Twinfusion GPS Attendance
Management System

Part 1Administrator

The web dashboard, used in the office. This part assumes you have an administrator or manager account.

1.1 Signing in

1. Open https://twinfusion.co.ke/attendance/admin/ in a browser.
2. In Email or employee ID, type your email address or your employee code.
3. Type your Password.
4. Press Sign in.

If your sign-in belongs to more than one workspace, the page comes back asking which one to open. Pick it from the Workspace list, type your password again, and press Open workspace. The password is asked for a second time because it is never held between steps.

After eight failed attempts the account is locked for fifteen minutes and you will see Too many failed attempts. Try again in 15 minutes. Wait it out; there is no way to shorten it.

Signing out

Your name sits at the bottom of the dark sidebar on the left. Press the power symbol beside it. Always do this on a shared computer.

1.2 Finding your way around

The sidebar on the left is the whole dashboard. Everybody who can sign in sees:

• Dashboard — today at a glance, and the exceptions that need a decision.
• Live map — everyone currently clocked in, on a map.
• Timesheets — the record of hours worked. Corrections happen here.
• Directory — the people.
• Locations — the sites and their geofences.

Administrators and super administrators also see:

• Devices — the shared handsets that clock people in by face.
• Automations — automatic rules and the organisation's attendance settings.
• Plan & billing — the subscription.

Below the menu, departments are listed as a tree. Clicking a department opens Timesheets already filtered to it. A number beside Timesheets is the count of attendance records waiting for a decision.

The bell at the top right is your inbox. Open it to read alerts; press Mark all read to clear the badge.

1.3 The Dashboard

This is the page that opens when you sign in. It answers one question: what needs my attention today?

The date

The date box at the top left changes the whole page. Pick a past date to see that day. Back to today returns you.

The five tiles

• Attendance rate — how many of the headcount checked in.
• Currently clocked in — people on shift right now.
• Late arrivals — people who checked in past their shift's grace period.
• Out of bounds — people who checked in outside a geofence.
• Hours logged — total hours, with overtime underneath.

The three live tiles refresh by themselves every 30 seconds. You can leave the page open on a wall screen.

Exceptions & alerts

The list at the bottom is the working part of this page. Every row is somebody whose day needs a decision — late, outside the fence, a suspicious location reading, or a shift that was never closed. A row marked Awaiting review is waiting on you.

Each row carries the buttons that settle it:

1. Approve accepts the record as it stands. It is marked approved with your name against it.
2. Reject asks "Why is this being rejected?" You must type a reason — cancelling the box cancels the rejection.
3. Add note attaches a comment to the record without deciding it either way.
4. Timesheet opens that person's full timesheet.

See all in Timesheets at the top right of the panel opens every flagged record for that day.

1.4 Live map

Everyone clocked in, listed on the left and pinned on the right. The two are the same list. Both repaint every 20 seconds.

• A pin is purple normally and red when the check-in landed outside its fence.
• A pin fades when the phone has not reported a position for 30 minutes; the roster row shows No ping 30m+.
• Each row shows the check-in time, how long they have been on shift, the site, and the phone's battery level when it was reported.
• Fit all zooms out to show everybody.
• Manage sites jumps to Locations.

Blue outlines on the map are the site geofences. A worker inside one is where they should be.

1.5 The Directory

The people. It has two views and you switch between them at the top left.

Board view

Four columns, one for each stage of joining: New registration, Pending ID verification, Active employee, Offboarded. Each card shows the person's name, employee code, job title, department, their employment type, and an On shift tag if they are clocked in right now.

Drag a card into another column to move that person's stage. The change saves immediately and a message confirms it. Drag it back to undo.

List view

A dense table: employee, employee ID, department, team, manager, employment type, number of sites, stage, account status, and when they were last seen. Two buttons sit at the end of each row — Edit and Timesheet.

Searching

1. Type into the box marked Name, employee ID or email.
2. Press Search.
3. Press Clear to go back to the full list.

Opening somebody's profile

Click anywhere on a card or a row — not on a button — and a panel slides in from the right. It shows:

• Four figures for this month: days worked, hours worked, late days and fence breaches.
• Contact and employment details, including when they last signed in.
• Postings — the sites they are attached to, current and ended, with hours worked at each.
• Recent attendance — their last days, with in, out, hours, status and whether the check-in was inside the fence.
• Devices — the phones that have paired with their account.

