(Google Play & Apple App Store Editions · Pro One-Time Lifetime Purchase · Non-Subscription)
SiteStake is a professional GPS/GNSS field survey and construction stakeout application built on a fully device-first / privacy-first architecture. Our privacy design principle:
If we don't need it, we don't collect it. If we don't have to upload it, we don't. If you don't actively share it, your data never leaves your device.
This policy explains when we do and do not process your data. We have no account system, no mandatory login, and we do not collect phone numbers, ID numbers, email addresses, or any identity information. All survey data is stored exclusively in your device's local app sandbox by default.
In the table below, "collect" means storage within your device's app private sandbox only (consistent with Google Play Data Safety definitions).
Any data that actively leaves your device or is uploaded to any server is marked with a special 🚀 indicator, along with the scenario and recipient.
| Data Category | Collected? | Purpose | Storage Location | Retention | Leaves Device? 🚀 |
|---|---|---|---|---|---|
| Precise GNSS Location (latitude, longitude, altitude, HDOP/VDOP accuracy, satellite count, raw NMEA fields) |
✅ Only while you actively use relevant features During track recording: continuous location via foreground service notification; continues when app is backgrounded or screen is locked |
① Show current position on map ② Record waypoints/tracks/survey points ③ Stakeout arrival alerts ④ Area/distance/slope measurement ⑤ Optional EXIF writing for GEO Camera | SQLite database within app sandbox (app_database.dart); Documents/nmea/ folder for NMEA logs |
Until you manually delete the entry or uninstall the app | ❌ Never uploaded Only leaves when you tap "Export/Share" and choose a destination app via the system share sheet |
| Photos & Media Photos taken by GEO Camera + image attachments imported from system gallery |
✅ Only when you actively capture/import | ① Field evidence documentation ② Optional EXIF GPS metadata writing (can be disabled) ③ Optional location/time watermark burning (can be disabled) ④ Waypoint/survey point attachments | App sandbox Documents/photos/ folder; optionally synced to system gallery (can be disabled in settings) |
Until you manually delete or uninstall | ❌ Never uploaded Only leaves when you explicitly share |
| Work Files GPX/KML/CSV/DXF/SHP files, raw NMEA logs, PDF inspection reports |
✅ Only when you import/export or manually enable logging | ① Import/export survey results ② File cabinet browsing ③ PDF report generation, printing, sharing | App sandbox Documents/ folder |
Until you manually delete or uninstall | ❌ Never uploaded |
| Sensors Barometer / accelerometer / magnetometer (compass) / gyroscope |
✅ Only while corresponding features run in foreground | ① Compass heading ② Barometric A→B relative altitude ③ Slope measurement ④ Map rotation heading | In-memory cache only, never persisted to storage | Released immediately when feature stops or app backgrounds | ❌ |
| Map Tile Cache Loaded raster tile images |
✅ Only in online layer mode (can be fully disabled for pure offline use) | Accelerate repeated loading, offline browsing | App sandbox tile cache directory | 30-day LRU auto-expiry, or clear anytime via Settings → Storage → Clear tile cache | ⚠️ Only your device makes GET requests to tile servers (OSM/Esri, etc.). Tile servers see your network egress IP (determined by your carrier; we neither receive nor store it). Tiles contain no SiteStake-specific data. |
| User Preferences Unit system (metric/imperial/mu), theme (4 options), language, coordinate datum, Helmert 7-params, map layers, export format defaults |
✅ | UI personalization, default workflow | App sandbox SharedPreferences | Until uninstall or "Restore defaults" | ❌ |
| Device Identifiers / AAID / IMEI / Phone / Email / Contacts / Clipboard | ❌ Not accessed at all | — | — | — | ❌ |
| Analytics / Tracking / Crash Reporting SDKs (Firebase / Umeng / Bugly / Adjust / AppsFlyer, etc.) |
❌ Not integrated | — | — | — | ❌ |
| Ad / Marketing SDKs (AdMob / Pangle / Tencent Ads, etc.) |
❌ Not integrated; no ads even in the free tier | — | — | — | ❌ |
| Registration / Login / Account System | ❌ No account system; all free features usable without registration | — | — | — | ❌ |
When you use the Track Recording feature, the app starts a Foreground Service and displays a persistent notification in the notification bar. This allows continued location collection in the following scenarios:
Design Rationale: Track recording often requires long-duration continuous logging. If location stopped when the app backgrounded, users could not complete field trajectory collection while the screen is off.
