Privacy Policy – TEMPUS by Jurist Soft (Android)

Effective date: 13.09.2026
Application name: TEMPUS BY JURIST SOFT
Version: 1.2.0+23 (Android)
Company: Jurist Soft doo Niš, Republic of Serbia
Contact: contact form at juristsoft.com
Privacy Policy URL: https://juristbiro.com/en/tempus/privacy-policy/android
Platform: Android

Introduction

This Privacy Policy explains how Jurist Soft doo Niš, Republic of Serbia ("we", "us", or "our") collects, uses, stores, and protects information processed through the TEMPUS BY JURIST SOFT Android mobile application (hereinafter referred to as "TEMPUS" or the "Application").

TEMPUS is a business-to-business application intended for employee working time and attendance records. The Application is used by employees whose employer has registered them in the TEMPUS system.

The Application is not intended for public consumer use. Access is provided only to authorized users through their employer.

Operating System Permissions and Data Safety Label

TEMPUS uses the Android permission system. For sensitive permissions, the operating system displays a dialog before the corresponding device feature is accessed for the first time. The user may deny a permission or revoke it later in the device settings; in that case, the function that depends on that permission will not be available. The Application declares the following permissions:

• Camera (CAMERA) — for scanning the QR code at the workplace and/or local biometric face verification;
• Precise and approximate location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) — to confirm that the user is at the permitted work location when checking in/out, and to show the user's position relative to the work zone while the Application is open;
• Nearby devices (BLUETOOTH_SCAN, BLUETOOTH_CONNECT) — to recognize the proximity of the Bluetooth beacon placed at the workplace;
• Biometrics (USE_BIOMETRIC, USE_FINGERPRINT) — to confirm the user's identity using the operating system's built-in biometric authentication, when that function is enabled;
• Notifications (POST_NOTIFICATIONS) — for the workplace-proximity notification offering a quick check-in/check-out, and for reminders set by the user;
• Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_LOCATION) — to recognize the proximity of the Bluetooth beacon even when the Application is not open; while this service is running, the operating system displays a persistent notification;
• Exact alarms and device start-up (SCHEDULE_EXACT_ALARM, RECEIVE_BOOT_COMPLETED) — so that reminders set by the user (shift start and end, wake-up) are shown at the exact time and also after the device restarts;
• Network access (INTERNET, ACCESS_NETWORK_STATE), vibration (VIBRATE) and keeping the device awake (WAKE_LOCK) — for communication with the server, detecting offline operation, and reliably showing reminders.

The Application does not request background location access (ACCESS_BACKGROUND_LOCATION), nor permission for the microphone or the advertising identifier (Advertising ID).

The application on Google Play additionally displays a standardized data disclosure ("Data Safety") summarizing the categories of data described in this Privacy Policy. This disclosure must at all times correspond to the content of this Privacy Policy.

2. Information We Collect

TEMPUS may collect and process the following categories of information:

2.1 Login Information

The Application processes:

• Email address entered by the user during login;
• Password entered by the user during login (transmitted securely and not stored locally);
• JWT authentication token stored locally on the device using encrypted storage;
• Refresh token stored locally on the device using encrypted storage.

The JWT token is used to authenticate the user and maintain secure communication with the employer's backend system. The refresh token is used to renew the authentication session without requiring the user to log in again.

So that quick check-in/check-out from the workplace-proximity notification (section 2.6) also works when the Application is not open, a copy of the short-lived JWT token is additionally stored in the Application's private storage on the device (SharedPreferences), which is not additionally encrypted. This copy is deleted upon logout. The refresh token is stored exclusively in encrypted storage.

2.2 Device Identifier

TEMPUS processes the Android device identifier (ANDROID_ID) to link a specific employee account to a specific device. ANDROID_ID is a value assigned by the Android operating system; it is unique to the combination of the device, the device user, and the application's signing key, and it changes when the device is reset to factory settings. ANDROID_ID is distinct from the advertising identifier (Advertising ID); TEMPUS does not access or use the advertising identifier.

