Privacy Policy
Effective November 3, 2026. How information is handled by features you use on Android and iPhone.
Controller and contact
TES E&C Co., Ltd. · Representative: Jin-ho Kim · Business registration: 659-86-03574
Privacy contact: tesenc@naver.com · +82-31-708-7750
Room 205, 42 Jangmi-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
Mail-order sales registration: 2026-성남분당A-0982 · Issuing authority: Seongnam-si, Gyeonggi-do
Information stored on the device
Photos, videos, projects, folders, board text, scans, PDFs, OCR results and capture settings are stored on the device. We do not automatically upload or back up captured originals. When you share, the operating system sends selected files to the app you choose.
Permissions
Camera access supports capture and scanning; microphone access supports video sound and voice commands; photo access supports saving, importing and deleting copies you select; location supports GPS, address, map and weather displays. You can revoke permissions in device settings, which may disable related features.
Location, maps and weather
GPS or a manually selected position can be included in photo metadata and overlays. Address lookup uses the device geocoding service. Standard maps use OpenFreeMap and satellite maps use EOX; requests can reveal the map area, zoom level and IP address. Weather, sunrise/sunset and estimated elevation send latitude/longitude rounded to three decimal places to MET Norway. Sunrise/sunset also sends the date and time-zone offset. Rounded coordinates are not assumed anonymous. You can disable location permission and related displays. We do not separately attach precise coordinates to advertising requests.
Voice commands and AI
Apple, Google or the device speech service transcribes audio; processing can occur on a server depending on the service, language and settings. AI interpretation sends recognized text, language, up to 500 existing folder paths, selected folder, creation base, date/weekday/time-zone/calendar context and a signed entitlement to Cloudflare Workers/Workers AI. Personal information in commands or folder names can therefore leave the device. Avoid unnecessary personal information. Captured photos and original audio are not included in our AI interpretation body. Basic capture works without AI.
Our interpreter uses standard Workers AI inference. Cloudflare says it does not train models on this content and does not retain standard inference inputs/outputs beyond request processing. Security/legal exceptions and operational metadata are separate. Our own cache of generated results for rewarded-AI retries follows the retention table below. Workers AI data handling
Sign-in, trials and purchases
There is no separate Field Camera username/password account. Store verification processes product IDs, purchase tokens/transaction IDs, expiry/renewal/cancellation/refund states and installation/device bindings through the store and our verification server. We do not receive card or bank-account numbers. If you used the legacy Google-authenticated trial route, an identity token was transmitted; the server uses a hash of the verified account identifier and the first trial period to prevent repeat trials. Any profile/email claims in a transmitted identity token are distinct from the trial hash actually stored. Store subscription trials, legacy in-app trials and closed-test access are separate entitlements.
One-year tester Pro pass
Android redemption processes a SHA-256 code hash, installation ID, a device-binding hash derived from the Android identifier, Play Integrity app/license/device verdicts, and redemption/check times and expiry. These support Pro access, the three-device limit and fraud prevention. The raw code is transmitted during a request but is not stored on our server; Android Keystore encrypts the local copy. Hashed installation or device values remain pseudonymous identifiers, rather than being assumed anonymous.
iPhone uses Apple official Offer Code redemption and transaction verification, not the same Android code. Its implementation processes the product, transaction fingerprint, original purchase date, expiry, installation/device binding and App Attest key ID, public key and counter. Raw transaction JWS is not stored permanently on our server. Apple passes are processed through these exchange and verification procedures when offered in the app and store.
One-hour Pro from rewarded ads
When operationally enabled, rewarded-ad verification processes platform/app/build/ad-unit information, installation and device-binding values, session and reward-transaction hashes, issue/expiry times, remaining AI uses and integrity proofs. SSV customData uses an opaque session binding rather than email, photos or GPS. iPhone keeps its rewarded-ad attestation key in Keychain separately from the coupon pass key. Commercial access requires Google server verification and a signed entitlement, rather than the SDK earned callback alone. Verification needed for an ad reward is performed when you choose that feature.
For idempotent AI retries, the server temporarily stores the request ID/digest and generated result. The raw AI request is not stored in the reward-verification database, but generated folder names can be present in the result cache. That cache is scheduled for separate deletion at the original one-hour grant expiry, without extension by a later ad or verification. Separate device/verification metadata is configured for one day after activity on Android, or 30 days when an iOS App Attest key is present. Advertising-personalisation choices are distinct from these entitlement and fraud-prevention checks.