The buttons along the bottom of the panel are Delete permanently, Remove, Reset password, Edit and Done. They are covered below.

1.6 Adding an employee

1. Open Directory.
2. Press Add employee at the top right.
3. Type the Full name. This is the only field that must be filled in.
4. Leave Employee ID blank and the system allocates the next one (EMP0001, EMP0002 and so on). Type one only if your payroll already uses a particular code.
5. Fill in Email and Phone if you have them. Neither is required.
6. Set the Job title and the Role — Employee, Manager or Administrator.
7. Set Employment type: Office, Field, Hybrid or Casual / daily.
8. Choose a Department, a Team and who they Report to, if those apply.
9. Choose a Shift. Leave it on — Organisation default — unless this person works different hours; the shift is what decides whether an arrival counts as late.
10. Set Joined on and the Onboarding stage.
11. Temporary password — leave it blank and one is generated for you.
12. Under Attendance policy overrides, switch on anything that should apply to this person only: Require a selfie at check-in, Allow check-in outside a geofence, Track route while on shift. Leave them off to use the organisation's settings.
13. Under Assigned locations, tick every site this person works at. The first one you tick becomes their primary site.
14. Press Create employee.

1.7 Editing an employee

1. In list view, press Edit on their row. Or open their profile and press Edit at the bottom.
2. Change what you need to.
3. Press Save changes.

Two fields appear only when editing:

• Engaged until — for casual engagements. Clear it to make the engagement open-ended.
• Account status — Active, Suspended or Archived. Suspending or archiving signs the person out of every device immediately.

Employee ID, Shift and Temporary password disappear when editing — they are set at creation.

Resetting a password

1. Open the person's profile.
2. Press Reset password and confirm.
3. The new password is shown once. Copy it and give it to them.

Every signed-in device for that person is signed out at the same time.

1.8 Postings: adding and ending

A posting attaches somebody to a site. It is what allows them to check in there, and it is the record that explains, months later, why their punches at that site were accepted.

Adding a posting

1. Open the person's profile.
2. Find the Postings section and press Add posting.
3. A numbered list of locations appears. Type the number of the one you want and confirm.

Ending a site posting

Use this when someone finishes at a site but stays employed.

1. Open the person's profile.
2. In Postings, press End on the row for that site.
3. A box asks for the end date and offers today. Accept today to stop check-ins immediately, or type a different date.
4. The confirmation names the hours kept, for example: "Posting to Kitengela Yard ends 2026-09-01. 146h 20m of recorded work there is retained."

The posting stays on the list, greyed out and tagged ended. That is deliberate: attendance at a site somebody is no longer posted to would otherwise look unexplained. Press Re-post to put them back.

Deleting a posting

A small ✕ appears beside a posting only when nobody has worked any hours against it. That is for a posting added by mistake. Once there are hours the button is not offered, and the system refuses: This posting has 12 attendance records against it, so it cannot be deleted. End it instead — that keeps the history and stops future check-ins.

1.9 Removing someone

Remove takes a person out of the directory. It is the correct action for almost everybody who leaves.

1. Open the person's profile.
2. Press Remove.
3. Read the confirmation: "They are signed out everywhere and their postings end. Every hour they worked is kept and stays payable, and you can restore them later."
4. Confirm.

What actually happens:

• The account is archived and hidden from the directory.
• Every signed-in device for them is signed out.
• Every posting is ended.
• Every recorded hour is kept. The confirmation message names the total, for example "312h 45m of recorded work is retained and still payable."
• If they were still clocked in when you removed them, the message tells you to close that shift under Timesheets.

Two removals that are refused

• Your own account: You cannot remove your own account.
• The last active administrator: This is the last active administrator. Promote somebody else first, or nobody will be able to sign in and manage the organisation.

Permanent deletion

Delete permanently is the last button on the profile and the least prominent, because it is nearly always the wrong one.

1. Open the profile and press Delete permanently.
2. A box asks you to type DELETE in capitals. Anything else cancels.

1.10 Locations and geofences

A location is a site with a boundary drawn around it. That boundary is the geofence. A check-in inside it is normal; one outside it is flagged, and may be refused.

The page shows your sites down the left and a map on the right. Click a site card to load it into the editor.