Your Control:
⚠️ Except for track recording, no other app features (waypoints, stakeout, measurement, etc.) collect location data in the background.
SiteStake performs network I/O only in the following 4 scenarios. Outside of these, we never proactively send any bytes:
| # | Trigger (must be a user-initiated action) | Recipient | Content Sent | Linked to Personal Identity? |
|---|---|---|---|---|
| ① | Scrolling the map in online mode requires loading new tiles | OpenStreetMap / OpenTopoMap / Humanitarian OSM / Esri World Imagery, etc. (online layers can be fully disabled in layer settings for pure offline mode) | Standard HTTPS tile URL (zoom level + tile coordinates) + your network egress IP (determined by carrier routing, cannot be masked) | ⚠️ Tile servers see your request source IP but not any SiteStake app data; we neither receive nor store this IP |
| ② | You actively tap "Share/Export" (survey results, tracks, PDF reports, NMEA logs, survey points, etc.) | System Share Sheet — destination app chosen by you (e.g., Email, Google Drive, etc.) | The files you selected | ❌ Entirely determined by the destination app you choose; unrelated to SiteStake |
| ③ | You actively tap "External Navigation" to jump to a third-party map app | Google Maps / system default map (if installed) | geo: scheme carrying target coordinates |
❌ Only coordinates sent; no identity information |
| ④ | Pro one-time purchase related: when you actively tap "Buy Pro" or "Restore Purchase" | Android: Google Play Billing (Google) processes the payment itself → RevenueCat Purchases SDK verifies entitlement iOS: Apple App Store / StoreKit processes the payment itself → RevenueCat Purchases SDK verifies entitlement |
Store side: transaction receipt (encrypted by Google/Apple; we never touch card numbers) RevenueCat side fields (strictly limited, see §3 list): anonymous UUID, product ID, price, currency, country code, transaction time, transaction ID, platform, app version |
✅ Linked to anonymous purchase ID (not personal information, see §3.2); absolutely never includes location, photos, or work data |
💡 Want to use completely offline? Turn off Wi-Fi + cellular data + switch all layers to "Offline Tile Cache" → achieves 100% no network requests (except for purchase/restore purchase).
Starting from v1.0, SiteStake offers SiteStake Pro (Lifetime / One-Time Purchase) to unlock 16 professional features (all map layers, custom Helmert 7-parameter datum, RTK, stakeout, PDF reports, 25-slot export matrix, etc.). Not a subscription, no auto-renewal, permanent use + permanent updates after purchase.
play.google.com → Payments & subscriptions).reportaproblem.apple.com or Settings → Apple ID → Media & Purchases).Purpose: To automatically restore your purchased lifetime Pro entitlement when you switch devices or reinstall the app (Restore Purchases feature). Without third-party verification, you would have to repurchase Pro on a new phone — which is clearly unreasonable.
Fields received by RevenueCat (and only these fields):
| Field | Source | Purpose | Personally Identifiable? |
|---|---|---|---|
app_user_id (anonymous) |
A UUID v4 generated locally on your device at first launch ($RCAnonymousID), completely unrelated to IMEI / Android ID / AAID / phone / email | Associate the same lifetime entitlement across reinstalls/device switches | ❌ Anonymous (unless you proactively email us to manually link it to your email; if you don't email, it stays anonymous forever) |
Product ID (sitestake_pro_one_time) |
Hardcoded in app | Identify as Pro lifetime entitlement, not another SKU | ❌ |
| Price, currency, country code | Google Play transaction data | Exchange rate conversion, refund detection statistics | ❌ Aggregated, depersonalized statistics; not linked to specific individuals |
| Transaction time, transaction ID (Google Play Order ID) | Google Play transaction data | Lifetime entitlement never expires (no expiry calculation); used only for Restore and refund detection | ❌ |
| Platform (Android), app version, OS version | Device information | Debug restore purchase failures and similar issues | ❌ |
Content RevenueCat never receives (and we never pass to the SDK):
To delete the lifetime entitlement verification record associated with your anonymous ID in RevenueCat:
[email protected] with subject "Delete Pro Account Data", and paste the anonymous ID in the body (or attach a screenshot of your purchase receipt)💡 Note: Deleting the RevenueCat anonymous record does not affect your lifetime Pro entitlement granted by Google Play (the entitlement itself resides with Google Play; when you reinstall and run Restore Purchases again, a new anonymous ID is generated based on your Google account purchase history — only the associated anonymous ID changes). Your lifetime entitlement rights are guaranteed by Google Play.
