records.
- Optional monitoring (desktop 0.2.0 and later), only with the worker's consent: a customer may turn on, per work profile and each with a stated reason: the names of the programs and websites in use (the site name only, never the page) and how long each is in front; whether listed work programs are open in the background; computer health (processor and memory use, free disk space, uptime); periods with no mouse or keyboard input; a screenshot of the main screen at a random moment in each interval, blurred on the computer so that no text can be read unless the customer chooses clear screenshots for a company-owned computer; and the computer's position from the operating system's location service at clock in and clock out, or periodically if the customer chooses that, compared with the agreed work site. The worker sees the full list in the app before starting work, accepts or declines on each computer, and states whether the computer is their own or the company's; on a personal computer screenshots are always blurred, position is taken only at clock in and out, and the services list is never collected. Recording runs only while the worker is clocked in, never on a break, stops when consent is withdrawn, and raw records are deleted after the retention period the customer sets (30 to 365 days). The worker sees every record sent from their computer at once, including every screenshot, and can remove a screenshot within 10 minutes of its upload, before the customer can see it. From these records and the worker's time, the service builds a work story for each day, week, month, and term that is shown to the worker and the customer at the same moment and sealed when the period ends; neither side can change it, and the worker can add notes for 3 days.
- Website contact form: the name, work email, organization, and message you send us.
- Technical data: security and error logs kept by our hosting providers, such as IP addresses and request times.
What XpressWorks Desktop never collects
By default the desktop app records only actions a worker takes in the app. Whatever a customer turns on, the app never records keystrokes, clipboard contents, files or file names, window titles, full web addresses, or anything from the camera or microphone, and it never records anything while the worker is clocked out or on a break. Screenshots and location are collected only when a customer turns them on and the worker has accepted, as described above; a screenshot is never taken off the clock, and position is never derived from the network address.
How we use information
- To provide xpressWorks: record time, sync devices, and produce timesheets, approvals, and payroll exports for the customer.
- To keep the service secure, prevent abuse, and fix problems.
- To send service emails such as sign-in links and invitations.
- To answer contact form requests.
We do not sell personal information and do not use it for advertising.
Service providers
We use a small number of providers to run xpressWorks, under contracts that limit their use of the data: Supabase (database, sign-in, and storage), Vercel (web hosting and downloads), and Resend (email delivery). Data is stored in the United States.
Retention
Time records are kept for as long as the customer's account is active and as required by the customer's record-keeping obligations. When a customer leaves, we delete or return their data on request, except where the law requires us to keep it.
Security
Data is encrypted in transit. Access is limited by role within each organization, and changes to time records are kept in an audit history. Records waiting on a desktop or kiosk to sync are stored encrypted on that device.
Your choices and rights
Depending on where you live, including California and Canada, you may have the right to see, correct, or delete your personal information. Workers should start with their employer. You can also contact us using the details below, and we will respond as the law requires, including under Canada's PIPEDA and its provincial privacy laws.
Children
xpressWorks is a workplace product and is not directed to children under 16.
Changes
We will post changes here and update the date above.
Contact
XpressBase Inc
112 E Amerige Ave
Fullerton, CA 92832
Use the contact form on this site.