The device identifier is:

• Stored locally on the device in encrypted secure storage;
• Transmitted to the employer's backend server when the user completes biometric enrollment or submits a biometric reset request, for the purpose of device binding and security verification.

The device identifier is used exclusively for device binding purposes — to ensure that only authorized devices may be used to access an employee account. It is not used for advertising, profiling, or any other purpose.

Additionally, a local integrity hash (SHA-256 of the device identifier combined with the user identifier) is stored on the device for internal consistency verification. This hash is not transmitted to any server.

2.3 Use of the Camera

TEMPUS may use the device camera for two separate purposes, depending on the employer's settings: (i) scanning a QR code generated by a terminal device at the workplace, to confirm presence — in this case the camera only reads the content of the code (location, time, hash value), and no photographs or video are captured or stored; and (ii) capturing a selfie photograph for biometric identity verification, described in section 2.4 below.

2.4 Biometric Data

Depending on the employer's policy and device capabilities, biometric verification may be enabled. Two modes are supported:

Mode A — ML Kit Face Recognition

In this mode, the Application processes:

• A selfie photograph of the user's face captured during initial enrollment;
• A face embedding — a numerical vector representation of the user's facial features, generated locally using Google ML Kit and a TensorFlow Lite model (MobileFaceNet).

The selfie photograph and face embedding are stored exclusively on the user's device, in encrypted form (see "Data Storage and Security"). They are not transmitted to the employer's server or to any third party.

During each check-in, face recognition is performed locally on the device. Only the result of the verification (a boolean value indicating whether the verification was successful) is transmitted to the employer's backend server.

Mode B — OS Biometric Authentication (Fingerprint / Face Recognition)

In this mode, the Application uses the Android device's built-in biometric authentication mechanism (BiometricPrompt — fingerprint or face recognition, depending on the device). No biometric photograph or face embedding is stored by the Application. Authentication is handled entirely by the operating system, and only the result (success or failure) is used by the Application.

In both modes, biometric data is used solely for identity verification during attendance registration.

2.5 GPS Location

TEMPUS may use the device's precise GPS location at the moment the user attempts to record a check-in or check-out, in order to verify whether the user is located within the permitted work zone determined by the employer. In that case, the GPS coordinates (latitude, longitude, and accuracy) are transmitted to the employer's backend server for server-side work-zone verification. The same applies when the user confirms a check-in or check-out using the button in the workplace-proximity notification (section 2.6): the location is then read once, at the moment of that action.

While the Application is open, the device location may be processed locally to show an indicator of whether the user is within the work zone and to show the user's position on the work location map. This data is not sent to the server.

TEMPUS does not use GPS to continuously track the employee's movement and does not collect GPS location in the background when the user has not actively initiated a check-in/check-out action. The Application does not request background location access.

2.6 Bluetooth and BLE Proximity Detection

TEMPUS may use Bluetooth Low Energy (BLE) to detect the proximity of the corresponding beacon device placed at the work location, as technical proof that the user's device is in the immediate vicinity of that location. This function may operate even when the user is not actively using the Application (in the background), through a foreground service during which the operating system displays a persistent notification, to the extent permitted by the device's operating system and when the user has granted the necessary permissions. Proximity detection stops upon logout.

When the corresponding beacon is detected, the Application may display a local notification offering a quick check-in or check-out. During this detection, only technical beacon data (identifier, major/minor values, signal strength – RSSI) is processed locally; no GPS coordinates are collected, and the user's movement is not continuously tracked.

When the user confirms a check-in or check-out, the technical beacon data (identifier, major/minor values, signal strength, and time of reading) is transmitted to the employer's backend server as proof of proximity to the workplace, together with the check-in or check-out event.

