A clock that holds the punch
Built for the tablet by the back door on a bad connection. Punches are captured locally, survive a reload, and sync when the network comes back.
What is an offline-first time clock?
An offline-first time clock records a punch on the device the moment it happens and treats syncing to the server as a separate, retryable step. That matters for hourly work because the places people clock in — stockrooms, kitchens, basements, sites — are exactly the places connectivity fails, and a punch that depends on a live request is a punch that can be lost.
A double tap cannot become two shifts
An open punch is written to a deterministic id derived from the employee, so a second clock-in collides with the first instead of minting a duplicate. That is a structural guarantee rather than a debounce — it holds across two devices, a slow network and a stale stream.
Deterministic open-punch id: the second create collides, it does not duplicate Clock-out is idempotent, so a retry cannot double-close a shift Duplicate open punches cannot silently double-count labor cost A re-entry guard covers the double-tap and stream-lag window
The failure modes it is designed around
Each of these is a real way hourly time tracking goes wrong, and each has a specific defence rather than a disclaimer.
The network drops
The punch is written locally with a device timestamp and syncs later. No spinner, no lost shift, no “please try again” at the start of service.
Someone forgets to clock out
Paid hours are capped at 16, so a next-day clock-out stores 16h rather than 27h and cannot silently double a day of labor cost. The punch is flagged for review.
Clocks disagree
Computed hours are clamped at zero, so cross-device clock skew on a very short punch cannot produce a negative that the write rules would reject.
Punching from the car park
Optional geofencing records whether the punch happened inside the location radius, so it is on the record rather than an argument later.
Managers fix timesheets without rewriting history
Open punches surface in a review queue, and correcting one shows the paid hours it will store as you edit. Corrections use the same hour computation as the kiosk, so a corrected punch and a clean one are priced identically.
Open-punch review queue with a long-punch badge Live paid-hours preview while correcting Missing-break flags surfaced against your break rules Approval gate: only approved punches reach the payroll export
Live cost priced at the wage that was true then
Each punch stores the wage in force when it happened, so the labor-cost figures you watch during the week reflect what each hour actually cost. Payroll is deliberately different: it prices from the employee’s current wage, because that is the number you are about to pay.
Wage snapshotted onto the punch, so live labor cost reflects the rate that applied Overtime split at 1.5× per ISO week in the payroll export Workers see their own earned-so-far total from the same figures Break time deducted from paid hours, per your configured rules
Questions, answered
What happens if the device goes offline mid-shift?
Nothing is lost. The punch was recorded locally when it was taken and persists in the local cache across reloads; it syncs when connectivity returns. Clock-out behaves the same way.
Can someone clock in twice by accident?
No. The open punch uses a deterministic document id derived from the employee, so a second clock-in writes to the same place rather than creating a second shift. This holds even across two devices.
What happens if a worker forgets to clock out?
The stored paid hours are capped at 16 so the day cannot be inflated without bound, the punch is annotated to say it was auto-capped, and it is badged for manager review so the real end time can be corrected.
Does it support geofencing?
Yes, optionally per location. The punch records whether it happened within the configured radius, so the fact is captured on the record rather than relying on someone remembering.
Do corrections change what a worker was already paid?
Corrections change the recorded hours. Live labor cost and a worker’s earned-so-far figure price each punch at the wage snapshotted on it, so a later raise does not re-price earlier days in those views. The payroll export deliberately uses the employee’s current wage instead — it is the figure you are about to pay, and it should match what the employee record says today.
Which punches reach payroll?
Only approved ones. The payroll export deliberately ignores unapproved punches so an unreviewed or auto-capped shift cannot flow into a pay run unnoticed.
Explore more of Sofia
Still short after Auto-Fill? Cover is a waitlist, not a live pool.
See CoverGet a store number, or let us show you around.
$200 a store. The line is boarding. Or open a workspace and run the roster today.