Dipper Field

Your data stays under your direction

Privacy Policy

Dipper Field is a local-first field data application from Insight Spatial L.L.C. We do not operate an advertising profile, analytics service, or Dipper Field account system. Network services are used only when needed for a feature you choose.

Effective October 27, 2026 · Version 1.5

1. Scope and who we are

This Privacy Policy applies to the Dipper Field mobile application for iOS and Android and the Dipper Field website at dipper.insightspatiallabs.com. Dipper Field is provided by Insight Spatial L.L.C., a North Carolina limited liability company (“Insight Spatial,” “we,” “us,” or “our”), 301 S McDowell St, Ste 125, PMB 1767, Charlotte, NC 28204, United States.

Dipper Field can be used without creating an account with us. The app is designed so that your project database remains in the app’s protected storage unless you choose to export, share, or transfer it.

For the limited information that reaches us, described in section 7, Insight Spatial is the controller: the business that decides how it is used. We do not receive the field data you collect in the app, so we are not a processor or service provider for it. If you collect information about other people, for example for an employer or client, you or that organization decide how it is used and are responsible for it.

2. Information Dipper Field processes on your device

Depending on how you use the app, Dipper Field may process:

  • Project and record data: project names, layer definitions, templates, form fields and answers, unique identifiers, labels, creation and modification times, symbols, search indexes, and notes.
  • Spatial data: point, line, and area geometry; GPS tracks; accuracy; altitude where available; map extent; measurement results; and geometry editing history or recoverable drafts.
  • Media: photos, videos, voice notes, audio captured with video, thumbnails, and metadata such as capture time, location, direction, and optional address or weather watermark information.
  • Scanned content: QR codes, barcodes, and recognized text that you choose to scan into a field.
  • Files and reports: imported datasets, exported packages, generated PDF reports, and transfer-task state.
  • Preferences: language, units, coordinate format, quality settings, display choices, and connected-service configuration.
  • Receiver and correction settings: the receivers you have connected, antenna height, and the address, mount point, and user name of any correction service you set up. Its password is kept in the iOS Keychain or Android’s protected credential storage.
  • Crash reports: if the app stops unexpectedly, Dipper Field writes a report on your device with the time, the app and operating-system versions, the device model, the error message, and where in the app’s code it failed. It keeps the five most recent.
  • Your name, if you enter one: the name you give in Settings is kept on your device and saved with the records you collect or change, so a project shows who did the work. It stays in the project files and reports that include those records, and anyone you share them with can see it. Entering a name is optional; without one, records are not attributed to anyone. Project files also contain random identifiers that Dipper Field creates for each copy of a project and each name you use; they are not derived from your device, account, or advertising identifiers.

This content is not automatically uploaded to Insight Spatial. You are responsible for determining whether your field data contains personal, confidential, regulated, or employer-controlled information and for collecting it lawfully.

3. Device permissions

Dipper Field requests a permission only when a related feature needs it:

  • Location while using the app centers the map, records geometry and video tracks, stores capture positions, and supports nearby address or weather information. While you walk a line or area with GPS, recording continues with the screen locked; iOS shows its location indicator and Android shows a notification. Dipper Field does not request “Always” or background-location permission.
  • Camera captures photos and videos and scans codes or text. On Android, codes are scanned by Google’s code scanner in Google Play services: the images are processed on the device, and the scanner sends Google device and app details, performance figures, and a per-installation identifier for diagnostics.
  • Microphone records voice notes and sound with video.
  • Photos and files let you select or save only the items you choose through system pickers.
  • Bluetooth (on Android, Nearby devices) finds and connects to the external positioning receiver you choose.
  • Local network (iOS) lets the app reach a receiver or correction service on your Wi-Fi network.
  • Notifications (Android) show the progress of a map download or a walk being recorded.

You can revoke permissions in iOS or Android Settings. Features that require the revoked permission will stop working, but existing local project data remains available.

