ClockoraStaff Timesheet & Time Tracker
Self-hosted staff timesheet — hours by project, exact totals, approvals. No invoicing.
No sign-up, no password — the demo opens already signed in, on sample data.
- Full PHP source included
- Instant download + licence key
- It never phones home
- Compare vs SaaS pricing →
The problem it solves
Studios, agencies, support teams, and workshops need to know who worked how many hours on what — and they track it in a spreadsheet nobody trusts, or in a time-tracking SaaS that insists on bundling invoicing, billing rates, and payroll they never asked for, priced per employee every month. All most teams actually need is exact hours, by project, approved.
- Hours logged in a spreadsheet that never quite adds up
- Time-tracking SaaS bolting on billing/payroll you don't want
- Per-seat monthly pricing for what is a timesheet and a total
What you get
Approve or reject a timesheet and the person who submitted it can be told by email — through your own SMTP, off by default, and never carrying a pay figure because the product stores none.
A cron chases employees whose week has hours but no submitted timesheet — each person claimed once per period before any mail is sent, so a double-fired cron can never nag twice. Dry-run mode shows who would be reminded.
Employees with a role and an optional weekly-hours target; projects as simple labels for tagging time — no billing rates anywhere.
Log time by clock start and end times (crossing midnight handled) or as a manual duration — stored as exact integer minutes, never floats.
One employee can't have two clock entries overlapping in time on a day, checked on an absolute minute-timeline; clean back-to-back entries are allowed. Manual duration entries have no clock position and are not overlap-checked.
A week (with prev/next) or a custom date range, with exact totals per employee and per project — reconciled to the minute.
Entries move pending → approved / rejected with an approver and timestamp, per entry or in bulk for a period.
A configurable weekly overtime FLAG (never a pay figure), a dependency-free per-employee PDF timesheet, and a spreadsheet-formula-injection-hardened CSV export. DST-safe throughout.
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Clockora 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
- Email notifications through your own SMTP
- CSV import with a mandatory dry run
- One-click backups
- Dark mode
Close a pay period and it is closed in the app, over the REST API and for an agent — one rule, one implementation, three doors, with unlocking audited. MCP runs the submit and approve cycle under the same refusals you get. Payroll CSV exports approved time only, exact minutes, no money.
- Roles with email invitations and a last-admin guard
- Append-only audit trail across browser, API and agent
- Your logo and colours throughout
- Scheduled backups with a guided dry-run restore
- Optional single sign-on (OIDC)
The 3.1 wave gave the catalogue a way to reach the other side of the transaction: counterparty email through your own SMTP server, calendar feeds your own calendar subscribes to, attachments filed where the paperwork belongs, and export presets other people's software imports. Every outbound path ships switched off, runs on your own credentials, and can never break the thing that triggered it. What this app gained is listed at the top of this section.
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
Which licence do I need?
It comes down to how many installations you need. Running your own business on one site is the Single licence. Building or running sites for other people — a second domain of your own, or an installation a client keeps — is the Extended licence.
Single licence
One (1) domain or subdomain
One business, running it on one site.
- Install it on one domain or subdomain you own or operate
- Change the source however you like for that installation
- Run your own business on it commercially, client work included
- Re-download the current build any time from your buyer portal
- A second site, or an installation you hand to a client as theirs, needs the Extended licence
- No reselling, redistributing or sublicensing the source
- Not for offering it to other people as a hosted service
Extended licence
Unlimited sites you own or operate
Agencies, and anyone running it on more than one site.
- Everything the Single licence grants
- Install it on as many domains as you own or operate — no cap on the number
- Build and hand over one installation per client project
- Still no reselling or redistributing the source itself
- Running it as a multi-tenant service others sign up for needs a SaaS agreement
Every download carries the full terms as LICENSE.txt, and the licence you bought is
named on your order and in your buyer portal. The complete wording lives on the
terms page, and the live demo is free for as long
as it takes to decide.
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Honest limitations
What it does not do — written down before you buy, and kept true on purpose.
- Single-tenant: one business per installation.
- Hours only — no invoicing, pricing, rates, wages or payroll. No email can contain a pay figure because the product stores none.
- Overlap detection applies to clock entries (start + end); manual-duration entries have no position on the clock, so a per-employee-per-day 24-hour ceiling refuses the impossible day instead.
- Email sends through your own SMTP server; every staff-facing message is off until you turn it on.
- Reminders need a scheduler:
cron/reminders.phpmust run daily — the app does not run background jobs by itself.
2-minute web installer, plain PHP 8 + MySQL (or SQLite for a trial), no Composer or build step — Docker image included.
Covered in these guides
The limitation-smash release: your tools now write to the people they serve — client emails through your own SMTP, calendar feeds, attachments, export presets — every one of them off until you switch it on.
Invoicing, time tracking, scheduling, expenses — $552 a year at entry tiers. For one person, per-seat pricing is the best case. What actually bites is the cap, and most of this stack has a free answer we will name.
Clockify charges $5.49 to $12.99 per seat per month, Harvest from $9 — which means your timesheet bill grows every time you hire. The per-seat math worked through honestly, including the free tier you might belong on, and the one-time alternative.
Time tracking and invoicing have the strongest free self-hosted options of any category we track. Here is an honest account of when Kimai and Invoice Ninja are simply the right answer, and the small set of cases where they are not.
Questions about Clockora
Does Clockora invoice or bill these hours?
No — and that is deliberate. It records hours worked and approves them; it applies no billing rate and produces no invoice. That is what keeps it distinct from an invoicing product and free of any payment surface. Pair it with your own billing system.
Is it payroll?
No. It computes no wages, holds no pay rates, and moves no money. The overtime feature is a flag against an hours threshold, never a pay figure.
How exact are the totals?
Exact to the minute. Time is stored as integer minutes and summed in PHP, with cross-midnight spans and DST handled — the shipped 147-assertion suite proves it.
MySQL or SQLite?
Either — SQLite for a zero-config trial, MySQL/MariaDB for production on ordinary shared hosting.
What if the developer disappears?
You get the full PHP source and your data lives in one database you own — nothing phones home, nothing expires.
Does it chase missing timesheets?
Yes — a daily cron (one line, shown in the app) reminds employees who have hours but no submitted timesheet, on the weekday you choose. Off by default, through your own SMTP, and idempotent per person per period: nobody is ever reminded twice for the same week.