Privacy Policy

Last updated: 23 September 2026

Spatialize Systems ("we", "us", "our") makes the Spatialize Tavak mobile application (the "App"). This policy sets out what information the App handles, what we do with it, and who else ever sees it.

Using the App means you accept that information is collected and used as described here. If you are not happy with that, please do not use the App.

1. Information We Collect

1.1 Location Data

• Precise location (GPS): with your permission, the App reads GPS coordinates as you work, in order to record survey tracks, place landmarks and watch geofences. That includes location in the background while a survey is recording.
• What it is for: the surveying itself. Recording a track, capturing a coordinate, measuring a distance, raising a geofence alert.
• Where it is kept: on your device, in a SQLite database. It is never sent to a server of ours. If you enrol the App into an organisation's fleet, your position goes to that organisation's server while a survey is open. Section 5 sets out exactly what is sent, and how you come to agree to it.

1.2 Photos and Videos

• The camera: with your permission, the App uses your camera to take geotagged photos and videos of the site.
• Your gallery: the App does not read your photo gallery or media library. Files you import, whether basemaps, layers or survey archives, are picked one at a time through the system file picker.
• Where it is kept: on your device. Exporting or sharing it is entirely up to you, and when.

1.3 Device Information

• Device identifier (full version only): the full version is licensed to one phone at a time (Terms, section 2.3). After a purchase or a restore, the App sends our licence server a one-way SHA-256 hash of the phone's Android ID combined with the App's package name, plus a short device name such as "Xiaomi Mi 8", the platform, the App version and the Google Play purchase token. The server keeps the hash, the device name, the registration date and a hash of the Google Play order id. It never receives the raw Android ID, your Google account, your name, or any survey data. The free version never contacts the licence server at all, and nobody collects an advertising ID, an IMEI or a hardware serial.
• IP address: the licence server is reached over HTTPS, and its web server keeps ordinary access logs. Those include your IP address and are deleted when the logs rotate, after 14 days. Requests for map tiles, to OpenFreeMap and to any tile service you add yourself, and purchase checks with Google Play, show your IP to those third parties under their own terms. We neither see nor store any of that.
• Operating system version: the App does not collect it. The platform store may use it to filter for compatibility, which is out of our hands.

1.4 Survey Data

• Your projects: every survey, feature, attribute and measurement you create is stored on your device.
• Exports: you can export to GeoPackage, with a QGIS project, and to Shapefile, GeoJSON, KML, GPX and spreadsheet formats. The files land in your device's storage, under your control. Bear in mind that an exported photo carries the place it was taken in its EXIF metadata, and every exported table carries the coordinates of what you recorded. Treat an export the way you would treat any other document with locations in it.
• Android backup: on Android, the App's database, meaning the surveys, objects, attributes, GPS tracks, geofences, landmarks and settings, goes into Google's device backup for your own Google account, so that a reinstalled or replaced phone can restore it. Photos and videos are not part of the cloud backup, though they are part of a direct device-to-device transfer. Your subscription state is never backed up. You can switch device backup off in Android Settings → Google → Backup.

1.5 Your Name

• The App asks for your name when it first starts, so that the work you hand over says who did it. Your name is written into the surveys you export, and into the photo watermark if you turn that on.
• Where it is kept: on your device, and we never receive it. You can change it whenever you like in Settings. If you enrol into an organisation's fleet, the surveys your phone delivers carry your name to that organisation's own Server, and that organisation may have set the name itself on the phone it issued you (section 5).

2. How We Use Your Information

• To make the surveying work at all: GPS tracking, the map, collecting the data.
• To check with Google Play whether you have bought the full version, and to register the one phone that holds it.
• To spot and stop abuse and security incidents.
• To make the App faster and to fix what is broken.

3. Data Storage and Security

• On the device first: the App is built to work offline, so your survey data, your location history and your media live on your device.
• Encryption: the cached record of your subscription is held in the platform's own secure storage, which on Android means encrypted preferences backed by the Keystore. Survey data sits in a local database with no encryption of its own, protected by whatever protects your device.
• Over the network: everything the App sends or fetches goes over an encrypted HTTPS/TLS connection. That covers map tiles, the optional address lookup, Google Play purchase checks, the licence registration, and, if you have enrolled, your organisation's own server. The only server of ours the App ever talks to is the licence server described in section 1.3, which is hosted in France, in the European Union. No survey data, location history or media ever reaches it. An organisation's Tavak Server is run by that organisation, wherever it chooses to run it (section 5).