4. Maps, search, addresses, and weather

Some features send limited requests directly from your device to an outside provider:

  • Google Maps Platform supplies certain base maps, including the imagery Dipper Field shows by default. Google may receive the device IP address, app and SDK information, an API credential tied to Dipper Field, map requests, and other information described in the Google Privacy Policy and Google Maps Platform Terms. By using Google map content in Dipper Field, you also agree to the Google Maps/Google Earth Additional Terms. The Google Maps SDK in the app also sends Google crash and performance reports, map usage such as panning and zooming, and a pseudonymous SDK identifier, which Google uses to run and improve its services; this happens even when another base map is shown.
  • Apple MapKit and geocoding may process map searches, coordinates, or address requests on iOS under Apple’s Privacy Policy. Android’s system geocoder may be supplied by Google or the manufacturer of your device.
  • Open-Meteo receives coordinates and requested forecast parameters when you enable weather information. Dipper Field caches a result for approximately 15 minutes to reduce requests. Open-Meteo may also receive normal network information such as your IP address; its published terms apply.
  • Custom map sources such as XYZ, WMS, WMTS, or ArcGIS services receive the map tiles or area, zoom, and layer requests needed to draw the source. They also receive normal network information and any credential you configure. Their operator—not Insight Spatial—sets the applicable privacy and retention rules.
  • Coordinate and height data comes from the PROJ project's server (cdn.proj.org, hosted by Amazon Web Services). When a coordinate or height system you choose needs a country's correction files, or for the country your device is in, Dipper Field downloads that country's public files. The server receives normal network information such as your IP address and which files are requested. To tell which country you are in, the app compares the device's last known position with country outlines built into the app; the position is not sent anywhere for this. You can turn automatic downloads off in Settings, under Coordinate and height data.
  • App Store and Google Play are asked whether a newer version of Dipper Field is available, by the App Store on iOS and Google Play on Android. Apple or Google receives normal network information such as your IP address and, on iOS, your region. A rating request the app may show after you have used it for a while is also handled by Apple or Google; Dipper Field never learns whether or how you rated it.

Turning off a layer or optional weather/address feature stops new requests for that feature. A base map still requires requests to its map provider while it is displayed.

5. Cloud storage, imports, exports, and sharing

If you connect Google Drive, Microsoft OneDrive, or Dropbox, Dipper Field uses the provider’s OAuth authorization flow. The app may receive your account’s name, email address, and identifier, which it shows so you can tell accounts apart, an authorization token, folder listings, file metadata, and the files you choose to upload or download. They stay on your device. With Google Drive, Dipper Field can access only the folders and files it creates there or that you choose to open with it, not the rest of your Drive. Access tokens are stored using the iOS Keychain or Android’s protected credential storage. We do not embed or ask for your cloud password.

Transfers occur directly between your device and the provider. Google, Microsoft, and Dropbox process data under their own policies. When you remove a connection in Dipper Field, the app deletes its token from your device and also withdraws its access at Google or Dropbox, unless another connection uses the same account. Microsoft offers no way for an app to do this, so for OneDrive, or if your device was offline when you removed the connection, remove Dipper Field in your account’s security or app settings. Withdrawing access stops future access; it does not delete files already copied to either location.

You can also connect S3-compatible storage by entering its HTTPS service address, bucket, and access keys. Dipper Field checks them with the service before saving the location, keeps them encrypted on your device, and transfers files directly between your device and that service, whose operator sets its own rules. A network folder is chosen through the system folder picker; Dipper Field keeps only the access the system grants to that folder.

Dipper Field’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you use a system file picker, share sheet, email client, AirDrop, nearby sharing, or another destination, the destination receives the items you select and applies its own terms. Dipper Field cannot control copies after you send them. Photos and videos keep the time, location, and direction recorded in their metadata, and stamped copies also show them in the image, so recipients can see where an item was captured.

