Privacy

Siteseen is a field tool for landscape architects, made by devmesh, a software studio in Manitoba, Canada. This page covers the Siteseen apps for Android and iPhone, and this website, including the dashboard. It says what we collect, why, where it is kept, who else receives it, how long it lasts, and how to have it deleted.

The short version

• We hold your site visits once they upload, which the app does by itself: photographs, voice notes, notes, measurements and precise locations. That is the service. It is why you can open a visit on the dashboard.
• Visits are encrypted on your phone before they are uploaded, and stored encrypted. We hold the keys, so we can decrypt a visit to show it to you on the dashboard. This is not end-to-end encryption, and we do not describe it as that.
• Photographs, voice notes and reports expire 30 days after a visit was last worked on, synced or restored to a phone. We email you a week before.
• We do not sell your data, and we do not use it for advertising. There are no analytics, advertising or tracking tools in the apps or on this website.
• A small number of companies run parts of the service for us and receive data to do it. They are listed below by name.
• You can delete your account at any time, from the app or at siteseen.app/delete-account.

On your phone, and how visits reach your account

While you are signed in and your trial or subscription is active, the app uploads your visits by itself, in the background, while you work and when a visit ends. You do not have to press anything. By default it waits for Wi-Fi; you can allow mobile data in the app's settings. After a trial or subscription ends, visits already on the phone keep uploading for 30 more days, so that you can still get them from the dashboard.

Recorded voice notes are transcribed on the phone itself, on both Android and iPhone, and the audio is not sent anywhere to be transcribed. Separately, on Android, the microphone button for speaking a note instead of typing it uses your phone's own speech service, which is usually Google's. That service may process what you say on its servers, under Google's terms.

Siteseen opts out of the phone's own cloud backup, so your visits are not copied into Google's or Apple's backup of the device.

If you send a photograph from the phone, or download a visit from the dashboard and pass it on, it goes wherever you send it. We are not involved in that.

What we collect, and why

Your account

Your email address, your name if you give it, and your password, which we store only as a one-way hash that cannot be turned back into the password. We also keep your subscription status and dates and your storage quota, and which version of the Terms of Service you accepted and when, which you do when you confirm your email address. We need these to run your account.

We keep the internet address your account was last used from, so that we can spot a sign-in that was not yours if you ask us to look. We keep only the most recent one, it is replaced each time, and it is deleted with your account. For each signed-in session we keep the browser or app description it reported, until 30 days after that session ends.

Teams and sharing

If you create or join a team, we also hold the team's name; who is in it and whether each person is an owner or a member; its groups and who is in each; the name of each project the team shares; and who each project is shared with. Other people in your team can see your name and email address, because that is how they choose who to share with. When an owner invites somebody, we hold the invited email address and a one-way code for the invitation link until it is used or expires after 7 days.

A project's name is stored in plain text so that phones and the dashboard can list it. Unlike the contents of a visit, it is not encrypted on your phone first. The contents of a shared visit are protected exactly as any other visit and are shown to the people the project is shared with, and to the team's owners.

Every photograph, voice note, note, measurement and mark you add to a visit records who made it: your account's identifier and your name as it was at that moment. Edits and deletions of those things are logged the same way, with the time. This is kept inside the visit's encrypted record, so we cannot read it without opening the visit. It is shown to everyone the site is shared with, as a line such as "Taken by" on each item and on the visit's activity list, and it is included in the activity log when someone exports the visit. A phone that was not signed in records a random identifier and no name. Visits from older versions of the app carry none of this.

If someone in your team asks you to capture something (a photo of a spot, with a short note), we hold that request in plain text until 30 days after it is answered or cancelled.

If you turn on alerts, we hold a token that identifies your phone to Google (Android) or Apple (iPhone) so we can tell it a request is waiting. The alert says only that a photo is wanted and carries a request number. It never carries a place name, a note, a photograph or a name. We delete the token when you delete your account, when someone else signs in on that phone, and when the phone has not been seen for 60 days.

Your site visits

When a visit syncs, we receive what you captured on it: photographs, voice notes and their transcripts, notes, measurements, precise GPS positions and their accuracy, compass headings, place names, and the site's name, address and client name. We also receive the files the app makes from the visit on the phone (the PDF report, the spreadsheets, and the GeoJSON and KML map files), and the phone's make and model. Photographs carry their GPS position and heading inside the image file, because that is where the phone records it.

We use all of this for one thing, which is showing your work back to you: on the dashboard, and on a phone you sign in on later. We do not analyse it, aggregate it or use it to train anything.

To run the service we also keep, unencrypted, the outline of each visit: file names, types, sizes, counts and times. That is how the service knows what has arrived and what is missing, and how much storage an account is using. It does not include the contents of any file.

We also keep the name of each site you make, so a site shows on both your phone and the dashboard before it has a visit. A site name is encrypted the same way a visit is. If you share a site with a team, its name is kept as the team's project, as described below.

Sync activity

We keep a record of each sync, restore and check-in from the app, and each time a visit is opened on the dashboard, for 60 days. For the app it includes which version sent it; for the dashboard, the browser, its major version and the operating system. We use it to find out why something failed and to see how the service is being used.

Crash reports (iPhone and iPad only)

When Siteseen crashes, freezes, or is shut down by iOS for using too much memory, the app records what happened and sends it to us the next time it has a connection. A report contains which of those things happened, a short fixed phrase describing what the app was doing (for example "idle"), the technical description iOS produced, the app and iOS versions, the device model, and how much free memory the device had.

