Evidence belongs to the person who made it.

Time-tracking software has a structural problem, and it is not technical. The person who buys it wants to watch, and the person who installs it resents being watched. Every feature gets designed for the first person and endured by the second.

You can see the consequences from orbit. Teams rip these tools out. A whole cottage industry exists to defeat them — mouse jigglers are sold openly, with reviews. And the tools can never expand past the set of people who can be made to install them, which is a small and shrinking market.

We took the other side of that bet: the record of your work belongs to you. Not as a slogan on a pricing page — as a constraint that decides arguments. Here is what it actually cost us to mean it.

A permission dialog you can rescind

If a screenshot of yours captures something private — a bank tab, a medical portal, a message from your sister — you can delete it. Not flag it for review. Not open a ticket. Delete it, now, and it is gone from the server.

The obvious objection is that this destroys the audit trail, and it would, if deletion erased the fact that something had been there. It doesn't. What deletion removes is the content; what remains is the record that a capture existed at that timestamp and was removed by its owner.

Which leads directly to the decision that makes the whole thing work.

Time that has lost its evidence is not erased. It stops being payable.

This is the pivot the entire model turns on. If deletion erased the hours, the feature would be a fraud button and no buyer could accept it. If deletion were forbidden, the tool would be surveillance with extra steps and no worker would accept it. Making deletion cost the claim instead of the truth satisfies both parties honestly, because both of them get the thing they actually needed:

• The worker gets an unconditional right to remove anything from the record.
• The client gets a bill in which every hour still standing has evidence behind it.

Nobody has to be trusted. The incentives simply point the same way for once.

When a manager approves your week, they are not ruling on whether you worked. They are adding their name to a record you made. That distinction sounds like semantics until you look at what it forces:

• You cannot review your own evidence. Not as an anti-fraud measure — as a definition. A countersignature by the author is not a countersignature.
• The reviewer is designated, and named on the record. "Someone at the company approved this" is not accountability. A name is.
• A reviewer deleting your evidence deducts the time reversibly, and you can appeal. The deduction is a position, not a fact, and the system records it as one.

A verdict ends a conversation. A countersignature starts one, which is the correct shape for disagreements about somebody's work.

Some of this is easier to state as refusals, because refusals are testable. Anyone can say they respect workers. Not everyone will write down what they turned down.

No webcam capture. No face recognition, ever. No keystroke-dynamics identification, ever. These are permanently rejected, not deferred to a later quarter when the pressure is higher.

Two of those three we rejected partly because they are bad at their job, and it is worth being honest that this made the decision easier. Webcam capture is sold as proof that the hired person is the working person; it proves nothing of the sort, because a subcontractor can sit in frame while somebody else works, or the hire can sit in frame while the sub works elsewhere. It is an expensive photograph of a person's face during their working day, and a photograph is all it is.

The third we rejected on principle alone. We do not collect or derive biometric identifiers, and the reason is that we cannot promise a worker their record is theirs while quietly building a never-deletable model of how their hands move.

We do run continuity checks — whether the machine is being driven remotely, whether input cadence looks synthetic — and we run them on aggregates, never on identity. The difference matters: one asks "is this machine being driven by a person right now", the other asks "which person". We answer the first question and refuse the second.

None of this is charity, and pretending otherwise would be its own kind of dishonesty. A record the worker trusts is a record the worker does not fight, which is why the evidence behind our hours is worth more than the evidence behind a tool people are actively trying to defeat.

The pitch fits in a sentence: verified hours your client will pay for, owned by the person who worked them. The four decisions above are what that sentence costs.

Questions, corrections, or a war story of your own? Write to hello@worktrackhq.com — a person reads every message.