Creating a geofenced site

1. Open Locations and press Add location.
2. Type the Name — what your people call the place, not what the map calls it.
3. Fill in the Address if you want it on record. It is free text and is not used to position the fence.
4. Find the place. In Find by address or place type at least three characters — a street, an estate, a landmark — and press Search or the Enter key. Pick a result and the pin drops there. See below for the detail.
5. Set the Type: Office, Client site, Warehouse or Remote. This is a label only; it does not change how the fence behaves.
6. Choose the Fence shape — Circle (pin + radius) or Polygon (drawn ring).
7. For a circle: the pin is the centre. Drag the Radius slider, or type an exact figure in the box below it. The slider runs to 2,000 m; typing allows anything from 10 m to 20 km.
8. For a polygon: click the map at each corner of the site. You need at least three. Undo point removes the last one; Clear starts the ring again.
9. Set Max GPS accuracy (m) — the default is 75. A position reading blurrier than this is rejected rather than trusted.
10. Pick a Map colour so this site is easy to pick out.
11. Tick any departments and teams that should be posted here. Everyone in them can then check in at this site.
12. Press Create location.

Circle or polygon?

For a circle, distance is measured from the edge of the ring. A worker reading 130 m from the centre of a 120 m fence is 10 m outside — and that is what the breach will say.

Searching for an address

1. Type at least three characters into Find by address or place.
2. Press Search, or the Enter key. Enter will not save the form — it only runs the search.
3. Pick a result from the list. The pin drops there, the latitude and longitude fill in, and the map zooms to it.
4. If you left Name or Address blank, they are filled in from the result. Anything you typed yourself is left alone.
5. Drag the pin, or click the map, to fine-tune the position.

The search tells you what it found:

• "Type at least three characters of the address to search." — the query is too short.
• "Nothing matched that. Try a nearby landmark or town, or click the map instead."
• "The address lookup service could not be reached. Click the map or type the latitude and longitude instead — the location will save either way."

Editing a location

1. Click the site's card in the left-hand list. The editor opens with its fence drawn.
2. Wait a moment. Save changes stays greyed out until the current department and team assignments have loaded, and the tick boxes are locked until then.
3. Make your changes and press Save changes.

Taking a location out of use

1. Open the site in the editor.
2. Press Deactivate at the bottom left.
3. Confirm: "Deactivate this location? History stays intact, but nobody can check in here."

The site stays in the list marked inactive. Nothing is deleted.

1.11 Timesheets

This is where hours are reviewed, corrected and signed off. It is the page that feeds payroll, so every change made here is recorded.

Filtering

The row of controls at the top narrows the table:

• A from and to date.
• All departments — pick one.
• Any status — present, late, half day, absent, on leave, holiday, weekend, missing checkout.
• A search box for a name or employee code.
• Flagged only — records the system has marked for a human to look at.
• Pending only — records waiting for approval.

Press Apply to run the filters, or Reset to clear them.

The totals

The six tiles describe the whole filtered range, not just the rows visible on screen: records, people, hours worked, overtime, late minutes and how many are pending review.

Correcting a punch

Times and the day's status are edited directly in the table.

1. Click the Check in or Check out cell you need to correct.
2. Type the corrected date and time.
3. A box asks "Reason for this adjustment (recorded in the audit trail):" Type why. This is not optional in practice — it is what makes the change defensible months later.
4. The Worked and Late columns recalculate themselves from the corrected times.

The Status cell works the same way, from a list, and does not ask for a reason. Notes on a record are added with the Add note button.

Approving and rejecting

1. Find the row. Rows awaiting a decision show pending in the Approval column.
2. Press Approve to accept it.
3. Press Reject and type why. The reason is required.

Your name appears under the approval status once you have decided.

Flagged records — what the flags mean

A flagged row is shaded and its reason appears when you hover over it. The reasons the system writes are:

A record can carry more than one reason; they are joined with a semicolon.

Seeing what was changed

1. Press History on the row. A number beside it is how many edits it has had.
2. The panel lists every change: which field, the old value, the new value, the reason given, who made it and when.
3. If nothing has been changed it says "No edits recorded — this row is exactly as the app captured it."

Exporting

Export CSV downloads exactly what your filters are showing. The columns are:

Employee code · Name · Department · Date · Check in · Check out · Worked (h) · Late (min) · Overtime (min) · Status · Approval · Check-in fence · Distance (m) · Site · Travelled (m) · Flag reason

Hours in the export are decimal, so 8h 30m appears as 8.5.

