Can TimeTac be vibe coded?
Cloud time tracking, attendance and leave management for teams, with clock-in via web, mobile and terminals.
If you are one person logging hours against projects, this is a solved evening: a table, a timer, a CSV export, done. TimeTac is not sold for that, it is sold to companies that must prove who worked when, which in Spain means a daily time record that survives an inspection. An agent can absolutely build the clock-in screen, the leave calendar and the monthly timesheet PDF, and it will feel surprisingly complete. What it will not hand you is the tamper-resistant audit trail, the payroll and HR exports your accountant already accepts, and the phone app your field staff will actually open. So: yes for yourself, shaky the moment other people's paychecks depend on your SQLite file.
Jump to the build brief ↓Legacy-calibrated assessment
Checked Aug 2026
What you pay today, before any DIY hosting
medium editorial confidence
Tracked separately from the pricing check
Buildability by layer
Screens, forms, and focused interactions
The repeatable job the product performs
Availability and legality of required data
Uptime, queues, support, and maintenance
Security, compliance, and user confidence
The achievable core
- A local web app where people clock in and out, log time against projects, request time off, and export approved monthly timesheets as CSV or PDF.
- Capture activity, categorize it, and report where the day actually went.
- A responsive interface with real empty, loading, success, and error states.
The parts a prompt cannot buy
- Legally defensible records: no tamper-evident log, no retention guarantees, nothing an inspector or works council will nod at
- Native iOS and Android apps with GPS, offline clock-in and geofencing for people who are not at a desk
- Hardware terminals and badge or fingerprint clock-in for shop floors
- Payroll, ERP and HR integrations plus the export formats your bookkeeper already imports without complaining
- Compliance, licensing, and legal accountability are core features.
- Connectors, OAuth flows, and vendor API changes require constant upkeep.
Build, switch, or keep paying
Narrower, with trade-offs
A local web app where people clock in and out, log time against projects, request time off, and export approved monthly timesheets as CSV or PDF.
Use the build brief ↓No checked option yet
Compare the prior art below or build only the workflow you need.
$7.20/mo
Companies do not buy time tracking because timers are hard, they buy it because a missing time record is a fine and a disputed overtime claim is a lawsuit. The paid version comes with rule sets for breaks, overtime and absence accrual per country, exports that payroll accepts, apps that work on a phone in a van, and a vendor to point at when something is wrong. A self-hosted app you wrote yourself is fine for your own invoicing and a bad idea the moment an employee disagrees with it.
Visit TimeTac ↗Why people still pay
Companies do not buy time tracking because timers are hard, they buy it because a missing time record is a fine and a disputed overtime claim is a lawsuit. The paid version comes with rule sets for breaks, overtime and absence accrual per country, exports that payroll accepts, apps that work on a phone in a van, and a vendor to point at when something is wrong. A self-hosted app you wrote yourself is fine for your own invoicing and a bad idea the moment an employee disagrees with it.
Compliance, licensing, and legal accountability are core features.
Connectors, OAuth flows, and vendor API changes require constant upkeep.
Years of history, configuration, and habits make migration costly.
The brief
Context, requirements, acceptance criteria, non-goals, and the full production standard — as Markdown, ready for any coding agent.
Build brief — a focused alternative to TimeTac
Context
TimeTac — Cloud time tracking, attendance and leave management for teams, with clock-in via web, mobile and terminals. It currently costs $7.20/mo.
If you are one person logging hours against projects, this is a solved evening: a table, a timer, a CSV export, done. TimeTac is not sold for that, it is sold to companies that must prove who worked when, which in Spain means a daily time record that survives an inspection. An agent can absolutely build the clock-in screen, the leave calendar and the monthly timesheet PDF, and it will feel surprisingly complete. What it will not hand you is the tamper-resistant audit trail, the payroll and HR exports your accountant already accepts, and the phone app your field staff will actually open. So: yes for yourself, shaky the moment other people's paychecks depend on your SQLite file.
This brief describes a focused, single-operator replacement for the part of TimeTac that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.
What you are building
A local web app where people clock in and out, log time against projects, request time off, and export approved monthly timesheets as CSV or PDF.
Capture activity, categorize it, and report where the day actually went.
A responsive interface with real empty, loading, success, and error states.
Requirements
Functional
Node 20+.
Somewhere to run it that your team can reach, plus HTTPS if it leaves your laptop.
Backups you actually test, because these records are the evidence.
Non-functional
Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
Security: server-side secrets, validated input, and no credentials in the client bundle.
Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
Portability: the operator can export their data and leave without losing it.
Implementation brief
Build a self-hosted team time tracking app called Hours. Empty folder, no cloud services.
Stack, no substitutions: Next.js 15 with the App Router and TypeScript, Tailwind for styling, SQLite through Prisma, all data in ./data/hours.db. Session auth with an httpOnly signed cookie, secret in .env as SESSION_SECRET. No third-party auth, no telemetry, no analytics.
