Field IMPACT Privacy Policy

Field IMPACT for Android (app.fieldimpact.android) and the website fieldimpact.app
Version of 18 October 2026 (wrong-password blocking added to 3.5). Effective from: 18 October 2026

1. Who is responsible

Field IMPACT is developed and operated by Tymur Savruk. The person or body responsible for the personal data described here (the "controller") is Tymur Savruk. In this policy "we" means the operator of Field IMPACT.

Field IMPACT is used by the ranger teams of the Cardamom Forest Protection Program.

Contact for anything about privacy: savruktimur@gmail.com

2. Who the app is for, and the two versions

Field IMPACT is a work tool for the staff of ranger patrol teams and for the person who runs the patrols (the "administrator"). A team account is created by the administrator and works on one phone that the administrator has approved. Nobody can create an account in the app. People without an account cannot use it.

The Android app has two parts: the Field IMPACT website shown inside the app (sign-in, the team's map and navigator), and the app's own GPS recorder, which runs in the background.

Field IMPACT is not affiliated with EarthRanger. EarthRanger is a separate system the organisation uses; it is mentioned here only because of how the two are used together (sections 5 and 6).

3. What is collected, and why

3.1 Precise location from the recorder, also in the background

What: the phone's GPS position. For each point: the time of the GPS fix, latitude and longitude, accuracy, speed, direction, altitude, and the battery level and charging state at that moment.

When: once recording has started (see the table in section 2), the recorder runs all the time – with the screen off, when the app is closed or not in use, and after the phone restarts. It is not limited to patrol hours: pressing Start or End of a patrol on the map only marks the patrol, it does not stop the recording, and the app has no button to stop it (see section 10). If Android closes the recorder, the app starts it again (an alarm a few seconds later, and a check every 15 minutes). While it records, the notification "Field IMPACT is recording the track" is shown – in the website version only if notifications are allowed. By default the phone takes a GPS fix every 10 seconds and keeps a new point every 25 metres moved; when the phone stands still it keeps one point every 5 minutes.

Why: to record each team's patrol route; to show the administrator where teams are and where they have been; to plan and check patrols; to detect gaps in the record.

Points are kept on the phone until they can be sent (there is often no mobile signal in the forest) and are then sent to the Field IMPACT server.

3.2 Location used by the website inside the app

While a page of the website is open, it may use the phone's position: to show your position on the team's map and navigator; to record the navigator's own track while it is open (those points are sent to the server under the team account); once when you sign in (3.5); for the place stamped on a patrol photo (3.7); and the last position the page received is attached to a problem report (3.8). In the Google Play version the team's navigator reads the position only from a tap on Start until End, and only once the explanation before Android's location question was accepted; outside that, it reads no new position (a photo or a problem report made after End carries the last position read before End, the photo marked with its age; the app's own recorder, 3.1, runs on after End). In the website version the navigator reads it whenever it is open.

3.3 Events on the phone

What: a short record each time one of these things happens: location switched off or on; airplane mode on or off; the phone switched on; the app updated; the recorder closed by the system, restarted, or unable to start; the location permission reduced or restored; battery optimisation applied to the app or lifted; the phone's battery saver on or off; the charger connected or disconnected; a position coming from a fake-GPS ("mock location") app; the phone's clock differing from GPS time by more than 2 minutes. Each record carries the time, the last known position and the battery level.

Why: so that a gap in a patrol record can be explained (for example a flat battery or no permission), and so that a phone cannot be silenced or its position faked without it being seen.

3.4 Identifiers and account names

• Recorder ID – a random code made by the app on the phone (for example fi-xxxxxx-xxxxxx-xxxxxx-xxxxxx), or an ID given by the administrator. Every location point, phone event and notice check (3.9) is sent with it. The server accepts points only from IDs the administrator has approved; an unknown ID that tries is noted with the internet (IP) address it came from.
• Phone sign-in ID – at the first sign-in the website makes a long random secret and keeps it on the phone (a cookie that lives up to 400 days, and the page's storage). The server keeps only a one-way fingerprint (hash) of it, never the secret itself. It ties a team account to one phone.
• Account and unit name – the name of the team account and of its unit, as set by the administrator.

Why: to know which team a point or a report belongs to, and to make sure an account is used only on the phone it was given to.

3.5 Sign-in

What: the team name typed in (teams have no password; the administrator signs in with a name and password); the phone sign-in ID (3.4); one GPS position with its accuracy, sent with the sign-in request; the IP address the request came from; and what the app says about itself (Android version, phone model, app version). Each sign-in, refused sign-in and phone approval is written to a log. Wrong passwords: after 3 wrong passwords for one name from one address (or 10 for one name from anywhere within a day), new sign-ins with that name are blocked until the administrator lifts the block; every attempt is logged with the time, the IP address and the browser and device description.

