Clockneo
Cookie Notice
Last updated 12 October 2026
This notice explains the cookies and similar browser technologies that Clockneo uses.
Effective date
Effective from: 12 October 2026
Clockneo is supplied by Panivon Ltd, registered in England and Wales, company number 17399934, of 426 Stockfield Road, Yardley, Birmingham, B25 8JJ, England.
Contact privacy@clockneo.com about cookies and similar browser technologies.
1. What we use
Cookies, local storage, IndexedDB and service workers can store information on your device or access information already stored there.
Clockneo uses these technologies for authentication, security and the application functions you use. Clockneo does not use advertising cookies, marketing pixels, session replay or audience analytics.
2. Authentication
Clerk, Inc. supplies sign-in and session security for the Clockneo dashboard through its authentication service at clerk.clockneo.com. Kiosk PIN clocking does not use Clerk.
| Technology | Purpose | Duration |
|---|---|---|
| __session cookies on app.clockneo.com and __client_uat cookies on .clockneo.com. Either may also appear with a suffix, such as __session_ followed by an identifier | Keep you signed in and let Clockneo check that your session is valid | Persistent, so that you stay signed in. Cleared or invalidated when you sign out or when the session ends under Clerk’s session settings |
| clerk_active_context cookie on app.clockneo.com | Used by Clerk on the application host after sign-in | Session cookie. It ends when the browser session ends |
| __clerk_handshake, __clerk_handshake_nonce and __clerk_redirect_count cookies | Used while a sign-in is checked or refreshed | Short-lived. The redirect counter lasts two seconds |
| __client cookie on clerk.clockneo.com | Maintain your signed-in device with Clerk’s service and protect sign-in against abuse | Set by Clerk’s service settings. Removed or invalidated when you sign out |
Clerk’s browser library may also keep related information in local storage for the same purposes.
These technologies are strictly necessary to provide the secure sign-in you request. Clearing them signs you out.
The authentication host clerk.clockneo.com can also store __cf_bm and _cfuvid after sign-in. __cf_bm is short-lived. _cfuvid lasts for the browser session. These cookies are on that host, not on the Clockneo application domain.
3. Kiosk authentication
| Technology | Purpose | Duration |
|---|---|---|
| stafftrack_kiosk_session cookie | Authenticates a kiosk device that an authorised person has activated | Up to 180 days, unless revoked or replaced sooner |
The kiosk cookie is HTTP-only, uses the /kiosk path and is sent securely in production. Removing it prevents the device from continuing as an authenticated kiosk until set up again.
4. Live updates, notifications and browser storage
Live updates. When an authorised user opens the dashboard or the live operations screen, Clockneo connects the browser to Google Firebase to receive update signals. The browser signs in to Firebase with a Clockneo-issued token linked to the user’s Clockneo account, organisation and role. The signals contain an event type and internal identifiers for the organisation, the location and the changed record, but no names, times or other workforce details.
The Firebase library may store that sign-in in the browser’s IndexedDB, in a database named firebaseLocalStorageDb, and may keep a small record of library use in firebase-heartbeat-database, which it sends to Google with its requests. These entries remain until the library removes them or you clear site data.
Browser notifications. If you enable browser notifications, Clockneo and Firebase use the information needed to register the device and deliver notifications. Firebase may create further IndexedDB databases for this, named firebase-messaging-database and firebase-installations-database.
Clockneo stores local-storage entries beginning clockneo:push: for the device token, the last reconciliation time and a disabled preference associated with the signed-in identity. Local storage has no automatic browser expiry; entries remain until the application removes or replaces them or you clear them through browser controls.
Turning notifications off stops them, removes Clockneo’s registration of the device and removes the stored token entries. Some Firebase library storage can remain until you clear site data. You can also change notification permission in your browser. Browser permission is distinct from the employer’s lawful basis for workforce processing.
5. Service worker and application storage
Clockneo registers a service worker, /firebase-messaging-sw.js, when you open the application, a kiosk or the kiosk setup page. It receives and displays browser notifications if you have enabled them and opens Clockneo when you select a notification. It does not store pages or data in CacheStorage.
Your browser keeps the registration until you clear site data or uninstall the app. Ordinary browser caching of web pages is separate and controlled by your browser.
Clearing site storage or uninstalling the app can remove this information and may require you to sign in or register a kiosk again.
6. Maps and address lookup
The initial public service does not embed a third-party map and does not send addresses to an external lookup provider. Clockneo does not make those requests for an organisation whose service does not include them.
Where a separate arrangement includes a map preview, the geofence settings page can show a map embedded from OpenStreetMap. Loading it sends the browser’s IP address, browser information and the map area to the OpenStreetMap Foundation’s map service, which applies its own privacy policy and may use its own technologies. Clockneo does not send a referrer or workforce information with that request.
Where a separate arrangement includes address search or UK postcode lookup, those lookups are carried out by Clockneo’s server, so those providers do not place technologies in the browser. The initial public service does not include them.
An external map link, if you choose to follow it, opens the provider’s website, which applies its own notice and controls.
7. Stripe-hosted payment pages
Checkout and the Billing Portal operate on Stripe-hosted pages. Stripe uses technologies for payment, authentication and fraud prevention and describes them in its own cookie information.
We do not use Stripe payment pages to introduce Clockneo advertising tracking.
8. Choices and changes
We assess each technology against the applicable rules. Describing storage as “functional” does not automatically make it exempt from consent.
Where storage is strictly necessary for a service you request, we use the applicable exception. Where consent is required, the technology must remain blocked until valid consent is obtained. We do not introduce such technologies merely by updating this notice.
You can clear cookies and site data through your browser. Doing so may sign you out, remove a kiosk session or disable requested functions.
We will update this notice when the technologies or purposes materially change.