1.12 Staff devices

A staff device is a shared Android phone left at a site. Workers clock in on it by face, with nobody signed in. The Devices page is where you provision them from the office. (A supervisor can also set one up from the phone itself — see 2.1.)

Adding a device from the dashboard

1. Open Devices and press Add device.
2. Give it a Label, for example Gate handset — Kitengela. Write the same name on the back of the phone. It is what names the device on every punch it makes.
3. Choose the Site. A device pinned to a site only searches the people posted there, which is both faster and much less likely to mistake one worker for another. Leave it on Any site in this workspace only for a phone that genuinely travels.
4. Leave Require a liveness check switched on. It is what stops a printed photograph clocking somebody in. Turn it off only where a person is watching the handset.
5. Press Create device.
6. A pairing code appears in large type. It is shown once. Press Copy code or write it down.

Pairing the phone

1. On the handset, open the app and choose Administrator, then Pair device.
2. Type the code. It is not case-sensitive and the dash is optional.
3. The phone stores its own credential and goes straight to the face screen.

The code expires after 30 minutes. If it lapses, or if you close the panel before pairing, press New pairing code on the device's card.

Reading a device card

Re-pairing and revoking

• Re-pair issues a fresh code — for a phone that was wiped or replaced. It does not stop the old phone. The existing credential keeps clocking people in until the new code is redeemed.
• Revoke stops the device immediately and asks for a reason. Use this for a lost or stolen phone. A revoked device cannot be given a new code — create a new device instead.

1.13 Casual and daily labour

The rule this part of the system is built on: "can work" and "has been approved" are two different facts.

A labourer hired at 06:40 has to be clocking in at 06:45. Waiting for an office to open would mean the hours were worked and never recorded — and unrecorded hours are the one failure this product exists to prevent.

So the system does this:

1. A supervisor registers the worker at the site phone with a name and phone number. Email is optional. See 2.2.
2. The worker is created as an active employee straight away and can start work. They are given an employee code automatically and are recognisable at that phone from that moment.
3. Their engagement is marked pending. Every shift they work while pending is recorded normally but is flagged with "Provisional registration awaiting approval" and set to pending approval, so it reaches a reviewer in Timesheets instead of sliding into payroll unexamined.
4. An administrator later rules on the engagement itself — whether this person is genuinely on the books.

1.14 Other screens

Two more pages exist for administrators. They are named here so the sidebar holds no surprises; they are not covered step by step in this manual.

• Automations — rules of the form if this happens, and these conditions hold, then do that, plus the organisation-wide attendance settings. A set of built-in alerts (geofence breach, late arrival, mock location, missing check-out) fires whether or not you configure anything.
• Plan & billing — the workspace's subscription and its seat allowance. If a plan limit is reached, adding an employee is refused with a message naming the limit.

NewFace check-in (new in this release)

Everything in this section is new or changed in version 1.1.0. If you have used the app before, this is what is different.

What changed

Face recognition now comes first. A worker no longer needs a login page at all. The app opens, asks who is holding the phone, and a worker goes straight to a camera screen. If the system knows their face, the clock starts.

What the worker sees

The staff screen is a live camera. There is nothing to press to start it.

A result stays on screen for about 20 seconds and then the screen returns to waiting, so the next person in the queue never sees the previous person's details.

Face enrolment and consent

Before any face is recorded, the person is shown a notice in full and must agree to it. The notice is not a tick box buried in a form; it is a screen with I agree and Not now, and Not now simply exits.

What is stored

Separately from the template, the system records that consent was given: when, on which device, under which version of the notice, and a fingerprint of the exact wording that was shown. The wording itself is not stored twice.

Asking for it to be deleted

A worker can withdraw at any time. On a phone where they are signed in with their own account, that is Face verification → Delete my face data → Delete permanently. The templates are deleted outright — not marked inactive — and the consent is recorded as withdrawn.

A casual worker who has no login of their own cannot reach that screen. They should ask their supervisor, who should pass the request to an administrator.

Liveness — why people are asked to blink

Before the system will even look at who a face belongs to, it asks for a movement it chose at that moment — a blink, a nod, a turn of the head — and checks that it happened. This is what stops somebody holding up a photograph of a colleague.