The free tier is permanently usable, no time limit, no ads, with only the following 4 quantity limits + 16 Pro feature locks (see pricing docs), which do not involve privacy:
| Type | Free Limit | After Pro Upgrade |
|---|---|---|
| Waypoints | ≤ 200 | Unlimited |
| Survey Points | ≤ 500 | Unlimited |
| Routes | ≤ 20 | Unlimited |
| Tracks | ≤ 50 | Unlimited |
Coordinate datums: WGS84 and CGCS2000 are free (global edition defaults to WGS84). Pro users unlock custom Helmert 7-parameter datum.
You have full ownership of all data on your device. We make this clear:
| Right | How to Exercise |
|---|---|
| Right of Access — view what data we store about you and how much | Open App → Settings → Storage → Data Usage Breakdown (shows waypoint count, survey point count, track count, route count, photo count, total file size, tile cache size) |
| Right to Data Portability — take all your data with you | Open File Cabinet → Select All → Export → choose GPX + KML + CSV + DXF + SHP + PDF batch packaging, or send to your own email/cloud drive via system Share Sheet |
| Right to Erasure / Right to be Forgotten | ① Single item delete: long-press or swipe left on any list item → Delete; ② Batch delete: multi-select mode → Delete selected; ③ One-tap clear all: Settings → Storage → Reset App Data (no uninstall needed); ④ Ultimate deletion: directly uninstall the app → entire sandbox permanently deleted by Android system |
| Right to Withdraw Consent — turn off permissions as you wish | System Settings → Apps → SiteStake → Permissions → turn off any of location / camera / Bluetooth / photos. After turning off permissions, corresponding features degrade (without location you can still manually enter points / browse offline / export saved data); you will not be locked out or forced to exit |
| Right to Lodge a Complaint | File a complaint with the supervisory authority in your jurisdiction: • EU: Data Protection Authority (DPA) of your member state • California, USA: California Attorney General's Office |
| Right to Delete Pro Anonymous Transaction Records | Follow steps in §3.3 via email; completed within 14 business days |
SiteStake is a productivity tool for professionals aged 18+ — engineers, surveyors, and inspection personnel. Our Play Store target audience is set to exclude users under 13.
We do not knowingly collect any personal information from children (in fact, we don't collect any personal information at all). If you are a parent/guardian and believe your child has provided us with any information, please contact [email protected] (though unlikely, we will cooperate to verify and delete).
When purchasing Pro, anonymous lifetime entitlement verification records are processed by RevenueCat and stored in its AWS us-east-1 (Virginia, USA) region.
Our safeguards:
RevenueCat is GDPR and CCPA compliant and has signed Standard Contractual Clauses (SCCs).
If you do not purchase Pro / do not tap "Restore Purchase" → no cross-border transfer occurs (free features are 100% completed on-device).
flutter_secure_storage (AES encrypted); entitlement state is not stored in SharedPreferencesusesCleartextTraffic=falseWe will not materially weaken the privacy commitments in this policy. If there are significant changes (e.g., adding an optional cloud sync feature in the future), we will:
For any questions, deletion requests, complaints, or Pro data deletion applications, contact us via:
[email protected]This privacy policy applies equally to the iOS edition distributed via the Apple App Store. All core privacy commitments — local-only data storage, no account system, no ad/analytics SDKs, no upload of location/photos/work data — are identical across Android and iOS. The following clarifies iOS-specific details:
Apple may collect standard App Store analytics (e.g., app downloads, crashes, install metrics) under Apple's own privacy policy. This data is collected by Apple, not by SiteStake, and is not linked to your in-app survey data.
Per Apple App Store requirements, our App Privacy labels declare: No Data Collected by the app itself (we do not collect or transmit personal data). In-app purchase receipts are processed by Apple/RevenueCat as described in §3.