Privacy Policy

This Privacy Policy explains how Denison Systems ("we", "us"), a sole proprietor based in California, USA, handles personal information in connection with the Civil Field Photos mobile application (the "App") and this website at the URL where you are reading this policy (the "Website"). For purposes of the EU and UK General Data Protection Regulation ("GDPR"), Denison Systems is the data controller for the limited personal information processed in connection with the App.

We have designed the App so that the photos and projects you create stay on your device. We do not operate servers that store, back up, or synchronize your photos. Limited personal information is, however, processed by a small number of third-party services that we rely on (Apple, Google, and RevenueCat) to deliver the App, resolve street addresses from coordinates, and process subscriptions. Those services are identified below.

Summary

• What we collect: we receive an anonymous subscription identifier and entitlement status from RevenueCat. We do not collect your name, billing details, or photos.
• What stays on your device: photos, annotations, GPS coordinates and reverse-geocoded addresses associated with photos, project and watermark settings.
• Selling or sharing: we do not sell or share personal information for cross-context behavioral advertising or any other commercial purpose.
• Your rights: you can delete all on-device data by uninstalling the App. EU/UK and California residents have additional rights described below.

Information stored on your device

The App uses the operating system's standard storage APIs to keep the following on your device:

• Photos you capture or import, along with annotations, dimension lines, watermarks, and any captions you add.
• Project and branding configuration (project names, logos, watermark settings).
• GPS coordinates, compass heading, altitude, capture timestamp, and a reverse-geocoded street address for each photo, used to render overlays on the photo itself.

This information remains on your device. It is not transmitted to us and we have no copy of it. When the App converts GPS coordinates into a street address, your device uses the native Apple or Google location and geocoding services provided by the operating system. It will leave your device only if you choose to export, share, or back it up (for example, by exporting a PDF, sharing photos via AirDrop or email, saving to your camera roll, or relying on your device's system backup such as iCloud Backup or Google One).

Photo metadata (EXIF)

Photos captured on a mobile device typically contain embedded EXIF metadata that includes GPS coordinates, capture time, and device information. When you export or share a photo, this metadata travels with the photo file unless your device or another tool strips it. We do not strip EXIF data from photo exports. You should be aware that sharing a photo may disclose its capture location to the recipient, even when the visible overlay is not present.

Information processed by third parties on our behalf

The following service providers (referred to as "processors" under GDPR and "service providers" under CCPA) handle a narrow set of information for us:

Apple and Google native location services

The App uses the native location and geocoding APIs provided by iOS, iPadOS, and Android to read device location and convert GPS coordinates into a human-readable street address. Apple or Google may process location-related information as part of providing those operating-system services, subject to their own privacy policies and the privacy settings on your device. We do not receive a copy of your GPS coordinates or address lookup requests.

RevenueCat (subscription processing)

RevenueCat, Inc. is a U.S.-based service that manages subscription entitlement state for the App. When you make a subscription purchase, RevenueCat receives information from Apple or Google including: device identifiers (Apple IDFV or Google advertising ID), country derived from your store account or IP address, app version, OS version, subscription product identifier, purchase and renewal events, and an anonymous user identifier we generate. We receive only an anonymous user identifier and the current entitlement status. RevenueCat's privacy practices are described at revenuecat.com/privacy.

Apple App Store and Google Play (distribution and billing)

If you obtained the App from the Apple App Store or Google Play, those platforms collect information about your download and any in-app purchase you make under their own privacy policies. We receive aggregated, non-identifying analytics from these platforms (for example, install counts and subscription metrics). We do not receive your Apple ID, Google account email, or payment information.

Vercel (website hosting and analytics)

The Website is hosted by Vercel Inc. and uses Vercel Analytics and Vercel Speed Insights to measure aggregated, privacy-preserving traffic statistics. These tools are designed to operate without cookies and without persistent cross-site identifiers. Vercel processes your IP address transiently to deliver the Website and to derive country-level traffic statistics. Vercel's privacy notice is available at vercel.com/legal/privacy-policy.

Permissions the App requests

• Camera — to capture site photos. Required for the App's core function.
• Location (while in use) — to read your latitude, longitude, compass heading, and altitude at the moment you capture a photo, so that this information can be rendered as an overlay on the photo and reverse-geocoded to a street address using native Apple or Google location services.
• Photo library — to import existing photos for annotation and to save exported photos, if you choose.

You may revoke any of these permissions at any time from your device's settings. The App will continue to function but permission-dependent features will be unavailable.

