Staff often clock in where there is no signal, such as a basement car park. So the app never waits for the network: every clock-in and clock-out is saved on the phone first, then sent to the server in the background.
The main rule: a punch is never lost. A failed upload, a missing selfie, or a closed app must not erase a clock-in or clock-out.
The time is taken when the button is pressed, not when the selfie finishes. Otherwise the camera would push every punch a minute or two later.Each session gets an ID on the phone before it is saved. A retry of the same punch is recognised by this ID, so it never creates a second session.Times and location are sent before the selfie. A selfie that fails to upload never stops the times from being recorded.The saved punches are kept in a small database on the phone, together with the selfie files.
When the app starts, and when the staff member signs in.When the app comes back to the foreground.Every 60 seconds while the app is open.Only one send runs at a time. If a new punch is saved while a send is running, the app runs one more send straight after, so the new punch is not left behind.
That last rule was added after a real case on 24 Aug 2026: a clock-out made with good signal only reached the server the next morning, after the employee had already been flagged and reminded for a missed clock-out.
The server refused it. It is not retried automatically unless the reason is known to clear up by itself.
needs_review
The times are recorded, but the selfie is missing. HR can review it.
A punch refused because "an active attendance session already exists" is put back to pending automatically. It usually clears once the earlier session reaches the server.A saved clock-in with no clock-out is marked as a missed clock-out on the phone when it passes the same reset deadline the server uses. See Attendance.The app sends saved punches first and only then asks the server to flag expired sessions, so a clock-out it is still holding is never reported as missed.The app also reports each punch's sync status to the server, so problems can be monitored centrally.