A PIN Can Be Shared. A Face Can't.
Buddy punching is the oldest problem in shift work: one person walks in with two PINs. Photo clock-in closes that gap by storing one still frame with every punch at the kiosk. Be clear about what each half proves. The tablet is bolted to the wall, so it already proves the punch happened here. The photo proves who stood in front of it. Together that's the pair worth having — and it's why we never asked anyone's phone for a location. Photo capture is off by default and stays off until you switch it on for your company, then per location. It changes nothing about the timesheet: the same row, the same confirm, the same approval, with a thumbnail attached.
Snap and Go.
The queue at shift change is real. Nothing here adds a tap.
The photo is a side effect of the punch.
The camera runs as a live mirrored preview next to the PIN keypad. Tapping 'Clock in' takes the frame. There's no separate camera button, no confirm step, no retake — a retake would let someone shop for a flattering frame and weaken the record.
People see themselves being photographed.
The live preview plus one line naming what's captured, why, and who can look at it. No consent modal on a shared tablet — a pop-up on the way to the bar is not informed consent, and the notice belongs in the employment relationship.
A broken camera never stops a punch.
Permission revoked, no hardware, black frame, upload failure — the punch records without a photo and is flagged as photo-missing. Recording working time is the stronger legal duty; the evidence layer never gets to veto it.
Uploads retry in the background.
Photos queue on the tablet, retry with backoff, and survive the nightly reload. If a device's camera keeps failing, it's marked as needing attention and the location's managers get one alert — not one per punch.
One Place to Look.
Photos that nobody ever reviews are the exact thing regulators penalize. So review lives where you already work.
Thumbnails on the row you're already reading.
Open the timesheet edit page for a shift and the punch photos are there, next to the times. No second inbox, no separate photo gallery to remember to visit.
It stays marked until someone looks.
Every photo carries an unreviewed marker until a manager clicks 'mark reviewed', which stamps who and when. That stamp is your evidence that review actually happens — the marker doesn't quietly age away.
Location managers and above. Plus the person themselves.
Employees see their own photos on their own timesheet, without the review action. Nobody browses anyone else's. Review sends no notifications — the marker carries the load.
Delete It on a Schedule You Set.
You choose how long photos live — anywhere from 1 to 90 days, 30 by default. A nightly job deletes everything past that window: database rows first, stored files after, with an audit record of the counts. Storage is a private bucket with a per-tenant prefix; images are re-encoded to JPEG at 800 px with metadata stripped, and are only ever served through short-lived links.
The punch itself is never deleted. Clock times, breaks and the record that photo mode was active survive as payroll data long after the image is gone. Retention removes the picture, not the hours.
Three things you owe your team, and we can't do them for you. Give employees prior written notice before you switch this on. Be able to say why you need it — a documented buddy-punching problem, not a hunch. And review the photos for real: a stored, never-opened image is the worst of both worlds. If you can't commit to those three, leave photo mode off. PIN-only is the default for a reason.
