Effective date: 1 July 2026 · Last updated: 9 October 2026 (sections 3, 4, 5, 7, 8 and 9 updated: push notifications)
ProofClock is a Ring Appstore application operated by Erbacci LLC (Wyoming, USA), which is the data controller for the personal data described here. Your ProofClock plan is handled entirely by the Ring Billing System. You can contact us for any privacy request at info@erbacciltd.com.
To deliver proof-of-attendance, ProofClock accesses, through the Ring Partner API and only with your authorization at account linking:
ProofClock does not access Live Video, media clips, image snapshots, or audio. Because it receives no images or video from your camera, there is nothing for a privacy zone to apply to: it cannot see anything a privacy zone hides, and it performs no masking of its own.
From those timestamps, ProofClock derives and stores only the minimal data needed for the service: your sites and schedules, your device list and status, the motion-event timestamps, and the computed attendance verdicts (Verified / Short / No-show / Unverifiable) for each expected window. It also stores your session, the email addresses of people you invite, and an access log of sign-ins and data views.
Push token (mobile app). If you allow notifications for ProofClock on your phone, the app sends us that phone’s push token — an identifier Apple or Google issues so that notifications can reach the ProofClock app on that phone. With it we store the phone’s platform (iOS or Android), the email address of the person who was signed in when it was registered, a one-way fingerprint of that sign-in session (never the session itself), the time it was last registered, and the reference of its delivery registration at AWS SNS (section 8). If you do not allow notifications, the app never sends us a push token. A push token is not an advertising identifier. On Android, Google’s Firebase Cloud Messaging component built into the app registers the app installation with Google (a Firebase installation ID and a push token) the first time the app is opened, before you sign in and whether or not you allow notifications; ProofClock itself receives the push token only once notifications are allowed (section 8).
We use this data solely to provide the feature you enabled: showing when scheduled crews arrived, how long they stayed, and whether they met the service window, and producing reports you can use for billing. We do not use Ring data for advertising, marketing, profiling of individuals, resale, or any purpose beyond delivering the service.
A push token is used only to deliver the notifications described in section 5 to that phone — never for advertising, marketing, tracking, analytics or profiling.
No AI training. ProofClock uses no AI or machine-learning models, and no Ring data is ever used to train, fine-tune, or improve any model.
ProofClock sends only account and service email — never marketing:
The account owner can turn service notices and the weekly digest on or off at any time in Settings → Email preferences; the digest stays off unless the owner turns it on, and invited members are not sent service notices or the digest. We do not send promotional or marketing email, and — as stated in section 4 — we never use Ring data for advertising or marketing.
Push notifications are sent to phones that registered for them after notifications for ProofClock were allowed, and they are never marketing — they report verdicts. After a scheduled window closes, ProofClock waits until the verdict is the same on two consecutive scorings (the scorer runs every 10 minutes), so a notification typically arrives 10–20 minutes after the window ends; none is sent once more than 90 minutes have passed. Each notification names the site and the verdict, with details of that visit such as the schedule’s name and time window or, where someone was seen, the arrival and last-seen times and time on site. It also carries ProofClock’s own internal references for that site, schedule and visit. It never contains camera images, video or audio, Ring device names or IDs, or anyone’s email address. By default only problems — No-show, Short and Unverifiable — are notified; if a problem we already notified turns out to be wrong (for example, delayed camera events show the visit did happen), one more notification gives the corrected verdict. The account owner can turn those off, or turn on a notification for every verdict, in the app under Settings → Push notifications; these settings apply to every phone signed in to the account, including invited team members’ phones. Anyone can stop notifications being shown on their own phone by turning them off for ProofClock in the phone’s settings; signing out of the app on that phone stops them being sent at all and deletes that phone’s push token (section 7).
ProofClock is a consensual employer attendance tool. If you use it to monitor staff or crews, you (the employer/account owner) are responsible for giving those individuals notice and obtaining any consent required by your local law. The account owner confirms this in-app before use, and ProofClock keeps an access log so account owners can see who accessed the data. ProofClock is not intended for covert surveillance of individuals.
Raw motion-event rows are retained for approximately 90 days and then expire automatically. Two of those timestamps — the first and last motion of a visit, shown as its arrival and departure — are copied onto the computed verdict for that visit and follow the retention of that verdict. Access-log entries are retained for approximately 1 year. Sites, schedules, devices and computed verdicts do not expire on their own: they are retained until you delete them, unlink the integration, or request deletion, after which they are removed.
A phone’s push token is kept until it is deleted from our database, which happens when that person signs out of the app on that phone, when the account owner removes that team member, when the account is deleted or ProofClock is unlinked (section 9), when the sign-in session it was registered with expires, and — once Apple or Google have refused that phone’s token as no longer valid (for example, after the app has been uninstalled) — the next time we try to send a notification to that phone. To reach a phone, AWS SNS keeps a delivery registration holding its push token (and nothing else about you), inside our AWS account in US-East-1; it is deleted together with the token. If you sign out while your phone is offline, the sign-out is completed — and the token deleted — the next time you open the app.
ProofClock shares data only with the processors strictly necessary to run the service:
Our web pages load two typefaces from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), so Google receives the IP address and browser user-agent of the device rendering the page. No Ring data, account data or attendance data is sent to Google through these fonts; push notifications to Android phones go through Google’s Firebase Cloud Messaging, described above.
We do not sell your data and have no law-enforcement integration or data-sharing with law enforcement.
You can delete your account and all associated data at any time from Settings → Delete account in the app, or by unlinking ProofClock from the Ring app. Either way we permanently delete your stored data — sites, schedules, devices, motion events, verdicts, team memberships, sessions, access logs and the push tokens of your phones, with their delivery registrations at AWS SNS. Deleting in the app does not by itself unlink the integration, so if you want all processing to stop, also remove ProofClock in the Ring app (Menu → My Apps → ProofClock); that unlink (the app_integration_removed event) triggers the same deletion and ends further collection. Deleted data is removed from our databases immediately; operational server logs, which may contain event timestamps and device identifiers, expire automatically within 30 days. If the same email address also owns or belongs to another ProofClock account, we keep the sign-in identity for that address so the other account continues to work. You can also exercise your data-protection rights wherever you are — including US state-law rights (such as the CCPA/CPRA) and, where they apply to you, your rights under the GDPR and UK GDPR — by emailing info@erbacciltd.com.
Data is encrypted in transit (TLS/HTTPS; plain HTTP is redirected to HTTPS) and at rest — Amazon S3 with SSE-S3 (AES-256) default encryption and public access blocked, and Amazon DynamoDB with its always-on server-side encryption. Your Ring account-linking tokens are held in DynamoDB under that encryption; they are never returned to any client, never rendered in the dashboard, and never included in any API response. The functions that process Ring data run under dedicated AWS IAM execution roles scoped to the specific tables, bucket and secret they need, and administrative access is limited to a small number of authorised people. Application activity is logged to Amazon CloudWatch Logs, retained for 30 days and reviewed by us; we do not currently run automated anomaly detection.
ProofClock is a business tool for adults. It is not directed to children under 13 and contains no child-oriented content.
We may update this policy; material changes will be reflected here with a new effective date and, where appropriate, communicated in-app.
Erbacci LLC (Wyoming, USA) · Contact: info@erbacciltd.com · ProofClock · Powered by Ring