What Kiosk Mode Locks Down on a Shared Tablet

You set a tablet on the table by the door so people can tap their name and clock in. Then the worry starts. If anyone can walk up and use it, what stops someone from fixing their own total, or shaving an hour off a coworker's, or deleting the whole afternoon? One shared device, no logins, and you are not standing over it all day. That is a real fear, and it is the thing that keeps people entering hours by hand on a clipboard instead.

The short answer: a worker tapping the kiosk cannot see or change anyone's hours, including their own. The tablet in kiosk mode only does one thing. It takes clock-ins and clock-outs. Everything else is locked behind a PIN that workers do not have.

What a worker can actually do at the kiosk

Picture the screen your crew sees. It is a list of names, or a single name on a personal link, with a button to start the clock and a button to stop it. A worker taps their name, confirms, and they are on the clock. When they leave, they tap again and they are off. That is the whole interaction.

What is not on that screen matters more. There is no edit field. No worker can open a past entry and change the start time. No one can delete an entry, add hours to a day that already happened, or rename themselves into someone else's record. There is no report to view, so a worker cannot even see how many hours a coworker logged, let alone touch the number. The kiosk shows the present moment and nothing behind it.

The same holds for the two other ways people clock in. A posted QR code opens the same stripped-down screen. A personal link does too. None of them carry an account, a password to steal, or a door into the admin side. Workers never sign in, so there is nothing to take over.

The kiosk PIN is the line between clocking and editing

The thing that makes the shared tablet safe is the kiosk PIN. When you set up the locked-down kiosk screen, you set a short code. During a shift the tablet stays on the clock-in list and will not leave it. To get back to the admin dashboard, correct a record, or close the kiosk, you type the PIN. A worker who grabs the tablet hits that wall. They can clock in and out all day, but they cannot cross into the part of the app where hours get changed.

This splits the two jobs cleanly. Clocking in is open to everyone on the device. Editing hours is not, and it never happens on the kiosk at all. Corrections live in the admin dashboard, which only you reach, by magic link, from your own phone or laptop. If your assistant needs that too, they get their own admin sign-in. The crew gets the tablet; the records stay with you. We walk through exactly who holds which in our note on how admin access works.

What stops a forgotten clock-out from faking hours

The other way shared hours go wrong is not malice, it is forgetfulness. Someone clocks in for a Saturday shift, leaves at 2, and never taps out. On a lot of systems that open entry keeps running until Monday morning, and suddenly a four-hour shift reads as forty-plus. Even if no one touched the tablet on purpose, the total is garbage.

Kangaroo Clock closes a stale open entry at its start time plus a cutoff you set, never at the current time. So a shift someone forgot to end gets closed near when it actually ended, not whenever you happened to notice. A forgotten tap never inflates the number. You can read how the auto-close cutoff is calculated if you want the exact behavior before you rely on it.

Why this makes the export worth trusting

All of this exists so one thing holds up: the hours you report are the hours people worked. When you pull a report for payroll, a grant, or a volunteer summary, you are not guessing which rows got edited by whom. Workers never had the keys to edit, forgotten clock-outs got capped at a sane number, and every correction you did make happened in the admin dashboard under your own sign-in. The downloadable hours report comes out with a stable column layout and a distinct-worker count, the same every time, so the person reading it on the other end has no reason to doubt it.

If you are still nervous about handing a crew a tablet, the fastest way to see the limits is to behave like a worker on one. Open the live kiosk, tap a name, and try to find a single place to change an hour. There is not one. You can test that yourself on a borrowed tablet or your own phone, no account required, in a couple of minutes.

Set the PIN before your first shift and keep it off the tablet itself. That one code is what turns a shared device into a clock you can actually trust.