Sensitive personal information

Precise geolocation is treated as "sensitive personal information" under the California Privacy Rights Act and as a special category of data in some other jurisdictions. The App uses your precise location only at your direction, only while you are capturing a photo, and only to embed that location into the photo overlay. We do not use sensitive personal information to infer characteristics about you and we do not retain any record of your location on our servers.

Legal bases for processing (EU / UK users)

For users in the EU, EEA, or UK, our legal bases under GDPR are:

• Performance of a contract (GDPR Art. 6(1)(b)) — for processing the limited subscription data described above to deliver the App and your subscription entitlements.
• Legitimate interests (GDPR Art. 6(1)(f)) — for aggregated, non-identifying analytics on the Website to understand traffic and improve the site. You may object to processing on this basis.
• Consent (GDPR Art. 6(1)(a)) — for any optional communications that we may send and that the App will request your consent for at the time.

International data transfers

We are based in the United States. RevenueCat, Vercel, Apple, and Google are also U.S.-headquartered. If you are located in the EU, EEA, UK, or another jurisdiction outside the United States, your personal information may be transferred to and processed in the United States. We rely on the providers' published transfer mechanisms (including the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses) for these transfers. Links to each provider's public information about transfer safeguards are available in their respective privacy notices linked above.

Data retention

Photos and project data are retained on your device until you delete them through the App, uninstall the App, or reset your device. We do not retain server-side copies. RevenueCat retains subscription event logs for the period described in its privacy notice (typically the life of the customer relationship plus a limited period for legal and accounting purposes). Aggregated, non-identifying website analytics are retained by Vercel as described in its documentation.

Security

Because we do not operate servers that store your photos or project data, the security of that information is governed by the security controls of your device and operating system (such as device passcode, biometric lock, file-system encryption, and the App Store/Google Play sandbox). For the limited subscription data processed by RevenueCat on our behalf, we rely on RevenueCat's published security practices. We will notify affected users without undue delay, and in any event consistent with applicable law, if we become aware of a personal data breach affecting their information.

Children's privacy

The App is intended for adult professional users. We do not direct the App to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has used the App and we have processed information about them, please contact us using the address below and we will take appropriate steps to delete the information.

Your rights — EU, EEA, and UK

If you are located in the EU, EEA, or UK, you have the following rights under GDPR with respect to personal information we control:

• Access — to obtain a copy of personal information we hold about you.
• Rectification — to correct inaccurate or incomplete information.
• Erasure — to ask us to delete information we hold about you.
• Restriction — to ask us to limit processing.
• Portability — to receive your information in a portable format.
• Objection — to object to processing based on legitimate interests.
• Withdrawal of consent — at any time, where processing relies on consent.
• Complaint — to lodge a complaint with your local data protection supervisory authority.

Because most personal information is stored on your device and not on our servers, the practical way to exercise erasure is to uninstall the App. To exercise other rights, contact us at support@civilfieldphotos.com.

Your rights — California residents

California residents have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").

Categories of information we have collected in the past 12 months

• Identifiers — anonymous user identifier passed to RevenueCat. Source: generated by the App. Purpose: subscription processing.
• Commercial information — subscription product purchased and entitlement status. Source: Apple App Store / Google Play via RevenueCat. Purpose: delivering paid features.
• Internet or other electronic network activity — aggregated, non-identifying website traffic data. Source: Vercel Analytics. Purpose: improving the Website.
• Geolocation data (sensitive) — used only on-device to overlay location on photos. Not collected by us or our processors.

Sale and sharing

We do not sell personal information and we do not share personal information for cross-context behavioral advertising (as those terms are defined in the CCPA). We have not sold or shared personal information in the preceding 12 months and we have no plans to do so.

Specific California rights

• Right to know what personal information we have collected, used, disclosed, and the categories of sources, purposes, and recipients.
• Right to delete personal information we have collected, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to limit the use and disclosure of sensitive personal information to permitted business purposes.
• Right to opt out of sale or sharing — not applicable because we do not sell or share.
• Right to non-discrimination for exercising any of these rights.

To exercise any of these rights, contact us at support@civilfieldphotos.com. We will verify your request through reasonable means consistent with the sensitivity of the information and your relationship with the App. We do not charge a fee to respond to verifiable consumer requests.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes that affect how we use your personal information, we will provide reasonable advance notice through an in-App notice, an update to this page, or both.

Contact

Questions, requests, or concerns about this Privacy Policy or our data practices can be sent to support@civilfieldphotos.com. The controller of personal information processed in connection with the App is Denison Systems, a sole proprietor located in California, USA.