It is not perfect and the system does not pretend otherwise: it defeats a held-up photograph, not a purpose-built attack. That is why a shared phone should be somewhere a person can see it.

How sure the system has to be

A face is only accepted when it is both a strong match and clearly better than the next-best person. Two similar faces scoring almost the same is not a match — it is a coin toss, and the cost of losing it is clocking in the wrong person. In that case the system refuses and asks the person to try again.

This is also why a device should be pinned to a site. Searching the eight people who work at a gate is far safer than searching four hundred across the company.

Part 2Supervisor / Foreman

In the field, on a phone. You need a supervisor, manager or administrator account to do any of this.

2.1 Setting up the phone as a staff device

This turns a phone into the site's clocking device. Do it once, on the phone that will stay at the site.

1. Open the app. If it asks "Who is using this phone?", choose Administrator.
2. Sign in with your employee code and password.
3. On the home screen, find the card headed Set up this device for staff and press the button of the same name.
4. Choose where the phone lives. Pick the site from the list. Choose Anywhere in the organisation only if the phone genuinely travels between sites.
5. Give it a Name for this device — at least two characters. Staff never see it; supervisors do, in the device list.
6. Leave Ask staff to blink or turn their head switched on.
7. Press Set this device up.

The phone signs you out, opens straight into the face screen, and is now the site's device. It will come back to that screen after a reboot, an update or a crash.

If you were given a pairing code from the office instead, choose Administrator then Pair device and type the code. Both routes end in the same thing.

2.2 Registering a worker in the field

Use this for a casual or daily hire who is not on the system. It takes under a minute and the worker can start immediately.

1. Hand the worker the site phone, or hold it for them. They look at the camera.
2. The screen says "We don't know this face yet". Press Register me.
3. Enter the Full name — at least two characters, as it should appear on the record.
4. Enter the Phone number. This is required. It is how the worker will be reached.
5. Email address (optional) — skip it. Most day labourers do not have one, and it is not needed.
6. Fill in Job title (optional) if it helps. How are you engaged? is already set to Casual, which is right for a day hire; change it to Field, Office or Hybrid only if it is not.
7. Engaged until (optional) — a date in the form 2026-12-31. Leave it blank if you do not know. Leaving it blank is safer than guessing.
8. Press Continue.
9. The consent notice appears. Let the worker read it, or read it to them. They press I agree — or Not now, which stops the registration and is a legitimate answer.
10. The camera opens. The worker follows the prompts — look straight ahead, turn slightly left, turn slightly right — until the angles are captured.
11. The screen says "You are registered". Press Start work.
12. The phone returns to the face screen. The worker looks at the camera once more and the clock starts.

Things that will stop you

• "Enter a phone number of at least three characters so your supervisor can reach you." — the phone number is not optional.
• "That email address does not look right. Correct it, or clear the field — email is optional." — clearing it is usually the right answer.
• "Write the date as YYYY-MM-DD, for example 2026-12-31, or leave it blank."
• "Registering needs a connection — your face cannot be recorded for later." — you cannot register somebody offline. Move to where there is signal, or send them to work and register them when the connection is back.

2.3 A returning casual worker does not re-register

The system deliberately protects this. When a posting to a site simply lapses — somebody set an end date, the job ran a week longer — the worker is still recognised for 30 days afterwards and their punch is accepted, with the re-engagement written into the record for an administrator to see. That is because the alternative is worse: the hours get worked anyway and go unrecorded, or somebody registers the same person a second time.

A posting an administrator deliberately ended is different. That takes effect at once, and the worker will not be recognised from that day.

So if a known worker is refused at the camera, the first question is not "register them again". It is: has somebody ended their posting, or has their account been suspended? Ask the office before you create a second record.

2.4 When somebody is refused

Work through this before registering anybody a second time.

2.5 Watching your team

On your own phone, signed in as a supervisor, the Team tab shows today.

• A summary line: headcount, clocked in, not clocked in, late, out of bounds, and the attendance rate.
• Filters across the top: Everyone, Clocked in, Not clocked in, Late, Out of bounds.
• Each person's row shows their state, how long they have been on shift or how late they were, their site, and a Flagged tag where the record needs review.
• Refresh pulls the latest.

The phone can sound an alert when somebody on your team clocks in. Use Mute check-in alerts to silence it; arrivals still appear on the screen.