2.7 Working Time and Attendance Data

The Application processes working time and attendance data, including:

• Check-in time and check-out time;
• Break start and end times;
• Shift type;
• Date of work activity;
• Data on the presence-verification method used for the specific event (QR code, Bluetooth beacon, and/or GPS location, in accordance with sections 2.3, 2.5, and 2.6);
• Biometric verification result (boolean) associated with the check-in event, when that function is enabled;
• A unique client request identifier (UUID) used to ensure idempotent processing of offline records;
• Timestamp of the recorded event.

This data may be temporarily stored locally in an SQLite offline queue and synchronized with the employer's backend server when internet connectivity is available. Locally stored offline records are automatically deleted after a maximum of 45 days.

2.8 Workflow Requests

When enabled by the employer's policy, the Application allows employees to submit workflow requests, such as:

• Notification of late arrival;
• Notification of inability to attend work;
• Request for early departure;
• Absence request.

These requests, including the request type, reason, and relevant time information, are transmitted to the employer's backend server.

2.9 Firebase Analytics Data

TEMPUS uses Firebase Analytics to collect application usage data, such as:

• General usage patterns;
• Technical identifiers generated or used by the Firebase SDK for its own analytics purposes.

TEMPUS does not forward the employee's first and last name, e-mail address, working time records, GPS coordinates, or local biometric data to Firebase Analytics. Firebase Analytics data is used to improve the stability, usability, and performance of the Application and is not used for advertising or marketing profiling of employees.

2.10 Firebase Crashlytics Data

TEMPUS uses Firebase Crashlytics to collect crash reports, including:

• Stack traces;
• Device type and model;
• Operating system version;
• Application version;
• Technical environment information (deployment environment identifier, API host).

No personally identifiable information is transmitted to Firebase Crashlytics. Crash reports are used only for diagnosing and fixing technical errors.

2.11 Sentry (Error Diagnostics and Performance Monitoring)

TEMPUS uses Sentry for error diagnostics and application performance monitoring, including a session-replay feature. The camera is explicitly masked within the session replay before being sent to Sentry, while text inputs and image displays are masked in accordance with Sentry's default behaviour.

After the user logs in, the internal user identifier and the account's e-mail address are attached to error reports in Sentry, so that an error reported by a specific employee can be located and fixed. This link is removed upon logout. Sentry is not used for advertising or for tracking users beyond the purpose of technical diagnostics.

2.12 Failed Request Log (Firebase Cloud Firestore)

When a request sent by the Application to the employer's backend server fails, the Application may write a technical record of that failure to the Firebase Cloud Firestore service. The record contains: the internal user identifier, the request address and method, the server's status code and error message (truncated to a maximum of 500 characters), the content of the failed request, the device manufacturer and model, the operating system version, the application version, and the time. The content of the failed request may include data described in sections 2.5–2.8 (e.g., GPS coordinates and beacon data accompanying a check-in/check-out, or the text of a workflow request). The password is never recorded. These records are used solely for diagnosing and fixing technical problems.

2.13 Data Not Collected by TEMPUS

TEMPUS does not access the device microphone.

TEMPUS does not collect advertising identifiers (advertising ID) and does not use them for advertising.

TEMPUS does not sell personal data to third parties.

TEMPUS does not use GPS location or Bluetooth proximity detection for continuous tracking of the user's movement beyond the purposes described in sections 2.5 and 2.6.

How We Use Your Information

We use the collected information for the following purposes:

• To authenticate authorized users and maintain secure sessions;
• To allow employees to record working time and attendance via QR code, Bluetooth beacon, and/or GPS location, depending on the employer's settings;
• To verify whether the employee, at the moment of check-in/check-out, is located within the permitted radius of the workplace (when GPS verification is enabled);
• To verify employee identity when biometric verification is enabled, using locally processed data;
• To prevent unauthorized use of employee accounts through device binding;
• To synchronize offline attendance records with the employer's backend server;
• To process employee workflow requests (such as absence or late arrival notifications);
• To show reminders set by the user;
• To maintain Application security and data integrity;
• To diagnose and fix crashes and technical errors (including via Firebase Crashlytics, Sentry, and the failed request log);
• To improve the Application's functionality and user experience;
• To allow employees to request a password reset;
• To allow employees to submit and manage account deletion requests;
• To comply with legal, contractual, and employer record-keeping obligations.