A crash report contains no survey data. The description of what the app was doing comes from a fixed list we wrote, never from anything you typed or captured. If you are signed in, the report is stored against your account, so we can tell whether a fault affects one person or everybody. If you are not signed in, the report is still accepted and stored with no account attached. The report is produced by Apple's own framework on the phone, and no company outside the list below receives it. Reports are deleted after 90 days.

The map

The satellite map comes from MapTiler, and every map request passes through our server first. MapTiler therefore sees which map area was requested, but not your internet address or anything about your account. We count how many map requests each account makes, but not where they were for.

Our hosting provider keeps its own record of each request for 30 days, including the address of the map area and the time. The internet address in that record belongs to our network provider, not to your device, and the record is not linked to your account. Our network provider, Cloudflare, carries every request and so does see your internet address. How long it keeps that is set by Cloudflare's own terms.

Other things the apps do

On Android, the app asks Google Play Services for AR whether your phone supports it. That service is provided by Google, under Google's privacy policy. After a visit, the apps may ask you to rate Siteseen. The rating goes through Google Play or the App Store, not through us.

To stop abuse, the service briefly holds your internet address and the email address being signed in with, in memory only, to limit repeated attempts. It is never written down, and it is gone within about 10 minutes.

Who at devmesh can see what

A small number of devmesh staff can see account details, sync activity, crash reports, map and storage use, and the outline of your visits, in order to run the service and answer support requests. Because we hold the keys, we could open a visit's contents. We do not, unless you ask us to, for example to help with a problem.

This website

The website sets one cookie, which keeps you signed in. It sets no tracking, analytics or advertising cookies, so there is nothing here to opt out of. Your browser also keeps two small preferences for the site, on your device only, never sent to us: whether you chose the light or dark theme, and your last choices in the export window.

Who else receives data

We do not sell or rent your data, and we do not share it with anyone for their own purposes. The companies below run parts of Siteseen for us, and receive only what their part needs:

We would disclose data to anyone else only if the law required us to, and only as much as it required.

Siteseen does not take payment yet. Before it does, this page will name who handles payments and what they receive.

Where it is kept

Our servers run in Toronto, Canada. The database is in Ohio, in the United States. Your visits' files are stored by Cloudflare in North America. Emails are sent by Resend, in the United States. We do not promise that your data stays in Canada, because it does not.

How it is protected

Everything travels over encrypted connections. When you open a visit on the dashboard, our service unlocks that visit's key and sends it to your signed-in browser, which decrypts the files itself. Each visit's files are encrypted on your phone with a key of their own before they are uploaded, and that key is itself protected by a master key. The master key is stored encrypted by Google Cloud's key management service, and we keep one offline backup copy of it. Photographs, voice notes and reports are held under a separate key, which is destroyed when they expire. After that they cannot be read by anyone, including us. Passwords are stored only as one-way hashes.

How long it is kept

Deleting a visit on your phone removes the phone's copy only. The copy on your account follows the timings above, and is removed completely when you delete your account.

Deleting your account

You can delete your account at any time, from the account screen in the app or at siteseen.app/delete-account, which works without the app installed. You will be asked for your password.

Your account closes straight away. You are signed out on every device, and nothing in it can be opened, downloaded or synced. About seven days later it is permanently deleted, in the next daily clean-up after the seventh day, together with everything we hold for it: every visit's photographs, voice notes, notes, measurements, locations and reports, your sign-in history, and any crash reports linked to your account. The seven days are there so that a deletion made by mistake, or by someone who got into your account, can be undone. Email support@siteseen.app before the date in the confirmation email and we will restore it. After that date nobody can recover it. Copies in our database provider's short-term backups are removed within 6 hours after that.

If you are in a team, you leave it when you ask for deletion: you are removed from its groups and from every project it shared with you, and the projects you made pass to a team owner so the team keeps its sites. Visits you captured are part of your account and are deleted with it, including those the team could see. If you are the last owner of a team that has other people, we ask you to make someone else an owner first. If you are the only person in the team, the team is deleted with you.

Visits stored on your phone stay on your phone. If you delete your account from the app, it asks whether to remove them too. We cannot reach them otherwise.

After your account is deleted we keep one thing, indefinitely: a one-way code derived from your email address. It is not linked to any other information and cannot be turned back into your address. We can only use it to check whether an address someone signs up with was deleted before, so that deleting an account and signing up again does not start another free trial.

If you cannot sign in, email support@siteseen.app from the account's address and we will delete it for you.

Your rights

You can see and download your visits from the dashboard at any time, including after a subscription has ended. The export window lets you choose one visit, several, or a whole site, and which parts to include (the report, photographs with or without markup, voice notes, spreadsheets, map files, the visit record and the activity log), as one zip, or one zip per visit. To get a copy of the other information we hold about you, to correct your name or email address, or to ask any question about this page, email support@siteseen.app. A person reads it, and we will answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator where you live.

Children

Siteseen is a professional tool for adults. You must be 18 or older to create an account, as our terms say, and we do not knowingly collect information from anyone under 18.

Changes to this page

When what we collect or how we use it changes, this page changes first, and the date at the top changes with it. If a change reduces your privacy, we will email you before it takes effect.

Contact

devmesh, Manitoba, Canada. support@siteseen.app