Why: a team account may be connected to a phone only at the team's own station; the position shows whether the phone is there. The log protects accounts against misuse.

3.6 Use of the website

What: which pages are opened and which files are exported, with the account name, unit, phone ID, time, IP address, phone model and app version, screen size, window size, pixel density, language, time zone, network type and whether the page was used offline. Pages also show the signed-in name on screen (a "watermark").

Why: security – patrol positions are sensitive information, so the administrator can see who opened or exported what, and when. The administrator also gets a daily summary of page views.

3.7 Photos

The team's navigator has a camera button. The photo is stamped with the date, the time and the full UTM coordinates of the place. The full stamped photo is saved in the phone's gallery (folder Pictures/FieldIMPACT), and a copy of it, with a miniature, the time, the position and its accuracy, is also kept in the app's own storage on the phone. The app does not delete those copies by itself: the map shows the photos of the last 3 days, older copies stay in the app's storage until the app's data is cleared or the app is uninstalled. Photos in the gallery stay until you delete them. From the gallery the ranger decides where to share a photo.

Only a small preview of the photo (a miniature of at most 120 kB) is sent to the server, with the time, the position, its accuracy, the account and the unit, so the administrator can see on the map where a photo was taken. The full photo is not sent.

The camera is used only when you open the camera in the app.

3.8 Problem reports

What: when you use "Report a problem": the text you write (up to 4,000 characters) and/or a voice message you record (up to 2 minutes). The app adds by itself, without asking: the account name, unit and phone ID; the page you were on, its title and the open tab; the time; the last GPS position the page had received (latitude, longitude, the same position in UTM, its accuracy and the time of that fix), if it had one; screen size, window size and pixel density; language and time zone; network type; whether the phone was online, and whether the report waited in the phone for a connection; whether the page was running as an app installed on the home screen ("standalone"); the website build; the IP address; the phone model and app version.

Why: to understand and fix the problem, including where it happened. Reports are read by the administrator. A report written without a connection is kept on the phone and sent when the connection is back. The microphone is used only while you record a voice message.

3.9 Notices to the team

Every 15 minutes, and when the app is opened, the phone asks the server for new notices for its unit (for example a changed task), sending its recorder ID. Notices hold only words about tasks and the app, never a position. A phone is given only notices of the last 3 days; the server keeps the last 300 notices.

3.10 Server logs

Like most web servers, the Field IMPACT server writes a technical log of the requests it receives: the time, the IP address, and the address that was requested – which for notice checks includes the recorder ID. Refused recorder IDs are logged with the IP address they came from.

Why: to run the server and to find faults and misuse.

3.11 What stays on the phone

Location points and phone events waiting to be sent (the last 300 events already sent are kept too); the recorder ID; settings and the last GPS fix; the sign-in; navigator tracks, page-use records and problem reports (including voice messages) not yet sent; the copies of patrol photos described in 3.7; map pictures kept for use without signal. Phone backup and phone-to-phone transfer are switched off for the app, so this data is not copied to a cloud backup or to another phone. Uninstalling the app, or clearing its storage, removes it from the phone; photos already saved to the gallery stay there until you delete them.

3.12 What is not collected

Field IMPACT does not read contacts, calls, text messages, e-mail, calendar, the list of other apps, or files on the phone. It contains no advertising, no analytics service, no crash reporter and no other tracking library. It does not use an advertising ID. It does not sell data.

4. Phone permissions

You can see and change these permissions in the phone's settings (Settings → Apps → Field IMPACT → Permissions). If location is taken away, recording stops and this is reported as a phone event (3.3).

Managed service phones (website version only). On a phone that the organisation has set up with a cable as a managed service phone ("device owner"), the website version of the app also:

• gives itself the location permissions (including "all the time") and the notification permission, and switches the phone's location on;
• stops the phone's location switch from being changed;
• prevents the app from being uninstalled;
• blocks "Force stop", "Clear storage" and "Disable" in the settings – for every app on the phone, not only Field IMPACT;
• blocks the developer options (so no fake-GPS app can be used), starting the phone in safe mode, and resetting the phone to factory settings;
• installs its own updates without a tap.

This is used only on phones the organisation provides for work. Only the administrator can remove it, on the phone, with an owner code. The Google Play version contains none of this.

5. Automatic checks

• Sign-in at the station. A team account is connected to a phone only when the phone's position at sign-in is within 200 metres of the team's station or patrol start point. Otherwise the request waits for the administrator, who can allow it.
• First patrols of a newly connected phone. For the first days after a phone is connected, the server compares the phone's track with the same unit's patrol track that the organisation already holds in EarthRanger. If the phone is clearly travelling with another unit, far from its own, the phone is disconnected, the account is locked, and the administrator is told. The administrator then looks at it and decides; nothing further happens automatically.
• Fake GPS and wrong clock are recorded as phone events (3.3).