We do not use personal data for advertising purposes.

We do not sell personal data.

Data Storage and Security

TEMPUS applies technical measures to protect user data on the device:

• JWT and refresh tokens are stored in encrypted secure storage (FlutterSecureStorage), whose keys are protected by the Android Keystore system; the exception is the copy of the JWT token described in section 2.1;
• The device identifier (ANDROID_ID) and the device binding integrity hash are stored in encrypted secure storage;
• The selfie photograph is encrypted using AES-256-CBC encryption before being written to the device storage; the encryption key is generated per device and stored in encrypted secure storage;
• The face embedding is stored in encrypted secure storage;
• An SHA-256 integrity hash of the selfie photograph is stored in encrypted secure storage and used to detect unauthorized modification of the biometric data file;
• Working time records temporarily stored in the local offline queue are held in an SQLite database on the device and automatically deleted after 45 days;
• Automatic backup of Application data (Android backup) is disabled.

Communication with the employer's backend server is performed over HTTPS. Cleartext HTTP traffic is not permitted by the Application's network security configuration.

Access to backend data is restricted to authorized systems and authorized employer representatives, depending on their role and permissions.

The backend infrastructure used by the JuristBiro platform, of which TEMPUS is a module, is hosted on Amazon Web Services (AWS) servers located in Frankfurt, Federal Republic of Germany. Germany is a member state of the European Union and a party to the Council of Europe Convention 108 on the protection of individuals with regard to automatic processing of personal data. Accordingly, under Article 65 of the Serbian Law on Personal Data Protection, Germany is considered to provide an adequate level of data protection, and the transfer of data from Serbia to Germany does not require any additional authorization or safeguard mechanism. Should the server location change, the Service User (the employer) will be notified in advance, together with the applicable legal basis for such transfer.

Although we apply appropriate security measures, no method of electronic transmission or storage is completely secure. We continuously work to maintain and improve the security of the Application.

Third-Party Services

TEMPUS uses the following third-party services:

Firebase Analytics

Firebase Analytics is provided by Google LLC and is used to collect usage data for Application improvement. The user's name, e-mail address, or other data that directly identifies the user is not shared with Firebase Analytics.

Firebase Crashlytics

Firebase Crashlytics is provided by Google LLC and is used to collect crash reports and technical diagnostics. No personally identifiable information is shared with Firebase Crashlytics.

Firebase Cloud Firestore

Firebase Cloud Firestore is provided by Google LLC and is used to store the failed request log described in section 2.12.

Google ML Kit (Face Detection and QR Code Scanning)

Google ML Kit is used locally on the device for face detection during biometric enrollment and verification and for reading QR codes. ML Kit processing occurs entirely on the device. Images, biometric data, and QR code content are not transmitted to Google. In accordance with the ML Kit terms of use, ML Kit may send Google technical data about the operation of the library itself (e.g., device model, application version, performance, and errors).

TensorFlow Lite

A TensorFlow Lite model (MobileFaceNet) is used locally on the device to generate face embeddings during biometric enrollment and verification. Processing occurs entirely on the device. No biometric data is transmitted to Google or any third party.

Sentry

Sentry is used for error diagnostics and Application performance monitoring, including a session-replay feature with explicit masking of the camera and Sentry's default masking of text and images, described in section 2.11.

OpenStreetMap

To display the work location map, the Application downloads map sections (tiles) from OpenStreetMap Foundation servers. In doing so, that server sees the device's IP address and which part of the map is displayed; the user's GPS coordinates are not sent to it.