Advertising and diagnostics
Builds that request ads may use Google AdMob and its consent SDK. Android GMA Next-Gen and iOS Google Mobile Ads SDKs can, depending on their actual version/configuration, process IP addresses (which may infer general location), interactions such as launches/taps/video views, diagnostics such as launch time/hangs/energy use, and ad IDs, app set IDs and applicable account-related identifiers for advertising, analytics and fraud prevention. IP processing is separate from GPS permission. Deleting the ad ID or declining personalization does not establish that all transmission stops. Ad requests, including test inventory, can involve external SDK processing. Where required, the consent flow applies and the displayed privacy choices let you change your selection.
Retention, deletion and rights
- Email our privacy contact and state whether you request deletion, access, correction or restriction.
- We identify you and the relevant records using the minimum necessary details, such as app version, device model and approximate pass-redemption time. Do not send passwords, verification codes, card numbers or a complete pass code.
- We explain which records will be deleted, any effect on entitlement restoration, and records and periods required by law, then reply with the outcome. Device-only photos and videos can be deleted in the app or Photos by you.
| Data | Storage | Retention/deletion |
|---|
| Media, projects and settings | Device storage / Photos | Until you delete them. Uninstalling does not necessarily delete shared-storage, Photos or recipient copies. |
| Paid current-state snapshot and transaction hash | Verification storage | 30 days after the last state refresh. Only app/entitlement type, transaction hash, state, store expiry and check time persist; raw purchase tokens, receipts and Apple JWS do not persist in this cache. Separate from legally required transaction records. |
| Android one-year code hash, binding and term | Verification storage | Expiry + 30 days after redemption; revocation + 30 days if revoked; unused issuance records use redemption deadline + 30 days. |
| iPhone one-year transaction fingerprint/binding/term | Verification storage | Pass expiry + 30 days. Raw transaction JWS is not permanently kept in this store. |
| Rewarded-AI result and request ID/digest | Verification storage | Until that request's original one-hour grant expires. A later reward does not extend old result retention. |
| Rewarded-ad device/verification metadata | Verification storage | One day after activity on Android; 30 days when an iOS App Attest key is present. |
| One-year/test iOS App Attest keys/counters | Verification storage | Separate from ad keys. The later of campaign end or final redemption deadline + up to 366 days + 30 days. Verification challenges last five minutes. |
| Legacy first-trial history | Verification storage | A verified-account hash, first start/expiry and policy version prevent repeat trials. Retained while first-trial duplicate prevention remains necessary during service operation. These records have no configured automatic deletion deadline; deletion or restriction requests are reviewed against the need and legal grounds for retention. |
| Refund processing/recovery | Verification storage | Encrypted purchase-token recovery for an uncertain refund lasts up to 24 hours. Minimum completion/review status and request-time records are retained as necessary for transaction handling, disputes and applicable statutory records. Raw recovery tokens are not retained for that whole period. |
Where Korean e-commerce record-keeping duties apply, contract/withdrawal and payment/supply records are retained for five years, complaint/dispute records for three years and advertising records for six months. This does not mean that every voice, photo or device identifier is kept for those periods; only applicable minimum records are retained with other use restricted. Record-retention rule
Request access, correction, deletion, restriction or device replacement at tesenc@naver.com. Provide only necessary details such as device/app version, approximate redemption time and error text. Never send passwords, verification codes, card numbers or complete pass codes. After identity checks, we explain the outcome or any grounds for a restriction. If deletion would end remaining Pro access or restoration, we explain this first. Legally required records are handled separately.
Third parties and international processing
Google, Apple, Cloudflare, MET Norway, OpenFreeMap and EOX may process information internationally to provide their services. Their policies control locations and retention. Google · Apple · Cloudflare
Providers' separate logs
MET Norway describes logging IP addresses and requested coordinates, with API access logs stored in Oslo, Norway. Its policy gives an up-to-90-day IP retention period for weather-site users without accounts; separate security processing follows that policy. OpenFreeMap describes seven-day general/error logs and up to 30-day security-incident IP logs. EOX describes general access logs kept for less than a year with security-investigation exceptions. These provider logs are distinct from our entitlement verification storage.
Cloudflare Workers AI · Cloudflare DPA · MET API · MET Privacy · OpenFreeMap · EOX
Changes
We update this policy and effective date when features, SDKs or server flows change, with in-app notice where required.