6. Who receives the data

• The administrator sees all data described above.
• A team sees, on its own phone: its task and plan; route lines built from earlier patrol tracks; its own piece of the satellite map; the track it is recording now; and the photos kept on that phone (3.7). A team cannot read back from the server its finished tracks, its track history, the photo previews, its problem reports or any other team's data.
• The Cardamom Forest Protection Program: [WHO IN THE ORGANISATION, BESIDES THE ADMINISTRATOR, CAN SEE FIELD IMPACT DATA, AND IN WHAT FORM - e.g. reports].
• Hosting. The Field IMPACT server is rented from Hetzner Online GmbH; the server is in their data centre in Nuremberg, Germany.
• Map providers. To draw the map, the phone or browser downloads map pictures directly from: OpenStreetMap's tile servers (tile.openstreetmap.org), Esri (World Imagery satellite map, server.arcgisonline.com) and Amazon Web Services (terrain heights, s3.amazonaws.com) on the team's map; the administrator's pages also use OpenTopoMap (tile.opentopomap.org). Like any website, these providers receive the IP address, the app or browser description, and which map pictures are asked for – that is, which area is on the screen. On the team's map this is usually the area around the phone's own position, so it shows roughly where the phone is. They do not receive the track, the account or the recorder ID. Their own privacy policies apply.
• Google location services. On phones with Google Play services, the app gets its positions from Google's location service on the phone. Google may process location data under its own privacy policy according to the phone's location settings.
• Telegram – only if the administrator switches it on (it was switched off on 13 October 2026): notices to the administrator (sign-ins, exports, problem reports including the voice message and the reported position, and a daily summary of page views, with the account name, IP address and phone model) are then also sent to the administrator's own Telegram chat, through Telegram's servers.
• EarthRanger. Field IMPACT sends nothing to EarthRanger. The Field IMPACT server reads, without changing anything, the patrol records that the Cardamom Forest Protection Program keeps in its own EarthRanger system, to show them together with Field IMPACT data and for the check in section 5. Photos or reports that a ranger puts into EarthRanger go there through the EarthRanger app, not through Field IMPACT.
• The law. Data may be disclosed where the law requires it. [CONFIRM: and where needed as evidence in a legal case about a patrol]

Data is not sold, not used for advertising, and not given to anyone else.

7. Where the data is kept

Data is sent from phones in Cambodia to the Field IMPACT server in Germany (European Union), over an encrypted connection (HTTPS), and stored there.

8. How long it is kept

At the time of writing the server deletes none of the records below automatically, except where a fixed limit is named. The periods marked in yellow will be applied once they are decided.

[CONFIRM: Records needed as evidence in a legal case may be kept for as long as that case requires.]

9. Security

• All connections use HTTPS. The app refuses unencrypted connections. It opens only Field IMPACT's own pages inside the app (map pictures are fetched from the providers in section 6); other links open in the phone's browser.
• The app contains no password or key to the server. It contains only a one-way fingerprint (hash) of the administrator's owner code.
• The phone's sign-in secret is stored on the server only as a one-way fingerprint.
• Only the administrator can sign in to the server, with a security key, not a password. The Field IMPACT service runs under its own account on the server.
• Inside the app, screenshots, screen recording and downloads of the map and tracks are blocked unless the administrator allows them on that phone.

No system is completely secure.

10. Your choices and rights

• Permissions. You can take any permission away in the phone's settings. Without location the recorder cannot work, and this is reported (3.3).
• Stopping recording – Google Play version. The app has no button to stop the recorder. It stops when you take the location permission away, when you switch off Field IMPACT's notifications (or its "Track recording" notification type), when you clear the app's storage, or when you uninstall the app.
• Stopping recording – website version. The app has no button to stop the recorder. It stops when the location permission is taken away or the app is uninstalled. Switching notifications off does not stop it. On a managed service phone (section 4) neither is possible; ask the organisation.
• When the administrator switches a unit off on the server, the server stops accepting that phone's points; the phone keeps them.
• Access and correction. You can ask what data is held about you or your team, and ask for it to be corrected.
• Deletion. You can ask for your data to be deleted. How: fieldimpact.app/data_deletion.html.
• Write to savruktimur@gmail.com. We answer as soon as we can; a guaranteed response time is being set. Depending on where you live, you may also have the right to complain to a data protection authority.

11. Children

Field IMPACT is a work tool for adult staff. It is not directed at children and must not be used by anyone under 18. We do not knowingly collect data about children. If you believe a child's data has reached Field IMPACT, write to savruktimur@gmail.com and it will be deleted.

12. Changes to this policy

When the app or this policy changes, the new version is published on this page with a new date.

13. Contact

Tymur Savruk, operator of Field IMPACT
E-mail: savruktimur@gmail.com
Postal address: [POSTAL ADDRESS]
Website: https://fieldimpact.app