Privacy

The short version

Sellers don't see you until one selects your bid. Photos can't be screenshotted in the app. Location is used only to search and to confirm you arrived, never in the background. Messages disappear 48 hours after a meeting. No ads, no data sales, and your ID is never stored here. Delete your account any time, in the app.

What we collect, and why

Your account. Your email address, to sign you in with a one-time code and to send you a receipt or a confirmation. Your name, title, company or affiliation, one link, an optional two-line bio, and a photo, which sellers see only after they select your bid. Sellers add a public listing: a display name, a photo, credentials, offers, and a city.

Payments. Card details go to Stripe, our payment processor. Clockr keeps the last four digits and the card brand for receipts, and a Stripe identifier for the card you chose as your default. Clockr never sees a full card number. Sellers are paid through Stripe Connect; the bank details they enter go to Stripe.

Location. With your permission, the app uses your phone's location for two things: to find sellers near you when you browse, and to confirm you arrived at the venue when you tap "I'm here" on meeting day. That arrival tap records your position, its accuracy, and the time, and keeps it with the meeting's records. The app never uses location in the background, and you can pick a city by hand instead of sharing your location at all.

Identity verification. Sellers verify their identity before they can list. Buyers may verify to lift the card limit on a first meeting. Verification is run by Stripe Identity: you photograph a government ID and take a selfie, and Stripe compares the two. That comparison uses facial geometry, which is biometric information. It happens only after you agree to it in the app, and only Stripe processes and stores the images. Clockr receives the result (verified or not, and whether you are 18 or over), the name on the document, and a one-way hash of the document number that lets us keep a banned person from coming back. Clockr never receives or stores the images, the document number, your date of birth, or your address. Stripe keeps verification data under its own privacy policy and deletes it on our request when your account is purged.

Meetings. Bids, bookings, the venue and time, both arrival taps, the meeting code entry, payments, refunds, and ratings. These are the records of what was agreed and what happened, and they are what we show a card network if a charge is disputed.

Messages. Chat is open after a meeting is confirmed, for logistics. Messages are encrypted at rest and deleted 48 hours after the meeting, unless one of you reports a message or opens a dispute, in which case the thread is kept until that is closed. Clockr staff read messages only while a dispute or a report is open.

Device. The app version and, if you allow notifications, a push token so we can tell you about a bid, a confirmation, a reminder, or a message. Notifications never carry names or amounts.

Errors. If something breaks, the app and our servers send an error report to Sentry with the request's details scrubbed of email addresses and identifiers.

What we never do

No advertising, no analytics vendors, no selling or renting of data, no access to your contacts, no background location. Buyer profiles are never public and never indexed by search engines. Ratings are shown only as an average after five ratings, never as a count and never with text. Counts, strikes, and decline rates are seen only by the Clockr team.

Who sees what

A seller's listing is public on the web when the seller allows it. A buyer is anonymous to a seller until the seller selects the buyer's bid, or from the start when the buyer chooses "Show who I am". After a meeting is confirmed each side sees the other's name and photo, and, if the two differ, the name on the other person's ID. Stripe sees what it needs to move money and verify identity. Resend delivers our email. Amazon Web Services hosts everything. Nobody else gets your data unless the law requires it.

How long we keep things

Messages: 48 hours after the meeting. Meeting records used for chargeback defense, including arrival positions: 180 days after the meeting, longer while a dispute is open. Bookings, bids, payments, and ratings: kept, because they are money records, but detached from your name when your account is purged. Reports: 24 months after they are closed. Error reports: 90 days. When you delete your account you have 30 days to change your mind; after that your name, email, photo, and profile are removed, your Stripe Identity session is deleted at Stripe, and your bank and card details stay only with Stripe under its own policy.

Your choices

Block anyone. Report any profile or message. Turn location and notifications off in Settings. Delete your account from the Privacy screen in the app. Ask us anything at [email protected].

Effective September 9, 2026. Clockr is for adults 18 and over and operates in the United States.