What leaves your phone, field by field.

All of the following is written only to the app’s own storage on your device and to your photo library if you choose to save there. None of it is transmitted anywhere:

• Photographs and their thumbnails, and any file you import to stamp
• Latitude, longitude, altitude and the accuracy of every fix
• Street addresses, and the offline cache of previously resolved addresses
• Notes you type onto a stamp, and any logo image you add
• Your stamp settings — which lines are shown, position, units, coordinate format

There is no account, no sign-in and no cloud sync. Nothing above is backed up to a server run by us; if you delete the app, it is gone from your side too, so keep the photographs you need in your photo library.

The app reports anonymous usage data so we can tell whether it is working — whether people who install it manage to take a photo, whether purchases go through, which iOS versions still need supporting. This is the complete list of fields.

installId

A random UUID the app generates on its own first launch and keeps in its own container. It is not the Apple advertising identifier, not the device serial and not linked to your Apple Account. Deleting the app destroys it; a reinstall produces a new one that cannot be connected to the old one.

appVersion, buildNumber

The version of the app that sent the record.

osVersion

The iOS version, for deciding what still has to be supported.

deviceModel

The model family, e.g. iPhone17,1. A family, shared by millions of handsets — not a serial number and not unique to your phone.

locale, region

Your language, and a two-letter country code as your App Store storefront already reports it — SG, MY, PH. Country, not city; nothing finer than that is collected or derived.

tier

Whether this install is on the free tier or has bought Pro.

events

Counts of things that happened, from a fixed list: app opened, photo taken, photo taken with a low-accuracy fix, batch import, stamp settings opened, location corrected by hand, upgrade screen shown or dismissed, purchase started, completed, failed or restored. Each event carries a timestamp and, at most, 8 numeric properties.

The event names are a closed list in the server’s own schema — the app cannot invent a new one — and event properties are restricted to numbers. A number cannot hold an address, a note or a file name, so the format itself prevents that data being sent by accident rather than relying on us to remember.

None of the following is transmitted, in any form, on any tier:

• Photographs, thumbnails, or file names
• Latitude, longitude, altitude, accuracy, or any derived position
• Street addresses or the address cache
• Notes, logos, or stamp text
• The Apple advertising identifier (IDFA) — the app does not request tracking permission because it has nothing to track you with
• Your name, email address, phone number, contacts, calendar or health data

Pro is a one-time purchase handled entirely by Apple. We never see a card number, a billing address, your name or your email address; Apple does not give them to us.

What is recorded against an install is the Apple transaction id and original transaction id, the product identifier, the time of purchase, the storefront country and whether the purchase was a production or sandbox one. That is enough to count sales and nothing else — a transaction id is not a person.

Your entitlement is decided on the device by StoreKit, not by our server. That is a privacy consequence and a practical one: Pro keeps working in a basement with no signal, because nothing has to be asked of us to prove you paid.

There are none. No advertising SDK, no attribution or install-tracking SDK, no third-party analytics service. The anonymous data described above goes to one server, run by the developer of this app, and is not sold, shared or passed on.

Address lookup uses Apple’s own geocoder on the device, as part of iOS. Payments go through Apple. Those are the only outside parties involved at all, and both are Apple.

The app asks for camera access to take photographs, and for location access while you are using it so it can compute the coordinate, the accuracy figure and the address for the stamp. Precise location is what makes the product work; a coarse fix would make the stamp worthless.

You can refuse or revoke either permission in iOS Settings. Without location the camera still works and the stamp simply carries the date and time — the app does not hold the shutter hostage.

The anonymous records are kept while they are useful for supporting the app. Because there is no account, there is nothing to log into and no profile to export: the install id is not linked to your name, your email or your Apple Account, and we have no way to work out which records are “yours” unless you tell us the id.

If you want the records for a particular install removed and you can supply that id, write to the address below and it will be deleted. Deleting the app from your phone removes the id from your side immediately.

This is a tool for field work. It is not directed at children, it collects nothing that identifies anyone, and it shows no advertising to anybody of any age.

These pages are static. They set no cookies, run no analytics, embed no fonts or scripts from another domain, and there is nothing here to consent to. The administrative area of this site is separate, password-protected and used only by the developer.

If any of this changes, the date at the top changes with it, and a change that widened what is collected would be described here in the same plain terms rather than folded into a paragraph.

Questions about any of the above, including ones that sound awkward: [email protected]. For anything that is not about privacy, the support page says what to include so it can be fixed quickly.