DutyLedger — Privacy Policy

Last updated: 7 July 2026 · Operated by CRES FMS Private Limited

DutyLedger ("the app") is a workforce duty attendance app operated by CRES FMS Private Limited ("we", "us", "our"). It lets staff check in and out of their assigned work sites by scanning a site QR code, taking a photo, and confirming their location. This policy explains what personal data the app collects, why, how it is used and stored, and your rights.

DutyLedger is an employer-provided app intended only for employees and contractors of organisations that use our attendance service. It is not intended for the general public or for children.

1. Data we collect

Data	Why we collect it
Phone number	To sign you in via a one-time SMS code (OTP) and to link you to your employee record.
Precise location (GPS)	Captured only at the moment you check in or check out, to confirm you are physically at your assigned work site (geofence verification). We do not track your location in the background or when you are not using the app.
Photo (selfie)	A photo taken with the front camera at check-in to verify the identity of the person on duty.
Attendance activity	Your check-in / check-out times, the site scanned, and computed shift duration.
Device information	A device identifier and push-notification token, used to send check-out reminders and to keep your session secure.
Diagnostics / crash data	Anonymous crash reports and diagnostic logs (via Firebase Crashlytics) to keep the app stable.

2. How we use your data

Your data is used solely to:

Authenticate you and provision your access to the app;
Record and verify your attendance for your employer;
Send you reminders (e.g. if you forget to check out);
Diagnose crashes and improve reliability.

We do not sell your personal data, use it for advertising, or share it with third parties for their own marketing.

3. Where your data is stored and who can see it

Data is stored securely on Amazon Web Services (AWS) infrastructure located in India (Mumbai region) and processed via Google Firebase for notifications and crash reporting. Access is restricted to:

Your employer's authorised managers, who can view your attendance records, location at check-in/out, and selfie for verification;
Our authorised technical staff, only as needed to operate and support the service.

4. Data retention

Check-in selfies are automatically deleted after 90 days.
Attendance records are retained for as long as your employer requires them for payroll and compliance.
When your employment ends, your login access is revoked and your phone number is unlinked.

5. Security

All data is transmitted over encrypted HTTPS connections. Authentication tokens on your device are encrypted using the Android hardware-backed keystore. Photos are stored in a private, access-controlled store and are never publicly accessible.

6. Your rights

You may request access to, correction of, or deletion of your personal data by contacting us or your employer's administrator. Some records may need to be retained where required by law or your employer's payroll obligations.

7. Permissions the app requests

Location — to verify you are at your work site at check-in/out (foreground use only).
Camera — to scan the site QR code and take your check-in selfie.
Notifications — to send check-out reminders.

You can revoke any of these in your device settings; some features will not work without them.

8. Children

DutyLedger is not directed to children and is only for adults employed or contracted by our client organisations.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

10. Contact

CRES FMS Private Limited
Email: manage@cresfms.com