Your crews install it on their own phones. Here is what that means.
Oh! Thyme records work time for your company and nothing else. It never follows anyone through the day, and it keeps the keys to your systems out of reach of any phone.
What we collect, and when.
Face ID and fingerprints stay on the phone. We never get them.
| What | What is kept | When |
|---|---|---|
| Who you are at work | Name, work email, job title, employee number, supervisor | From your employer or its NetSuite |
| Your time | Clock-ins and outs, breaks, hours by project and task, time off, every change with who and why | When you record it |
| Location | One reading per punch, saved with that punch | At clock-in, clock-out and task switch only |
| Camera | Nothing is saved | Only while scanning a code |
| Device name | Which phones are signed in | At each sign-in |
How it is built.
Keys stay sealed
NetSuite and Paycom keys are stored encrypted on our servers and never reach a phone. For NetSuite, Oh! Thyme makes the key pair itself; only the certificate ever leaves it.
Least access
The NetSuite role can add time entries and read the lists it needs. Each person sees their own time; supervisors see their people; payroll and admins see what their role needs.
Nothing silently changed
Original punches are always kept. Every change records who made it, when, why and what it was before.
Who else touches the data.
No ads, no tracking cookies, and we do not sell anything about anyone.
| Service | Why |
|---|---|
| Cloudflare | Hosts Oh! Thyme and stores its data. |
| Resend | Sends the sign-in codes we email. |
| Microsoft | Signs people in, if your company uses Microsoft 365. |
| NetSuite and Paycom | Only if your company connects them, to receive approved hours. |
Questions from IT and HR.
How do people sign in?
With their work email. If your company uses Microsoft 365 they sign in with Microsoft; otherwise they get a one-time code by email, valid 10 minutes. A phone stays signed in for 30 days.
Can we require Intune-compliant devices?
Yes. Add Oh! Thyme to the allowed apps like any other mobile app.
How long are records kept?
As long as your company uses Oh! Thyme. Wage laws require employers to keep time records, so your company decides when they can be deleted.
Do you have a SOC 2 report?
Not yet. Oh! Thyme is in pre-release. Ask us anything about how data is handled and we will answer in writing.
Is California's privacy law covered?
Precise location is sensitive personal information under the CCPA. Oh! Thyme reads it only at a punch and tells people so in the app.
Questions we have not answered?
Email support@ohthyme.com and we will answer in writing.