No data leaves your device unless you've explicitly pressed the button to email your exported data to the email address you've configured. When doing so, the following data will be emailed to you as a CSV file: Employee Name, Punch-in/out Times, internal Time Clock generated ID and calculated hours worked.
No third party services are used.
Employee clock punch images are stored on your device. They are never uploaded to the cloud or shared with anyone. Furthermore, periodically, old images are deleted from your device (mostly just to save space, but it feels like a nice thing to do privacy-wise as well).