Sonoba is an app for construction crews. It records when you clocked in and out, photos of the job, and — when it can, and only at those moments — where the punch happened. This page says exactly what that means.
Your employer does. Sonoba is sold to construction companies, and the company that gave you this app runs the account. Your time records are that company's records: they decide what is collected within what the app offers, who at the company sees it, and what happens to it. In the language of California's privacy law, your employer is the business; Sonoba is a service provider processing the data on their behalf and on their instructions.
This matters for requests. A request to see, correct or delete your own records is answered by your employer. Sonoba can only act on it when your employer asks us to.
Every clock-in and clock-out records the time on your device, which of the two it was, who you are as an employee of that company, the company the record belongs to, and the work order it is against when there is one. This is the wage record. It is what the hours calculation runs on and what your employer keeps to show what you were paid for.
Punches are written on the phone first and sync to your employer's account when there is a connection. A punch made in a basement is a real punch; it just arrives later.
The app asks for When In Use location, and nothing more. It never asks for "Always", and there is no background location, no continuous tracking, and no location collection while you are off the clock. That is a property of the code, not a setting.
A location is requested at the moment you punch or mark an arrival, and at no other moment. The app waits up to three seconds for a fix and then gives up. Accuracy is requested at roughly a hundred metres — enough to tell one job site from another, not enough to follow anyone around a building.
A punch without a location is a complete punch. Declining location does not stop you clocking in, does not block your hours, and is not treated as an error. When there are no coordinates, the record says which of two things happened:
Those are kept apart deliberately. They mean different things to a manager reading a record later, and collapsing them into a blank invites the wrong conclusion about either.
Where a fix was obtained, the record keeps the coordinates and how accurate the fix was in metres. The accuracy is kept so that "within twelve metres" and "within three kilometres" are not read as the same claim.
Location is stored separately from the wage record, so it can be removed on its own schedule without destroying the fact that a shift happened. See how long things are kept.
Photos are documentation of a job. Each one is taken deliberately by you, labelled with what it is for, and attached to a work order:
Before a photo is stored, it is resized to 2048 pixels on its long edge and re-encoded as a JPEG, and the original metadata is discarded — the embedded GPS tag, the device identifier and the capture timestamp that a camera writes into a file do not survive. That is done because a photo shared with a client should not carry the technician's phone or whereabouts inside it. What remains in the file is pixel dimensions and colour space.
The photo record kept alongside the image holds when it was taken, its kind, its size, the work order, and — when a location was available at that moment, under the same rules as a punch — the coordinates.
The app can save a photo to your own photo library if you ask it to. It does not read your photo library.
Punches are turned into hours by a calculation that applies California wage rules, including the construction-specific provisions of IWC Wage Order 16. A manager then approves the result, and the approval records who approved it and when. An approved timecard is frozen: the numbers on it are what you were paid, and nothing in the system rewrites them afterwards. Corrections are issued as a new record alongside the old one, so the history stays readable.
Plainly, and all four:
This website is built the same way: no cookies, no tracking pixel, no analytics, no third-party fonts and no content loaded from anyone else's servers. The home page runs a small amount of our own JavaScript for its menu and the early-access form; this page and the support page run none. Opening a page tells us nothing about you beyond what your browser tells any web server it connects to.
The form on the home page is separate from the app. If you fill it in, we receive what you type: your name, email address and phone number, and — if you give them — your business name, industry and team size, what you want handled, what is taking up your time, and who referred you.
It is used for one thing: replying to you about Sonoba. It is emailed to our team, and a copy is kept in a file on our web host (DreamHost) so that a request is not lost if an email goes astray. It is not added to a mailing list, and it is not shared or sold.
To stop the form being abused, the web server uses your IP address to limit how many requests one connection can send. That record is stored as a one-way hash rather than the address itself, and is deleted after an hour. Your IP address is not stored with your request.
A request is kept while we are talking to you about Sonoba and deleted when it is no longer needed — or sooner, if you ask at x@sonoba.io.
Records are written on your device and sync to your employer's Sonoba account, where the people your employer authorises — typically the office and your managers — can see them. Data belonging to one company is kept separate from every other company's.
Sonoba uses infrastructure providers to run that service, which process data only to provide it and under contract. Nobody else receives your records, except where the law requires it — a subpoena, a court order, or a labour-agency demand — in which case your employer is told unless we are prohibited from telling them.
| Record | Kept | Why |
|---|---|---|
| Punches, hours, approved timecards | At least 4 years | California requires an employer to keep time records for 3 years — Labor Code §1174(d) and IWC Wage Order 16 §7(C). Sonoba is built to 4, because a wage claim can reach back further than the statute an employer is counting from, and the cost of keeping a timestamp is nothing. |
| Punch and arrival coordinates | Shorter, and separable | Precise location carries no statutory retention obligation of its own. It is stored apart from the wage record so it can be removed while leaving intact the fact that a shift happened. |
| Job photos | For the life of the job record | They are evidence of what was found and what was done, and are what settles a dispute about it. |
Said honestly: automatic purging on those schedules is not built yet. The data model separates location from wage data so that it can be, and this is on the list to build. Until it is, deletion happens on request.
If you are a California resident, you have rights over the personal information your employer holds about you. The categories the app collects are:
Precise geolocation is sensitive personal information under the CPRA. It is used only to record where a punch happened and for no secondary purpose, so there is no further use to opt out of. It is never used to infer anything about you beyond the location of the punch it is attached to.
Your rights are to know what is collected, to get a copy, to correct what is wrong, to delete, and to limit the use of sensitive personal information. You will not be treated differently for exercising any of them.
One limit worth stating in advance: a request to delete does not reach the records an employer is legally required to keep. Time and wage records fall under the statutory retention above, and the CCPA exempts personal information a business must retain to comply with a legal obligation. Coordinates, photos and anything not part of the wage record are not covered by that exemption.
Ask your employer first. They hold the records and they decide the answer. Their office or HR contact is the right route.
If that does not get you anywhere, or you are not sure who to ask, email x@sonoba.io with the name of the company you work for and what you are asking for. We will route it to them and help them answer it. We will respond within 45 days, and will say so if we need the extension the statute allows.
An authorised agent may make a request on your behalf, with proof that you authorised them.
Records are stored on your device and in your employer's account, and travel over an encrypted connection. No system is perfect, and claiming otherwise on a privacy page is a bad sign; what we will say is that access is scoped to the company the record belongs to, and that no credential for the service is stored in the app's source code.
Sonoba is a workplace tool, used by employees of the companies that buy it. It is not directed at children and we do not knowingly collect information from anyone under 16.
If this policy changes in a way that matters, the date at the top changes and the change is described here. Legal review is expected to change the wording; the practices described above are what the software does, and changing those is a change to the software.
13 October 2026: added the section on the early-access form on this website, updated how this website is described — the home page now runs a small amount of our own JavaScript — and changed the contact address to x@sonoba.io.