These services may process technical information in accordance with the respective provider's own privacy and security policies.

TEMPUS does not share working time data, biometric data, or personally identifiable information with third parties for marketing or advertising purposes.

Working time data is transmitted to the employer's backend system for attendance management purposes and is not shared with any other third parties, except within the failed request log described in section 2.12.

Your Rights

If you are located in the European Union, European Economic Area, or another jurisdiction with similar data protection laws, you may have the following rights under applicable data protection regulations, including the GDPR:

• Right of access to your personal data;
• Right to rectification of inaccurate personal data;
• Right to erasure of personal data;
• Right to restriction of processing;
• Right to data portability;
• Right to object to certain processing activities;
• Right to withdraw consent where processing is based on consent;
• Right to lodge a complaint with a competent data protection authority.

Because TEMPUS is used in an employment context, some data may be controlled by your employer. To exercise your rights, you should contact your employer directly.

You may also contact us through the contact form at juristsoft.com.

We may need to verify your identity before responding to your request.

We will respond to your request without undue delay, and in any event within 30 (thirty) days of receipt of the request, in accordance with Article 12 of the GDPR and the corresponding provisions of the Law on Personal Data Protection of the Republic of Serbia. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; in such case we will inform you of the extension and the reasons for the delay within the initial 30-day period.

Account Deletion

The Application provides a built-in account deletion request feature. You can access it from the Application settings. Upon confirmation, a deletion request is submitted to the employer's backend system. You will receive information about the scheduled deletion date. You may cancel the deletion request before it is processed.

The Application offers two types of logout. "Logout only" removes the tokens from the device (including the copy of the JWT token) and stops beacon proximity detection, while biometric data, device binding, and offline records remain stored for a faster return on the same device. "Logout + reset device" additionally removes biometric data, device binding, and offline records. Uninstalling the Application removes all of its locally stored data.

Alternatively, users who have uninstalled the Application or cannot access it can initiate an account and data deletion request from the web through the contact form at juristsoft.com. Upon receiving the request, we will verify the user's identity and coordinate with the respective employer to process the deletion.

Data Retention

Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy.

Working time and attendance records may be retained in accordance with applicable employment, accounting, tax, and labor law obligations, or according to the employer's internal retention policies.

Biometric data (selfie photograph and face embedding) is stored locally on the device only for as long as necessary for identity verification during the user's active enrollment period. It is permanently removed from the device when "Logout + reset device" is selected, when the employer revokes the user's biometric enrollment, upon re-enrollment, or when the Application is uninstalled.

Locally stored offline working time records are automatically deleted from the device after a maximum of 45 days.

Tokens are removed from the device upon every logout. Device binding data, biometric data, and offline records are removed from the device when "Logout + reset device" is selected or when the Application is uninstalled.

Users may request deletion of their data by using the in-app account deletion feature, by contacting their employer, or through the contact form at juristsoft.com.

Children's Privacy

TEMPUS is not intended for children. The Application is intended only for employees registered by their employer.

We do not knowingly collect personal data from children. If we become aware that data from a child has been processed through the Application, we will take appropriate steps to delete such data, unless retention is legally required.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Application, legal requirements, security practices, or business operations.

When we update this Privacy Policy, we will revise the effective date at the top of this document and increment the policy version.

Users will be notified of significant changes through the Application's in-app disclosure screen, which requires renewed acceptance upon each material change. This applies in particular to the introduction of new presence-verification methods, which will not be activated without a prior update of this Policy and a corresponding notice.

Contact Us

For questions about this Privacy Policy or the processing of personal data, please contact:

JURIST SOFT DOO NIŠ

Aleksandra Medvedeva bb

18000 Niš

Republic of Serbia

Contact form: juristsoft.com/contact

Web: www.juristsoft.com

Privacy Policy URL: https://juristbiro.com/en/tempus/privacy-policy/android