The sign-in sheet, retired.

This organisation runs on people rather than paperwork: a small office staff, and a much larger group of caregivers working across dozens of client homes and community locations rather than one building.

Attendance had always been kept by hand — a paper sign-in sheet, or a manager holding it in their head. That works until it does not. A payroll dispute arrives and there is no record to check. Nobody can see a month’s pattern. And when someone checks in somewhere that does not match where they were scheduled, nothing catches it.

The constraints were as firm as the problem. It had to be run day to day by a non-technical office manager. Caregivers in the field had to use it from a phone in seconds. And it could not require buying software or standing up hosting, because the budget for both was nothing.

The ask sounded like a time clock. What the organisation actually needed was a record it could defend — in a payroll dispute, in a funder’s audit, in a difficult conversation with a caregiver. That reframing set almost every decision that followed.

The one we thought hardest about is treating self-reported data as provisional. Every entry an employee submits lands as Unverified until a manager confirms it. That is not distrust; it is the difference between a claim and a record, and drawing the line explicitly is what makes the confirmed data worth relying on. The corollary is that the flag never blocks anything. A check-in from outside the office radius still goes through, still counts, and simply arrives with a note attached. Software that argues with someone standing in a client’s driveway does not get used.

Underneath, the logic deciding what counts as present, absent or excused — weekends, holidays, each person’s own schedule — lives in its own module with its own test suite, forty tests, independent of any screen. It runs identically whether the manager dashboard is asking or the check-in page is. Attendance rules are exactly the kind of thing that quietly drifts apart when the same logic gets written twice.

The hardest problem was not in our code. The dashboard originally gated access on a Google account allowlist, which is clean until a manager’s Google account sits on a different domain than the owner’s — a genuine, under-documented limit of the platform rather than a bug. Rather than paper over it, we added a second path: a scoped, revocable link that sits alongside the account check and lets a manager grant full access to whoever needs it without fighting Google’s identity model.

The documentation shipped as part of the product, not after it. Two branded PDF guides, one for managers and one for employees, plus a personalised onboarding packet for every single person — a cover page with their name and a QR code straight to their own check-in link, generated from the live roster rather than assembled by hand.

All of it runs on a Google Sheet the organisation already owned. No server, no database, no hosting bill. For a nonprofit, that was not a technical detail; it was the reason the project was possible.

What the second release changed. Thirty days of testing, onboarding, and using it is worth more than any amount of planning, and it argued for four changes. Time off stopped being a text message to a manager and became a queue with an approve or deny on it. WFH stopped being an exception filed under something else. The month grid started showing arrival times instead of verdicts, because present turned out to be a thinner fact than 8:52. And the day now opens with four numbers rather than a roster, so the question the manager was reading the list to answer is answered before they start reading. The check-in screen is the part we changed least, which is the part we are happiest about.

What we would do differently. Apps Script’s identity model was the single biggest source of friction in this build — cheap and infrastructure-free, but it fights you the moment your users are not all on one Workspace domain. For an organisation we knew from day one would have managers across domains, we would design the access-link path in at the start rather than reaching for it after hitting the wall.