Data model: User (name, email, passwordHash, role of admin or member, weeklyHours, vacationDaysPerYear), Project (name, client, archived), TimeEntry (userId, projectId nullable, start, end nullable, note, breakMinutes, approvedAt nullable), Absence (userId, type of vacation or sick or unpaid, startDate, endDate, status of pending or approved or rejected), AuditLog (userId, action, targetType, targetId, before JSON, after JSON, createdAt).
Member views: a big clock in and clock out button showing today's running total, a project picker, an editable list of this week's entries with hour totals per day and week, an absence request form, and a personal balance showing hours worked versus contracted and vacation days used versus remaining.
Admin views: everyone's entries for a chosen month in a grid, one-click approve per user per month which locks those entries from editing, approve or reject absence requests, CRUD for users and projects, and exports: CSV of entries filtered by month and user, plus a printable HTML monthly timesheet per user with signature lines.
Every create, update and delete on TimeEntry and Absence writes an AuditLog row. Never hard delete a TimeEntry, use a deletedAt flag and keep it out of totals.
Rules: overlapping open entries are rejected, entries longer than 12 hours warn on save, a configurable auto break deduction of 30 minutes past 6 hours is applied at display time not at write time.
Out of scope, do not build: mobile apps, GPS or geofencing, payroll integrations, invoicing, multi-tenant orgs, email sending.
Ship a seed script with two users, three projects and a week of sample entries, a README with setup and backup instructions, and Vitest tests for the totals and break deduction math.
Delivery standard
Inspect the repository first, then write a short implementation plan before writing code.
Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
Add structured logs around every external call and return actionable errors without leaking sensitive details.
Write unit tests for the core logic and one automated test of the main user journey.
Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.
Acceptance criteria
A clean install starts the app using only the README and .env.example.
The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
Tests, type checking, linting, and a production build all pass with no ignored failures.
No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.
Non-goals
Do not build these, and do not claim to have replaced them:
Legally defensible records: no tamper-evident log, no retention guarantees, nothing an inspector or works council will nod at.
Native iOS and Android apps with GPS, offline clock-in and geofencing for people who are not at a desk.
Hardware terminals and badge or fingerprint clock-in for shop floors.
Payroll, ERP and HR integrations plus the export formats your bookkeeper already imports without complaining.
Someone else owning uptime, overtime rule edge cases and the shift and break math for each country.
What you still own after launch
Run migrations, backups, restores, and dependency updates.
Test the critical journey after every model, API, or hosting change.
Monitor failures and fix the edge cases a first prompt will miss.
Maintain every third-party integration as APIs and OAuth rules change.
Risk
High consequence. Use this as a prototype or personal aid. Keep a qualified human and an established provider in the loop for consequential decisions.
Editorial confidence in this assessment: medium. No reviewed project implementation is linked yet.
Generated by Can It Be Vibe Coded? · Full report: https://www.canitbevibecoded.com/timetac
You still own the product
- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.
Projects built from this idea
No reviewed implementation has been linked for TimeTac yet. A submission is evidence for review, not automatic proof that the whole product was replaced.
Built a version of TimeTac?Submit the project as evidence for this report.
Before you start
Can TimeTac be vibe coded?
Partly, if you narrow it. If you are one person logging hours against projects, this is a solved evening: a table, a timer, a CSV export, done. TimeTac is not sold for that, it is sold to companies that must prove who worked when, which in Spain means a daily time record that survives an inspection. An agent can absolutely build the clock-in screen, the leave calendar and the monthly timesheet PDF, and it will feel surprisingly complete. What it will not hand you is the tamper-resistant audit trail, the payroll and HR exports your accountant already accepts, and the phone app your field staff will actually open. So: yes for yourself, shaky the moment other people's paychecks depend on your SQLite file.
What can an AI coding agent reproduce from TimeTac?
A local web app where people clock in and out, log time against projects, request time off, and export approved monthly timesheets as CSV or PDF. Capture activity, categorize it, and report where the day actually went. A responsive interface with real empty, loading, success, and error states.
What will a DIY TimeTac replacement still be missing?
Legally defensible records: no tamper-evident log, no retention guarantees, nothing an inspector or works council will nod at; Native iOS and Android apps with GPS, offline clock-in and geofencing for people who are not at a desk; Hardware terminals and badge or fingerprint clock-in for shop floors; Payroll, ERP and HR integrations plus the export formats your bookkeeper already imports without complaining; Compliance, licensing, and legal accountability are core features.; Connectors, OAuth flows, and vendor API changes require constant upkeep.
What do I still own after building a TimeTac alternative?
Run migrations, backups, restores, and dependency updates. Test the critical journey after every model, API, or hosting change. Monitor failures and fix the edge cases a first prompt will miss. Maintain every third-party integration as APIs and OAuth rules change.