Privacy policy

Who this app is for

Keystone Field is a workplace operations app for JMG KCC employees, supervisors, and administrators. It supports attendance, job activity, team communication, reimbursement requests, forms, and employee work email.

Account and employment information

The app may use your name, role, employment status, assigned jobs, and company email address to identify you, control access, and show the work information relevant to you. One-time sign-in codes are delivered by company email so Keystone Field does not require a paid text-message provider. Authentication records are processed through the configured identity service.

Location at clock-in and clock-out

When you choose to clock in or clock out, Keystone Field can request your device's foreground location and record coordinates, accuracy, time, job assignment, and whether the clock event appears inside the assigned job-site area. Managers use this information to review attendance and GPS exceptions.

• Location is requested in the foreground as part of the clock action.
• An administrator can require GPS for an employee or allow that employee to clock without it.
• If GPS is required and a usable location is unavailable, the clock action is not accepted.

Reimbursements and receipts

When you submit a reimbursement, the app processes the amount, category, description, date, job association, status, reviewer notes, and any receipt image you upload. Authorized managers can review these records to approve, reject, or request more information.

Messages, forms, and work activity

Team messages can include their content, participants, timestamps, and read status. Forms and other operational features can include responses, acknowledgements, job assignments, schedules, and activity history. Authorized employees and managers see information based on their role and assignment.

Employee cPanel email

Employees can connect their own @wk.jmgkcc.com mailbox. The mailbox password is designed to remain in encrypted device SecureStore while saved on the phone. It is sent to the Keystone Field server only over encrypted HTTPS for the employee's requested mailbox action and is held in server memory only while connecting to cPanel through encrypted IMAP or SMTP.

The mailbox password is not designed to be written to the Keystone Field application database or Supabase. Disconnecting the mailbox or signing out removes the saved password from the app device. Email content still remains subject to the cPanel mailbox provider's storage and retention practices.

Employees should never send a mailbox password in a support message, chat, reimbursement, or form.

Storage, sharing, and security

Operational records are stored with the services configured for Keystone Field, including the application database and file storage. Data is made available to authorized JMG KCC personnel who need it for workplace operations, review, support, or legal obligations. Service providers process data only as needed to operate the app.

Keystone Field uses access controls and encrypted network connections in its production design. No online service can guarantee absolute security, so suspected account or device compromise should be reported promptly.

Retention and deletion

JMG KCC has approved the following Keystone Field retention schedule:

• Time entries, clock-in/clock-out GPS evidence, reimbursement records, and receipt images: four years.
• Team messages, forms, safety submissions, field issues, and related operational records: one year.
• Application security and diagnostic logs: 90 days.
• Background breadcrumb locations: not collected in the current release.

A legal hold, active dispute, tax requirement, insurance requirement, or other applicable obligation may require a specific record to be kept longer. Records should be securely deleted or anonymized after the approved period when no longer required.

Employees can request account deletion or ask about a specific record using the steps on the account-deletion page. Some records may need to be retained even after account access is removed.

Your choices

• You can allow or deny device location permission, although required-GPS clock actions will not work without it.
• You can connect or disconnect your optional worker mailbox and remove its saved password from the device.
• You can request correction of inaccurate profile or work records through your company administrator.
• You can request account deletion as described on the public account-deletion page.

Contact

Email magaly@jmgkcc.com for privacy questions, access or correction requests, or account-deletion requests. Never include a password or one-time authentication code.