4. Third-Party Services

• Turning coordinates into an address (optional, off by default): if you switch on the "Include Location" address line for photo watermarks, the App asks your device's map provider, which is Google, to turn that one photo's GPS coordinates into a street address. Those coordinates go to that provider under its own terms. Nothing happens unless you switch it on, and only that single point is ever sent, never your track.
• OpenFreeMap: the built-in basemap loads its style and its tiles from OpenFreeMap (tiles.openfreemap.org), which serves OpenStreetMap data. Those requests carry your IP address, the App's name and version, and the area you happen to be looking at. OpenFreeMap is not ours, and we send no personal identifier along with the requests. Tiles you have viewed are kept on your device so that the same area draws again offline.
• Tile services you add: if you add an online basemap yourself, say OpenStreetMap's own tile servers or some satellite imagery, the App loads tiles from the address you typed in, and that provider gets the same kind of request under its own terms.
• Google Play Billing: every purchase, the lifetime one and the subscriptions alike, is handled entirely by Google Play. We never see your payment card or your Google account details. The App passes the purchase token Google issues to our licence server, which asks Google's Play Developer API whether that token is a valid purchase that has not been refunded. See the Google Privacy Policy.

5. Working for an Organisation (Company Mode)

Tavak can be used on your own, or as part of an organisation's fleet. Nothing in this section happens unless you deliberately enrol. Enrolling means scanning a code your organisation gives you, reading a screen that lists exactly what the organisation will receive, and ticking a consent box. An App that is never enrolled behaves exactly as the rest of this policy describes.

The organisation's server belongs to the organisation. When you enrol, your phone connects to a Tavak Server your organisation runs on its own infrastructure. We do not host it, receive its data, or read it. For everything sent to it, your organisation is the data controller, not Spatialize Systems, and their own privacy notice and your employment or contracting terms govern what happens to it. Questions about that data go to them.

While enrolled, your phone sends that server:

• The surveys you capture, with their photos, videos and attributes, on whatever schedule the organisation sets, and whenever you tap "Deliver now". A delivery is a copy; nothing is deleted from your phone.
• Your position while a survey is open, at whatever interval the organisation sets, and never more often than once every five minutes. With no survey recording, your position is not reported at all. While it is being reported, a notification names both the App and the organisation receiving it.
• The state of the phone at each status report: the battery, the free storage, the network type, the App version, the device name, and which of the organisation's deployments are installed.
• Who is holding the phone: the surveyor name and reference the organisation set when it issued the enrolment.

Your organisation can also send things to the phone: work to do, map layers, basemaps, forms, places to visit, and settings it locks. A locked setting is marked "set by your organisation" in the App, so you can always see which ones they are.

Leaving. You can leave the organisation from inside the App whenever you want. Reporting stops at once, the locked settings are released, and the surveys already on your phone stay on your phone. Your organisation can also release the phone from its end, which comes to the same thing.

6. Data Retention

• On your device: kept until you delete the App, or delete the projects yourself. We hold no copy of your survey data on any server. If you are enrolled into an organisation's fleet, that organisation holds whatever has been delivered to it, on its own server, under its own retention rules (section 5).
• Purchases: payment and subscription records are Google Play's, kept under Google's own retention policies. For each purchase, our licence server keeps the hashed order id, the product, a subscription's expiry date, and the registered phone's hashed identifier, device name and dates. It keeps them for as long as the purchase is valid, and for up to 12 months after it ends or is refunded, so that refunds and support questions can be dealt with. Licence check logs, which hold the hashed identifier, the outcome and the time, are kept for 90 days.

7. Your Rights

Depending on where you live, you may have the right to:

• See the personal data we hold about you.
• Ask us to correct it, or to delete it.
• Withdraw your consent to location tracking. You can turn it off in your device settings, though that will leave much of the App unable to work.
• Ask for a copy of your data in a portable format.
• Release your phone from the licence, under Settings → Full Version → Release, or ask us to delete the hashed identifiers our licence server holds for your purchase.

To do any of this, write to us at the address below.

8. Children's Privacy

The App is not meant for children under 13, and we do not knowingly collect personal data from them. If you find that a child has given us personal data, tell us and we will delete it.

9. Changes to This Privacy Policy

We may change this policy from time to time. When we do, the new version goes on this page and the "Last updated" date changes with it. It is worth looking back here now and again.

10. International Data Transfers

The only server of ours that handles your data is the licence server described in section 1.3, which is hosted in France, in the European Union, and never receives survey data, location history or media. Anything shared with Google Play to process a subscription falls under Google's privacy policy and may cross borders under Google's terms. Map tile requests, to OpenFreeMap or to any tile service you add, go to that service's own infrastructure, wherever it happens to be.