2.6 Taking the phone back out of staff mode

1. On the face screen, press and hold the site name at the bottom of the screen.
2. The unlock box appears.
3. Type an administrator's or manager's employee code and password.
4. Press Unlock.

The phone stops clocking staff in and returns to the sign-in screen. The password is checked against the server, so this needs a connection.

An ordinary employee's credentials will not do it: "Those credentials are valid, but only an administrator or manager can take this device out of kiosk mode."

Part 3Worker

What you see and what you do. Most workers only need section 3.1.

3.1 The shared site phone

There is no password and nothing to remember. The phone is already on the camera screen when you pick it up.

Clocking in

1. Stand in front of the phone. The screen says "Look at the camera to clock in".
2. Hold it at eye level and look straight at it.
3. If you are asked to blink, nod or turn your head, do it slowly. This is how the phone knows it is looking at a person and not a photograph.
4. Your name appears with Clocked in and the time. Your shift has started.
5. Hand the phone to the next person. The screen clears itself after about twenty seconds.

Clocking out

1. Look at the camera again, exactly as before.
2. Your name appears with how long you have been working, and a Clock out button.
3. Press Clock out. The screen confirms the time and your total for the day.

Seeing your own record

1. After the phone recognises you, press My history.
2. "Your last few days" lists your recent days — the time in, the time out, and the hours.
3. Press Hide my history, or just wait. The screen clears itself.

Only your own days are shown, and only right after the phone has recognised your face. Nobody can look up your record on that phone without you standing there.

If the phone does not know you

1. The screen says "We don't know this face yet".
2. If you have never registered, press Register me and follow 2.2. Your supervisor should be with you.
3. If you have registered before — even months ago, even on a different job — do not register again. Press Try again, and stand in better light. If it still refuses, tell your supervisor. Registering twice splits your record in two and can cost you hours.

3.2 Your own phone

Some staff — usually those with a job title and an email — are given their own login and use the app on their own phone. If you were never given an employee code and a password, this section does not apply to you; use section 3.1.

Signing in

1. Open the app and choose Administrator at the first screen if you are asked.
2. Type the Employee code your supervisor gave you and your Password.
3. Press Sign in.

You need a connection the first time only: "You need a connection to sign in the first time. Once signed in, clocking in works offline."

Clocking in and out

1. The Today screen shows where you are, how accurate the GPS reading is, and how far you are from your site.
2. Wait for a GPS reading. If it says "Waiting for a GPS reading", step outside and press Refresh.
3. Swipe the slider marked Swipe to check in.
4. If a selfie is required, the camera opens. Take it.
5. If you are outside your site's area, you are asked for a note: "You are outside the designated area. Add a note to proceed." Say why — for example, delivering at the client site.
6. The banner confirms: "Checked in. Your shift is running."
7. At the end of the day, swipe Swipe to check out.

If you had no signal, the banner says your punch was "Saved on this phone and will sync by itself" with a count of what is waiting. It sends itself when the connection returns. You do not need to do anything.

Your history

The History tab shows 7, 30 or 90 days, with a summary at the top: days worked, total worked, overtime, late days and flagged days. Each day shows the times, whether the check-in was inside the fence, and your selfie if one was taken.

The Alerts tab is your inbox from the office.

3.3 Your face data and your rights

Read this before you agree. It is short and it is the whole story.

• Your employer uses face verification to confirm that it is really you clocking in and out. That is all it is used for.
• Your phone measures your face and turns it into a list of numbers — a face template. Only those numbers are sent.
• No photograph of your face is uploaded, and none is kept on the phone.
• The numbers cannot be turned back into a picture of you.
• You will be asked to blink or turn your head, so the system can tell a live person from a held-up photograph.
• Agreeing is your decision. If you would rather not, choose Not now and speak to your supervisor about recording your attendance another way.
• You can withdraw at any time. Withdrawing permanently deletes your face templates from the server.

Deleting your face data

If you have your own login on your own phone:

1. Open Face verification from the home screen.
2. Press Delete my face data.
3. Read the warning — if your employer requires face verification, you will not be able to clock in until you set it up again.
4. Press Delete permanently.

If you use only the shared site phone, you have no settings screen of your own. Ask your supervisor to pass the request to the office. You are entitled to make it, and the request should be honoured.

ReferenceTroubleshooting

The messages people actually hit, and what to do about each.

At the camera

Location and geofence

An out-of-bounds check-in from a shared phone

A shared site phone has nobody to type a note — the worker is standing at a screen with no keyboard. So when an out-of-bounds punch is permitted, the device writes the explanation itself, naming the device and the distance, for example:

Recorded away from the site by the "Gate handset — Kitengela" staff device, 310 m from Kitengela Yard. The worker was identified by face; no note could be typed on a shared device.

The record still appears in the review queue. It is not an exemption — it is an explanation.

Signing in and connection

Installing and updating the app

These phones do not get the app from the Play Store — it is installed directly, and the app updates itself. When a new version is ready you will see "Version 1.1.0 is available" with a Download update button showing the size, because the download may spend the phone's own data.

• "Android needs your permission to install apps from Attendance." — press Allow installs, switch the permission on, and come back.
• "The downloaded file did not arrive intact and was discarded. Try again, ideally on Wi-Fi."
• "There is not enough free space on this phone for the update." — clear some space and retry.
• "This phone is running a version the server no longer accepts." — the update is compulsory. Nothing already recorded is lost.

In the dashboard

ReferenceNot on a screen yet

Honest limits of version 1.1.0. These things the system can do, but there is no button for them in the dashboard. They are listed so nobody hunts for a control that is not there.

• Restoring a removed employee. Remove is reversible by design and destroys nothing, but the Directory has no list of removed people and no restore button. If somebody is removed in error, ask whoever maintains the system — do not create a second account.
• Approving or rejecting a field registration as a whole. There is no review queue screen for engagements. Review the individual shifts in Timesheets (Flagged only or Pending only) and, if the person should not be on site, archive or remove them in the Directory.
• Viewing or deleting somebody's face data from the dashboard. A worker with their own login can delete their own; there is no administrator-side control for one who cannot.
• Approving a location a worker declared from the field. The app lets a worker declare a site they have been sent to; the dashboard has no queue for ratifying those. Create the site properly under Locations.
• Adding a worker from the supervisor's own phone. Field registration happens at the shared staff device, via Register me. There is no Add worker button on the Team screen.

ReferenceGlossary

Geofence

The boundary drawn around a site. A check-in inside it counts as being at work. One outside it is measured, recorded and flagged — and may be refused. A fence is either a circle (a pin and a radius) or a polygon (a ring of corners clicked on the map).

Posting

The link between a person and a site. It is what lets them check in there, and it is what puts them on that site phone's list of recognisable faces. Ending a posting keeps the history; deleting one is only for a posting added by mistake.

Casual worker

Daily or short-term labour, hired on site rather than through the office. Usually registered at the site phone with a name and a phone number, with no email and no password. They have an employee code like anybody else and their hours are recorded the same way.

Provisional registration

A worker who was registered in the field and can work immediately, but whose engagement no administrator has ratified yet. They are fully active and fully recognisable; their shifts are flagged "Provisional registration awaiting approval" so a reviewer sees them. The approval decides whether the engagement stands, never whether the hours happened.

Liveness

The check that asks a person to blink, nod or turn their head, so the camera can tell a live person from a held-up photograph. The movement is chosen by the server at that moment and can only be used once, so a recording cannot be replayed. It defeats a printed photo; it is not proof against a determined, purpose-built attack.

Template (face template)

The list of numbers a phone produces when it measures a face. It is what the system stores and compares. It is not a photograph, no photograph is uploaded or kept, and the numbers cannot be turned back into a picture of the person.

Kiosk / staff device

The same thing under two names. A shared Android phone that belongs to a site rather than to a person: nobody signs in on it, it opens straight to the camera, and it clocks workers in and out by face. It is set up either from the phone (Set up this device for staff) or with a pairing code from the dashboard, and taking it back out needs an administrator's password.

Flagged record

An attendance record the system has marked for a human to look at — out of bounds, a weak or faked GPS reading, a very late sync, a shift closed automatically, or a provisional worker's shift. Flagging never blocks the hours; it routes them to a reviewer.

Out of bounds

A punch taken outside the geofence. The record says which fence was missed and by how far — measured from the edge of the fence, not from its centre.

Employee code

The short identifier on every person, such as EMP0142. It is allocated automatically when somebody is registered in the field, and it is what an administrator or manager types to sign in on a phone.