6. External receivers and RTK corrections

  • Receivers. When you connect an external GNSS receiver over Bluetooth, Wi-Fi, or (on Android) USB, Dipper Field reads the positions and satellite information it sends and can send correction data back to it. This exchange stays between your device and the receiver.
  • Correction services (NTRIP). If you set up a correction service, Dipper Field connects from your device to the address you enter and sends the user name and password you entered. While corrections stream, it also sends the receiver’s current position about every five seconds, because network services build corrections for where you are. With Connect automatically on, the default, this starts whenever the receiver connects. The service’s operator—not Insight Spatial—receives this information together with normal network information such as your IP address, and its own terms and privacy rules apply.
  • Encryption. Unless you turn on Use encrypted connection and the service supports it, the connection to the correction service, including the user name, password, and position, is not encrypted.
  • A receiver that fetches corrections over its own internet connection contacts the service itself; Dipper Field does not take part in that connection.

Disconnecting corrections stops these requests. Removing the service in NTRIP Settings also deletes its saved password from the device.

7. Information Insight Spatial receives

The Dipper Field app does not send us project content, precise location, media, scanner results, contact lists, advertising identifiers, or app-usage analytics. We do not use advertising SDKs or sell information.

This website is hosted by Cloudflare. When you visit it, Cloudflare may process standard request and security data such as IP address, user agent, requested page, timestamp, and threat signals to deliver and protect the site. We do not add analytics scripts, advertising pixels, forms, or cookies to this site. See Cloudflare’s Privacy Policy.

When you open the template library, the app downloads the list of templates, and any new or updated ones, from this website. The request carries no project content or location; Cloudflare processes the same standard request data as for a visit to the site.

If you email support, we receive your email address, message, attachments, and technical details you choose to provide. We use them to respond, diagnose the issue, prevent abuse, and maintain a reasonable support record.

Crash reports reach us only if you send them. After an unexpected close, the app asks once; Send report opens an email to support with the report attached, which you can read before sending. Until you send or delete them, reports stay in Settings. A report describes where the app failed, not your project; an error message can occasionally include a file name or value the app was handling at the time. Before writing a report, the app removes user names, passwords, tokens, and the parameters of web addresses from it, and shortens any coordinates to about a kilometre.

To run this website and handle email, we use service providers that process this information for us under their terms: Cloudflare (hosting this website and the template library, and forwarding email sent to our addresses), Google (the mailbox where we read support email), and Resend (sending our replies). They process it in the United States.

Separately, Apple and Google may give developers crash and performance data from devices whose owners have chosen, in the device’s settings, to share it with app developers. That data comes through the platform under Apple’s and Google’s policies, not from Dipper Field.

8. Why we use information, and our legal bases

We use the information described in section 7 only for these purposes. Where the GDPR, the UK GDPR, or Swiss law applies, the legal basis for each is:

  • Answering the support email and crash reports you send, to help you and fix problems: our legitimate interest in supporting Dipper Field and, where you ask for help, taking the steps you request.
  • Delivering this website and the template library, and keeping them secure: our legitimate interest in operating and protecting them.
  • Keeping records and meeting legal obligations, such as answering lawful requests or establishing, exercising, or defending legal claims: our legal obligations, or our legitimate interest in protecting our rights.

Where we rely on legitimate interests, you may object (section 12). Sending an email or crash report is up to you; nothing in the app depends on it. We do not make decisions about you based solely on automated processing, including profiling.

9. Sharing, sale, and advertising

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles. Data is disclosed only:

  • to a service you deliberately use, as described above;
  • to a destination or person you select when exporting or sharing;
  • when reasonably necessary to protect users, enforce legal rights, or comply with valid legal process; or
  • as part of a merger, acquisition, financing, or sale of assets, subject to this Policy and applicable law.

Dipper Field and this website do not track you across other companies’ apps or websites, so a Do Not Track signal has nothing to switch off and does not change how they work. We treat a Global Privacy Control signal as a request not to sell or share your personal information, which we do not do in any case.

10. Retention, deletion, and backups

Local project data remains until you delete the project, remove generated or received files, clear the app’s data, or uninstall the app. A record you delete moves to Deleted records in the same project, where it can be restored, and goes when the project is deleted. Android cloud backup is disabled for Dipper Field. On iOS, device or iCloud backups may include app data according to your Apple backup settings; temporary and recoverable cache files may be excluded.

Files exported to another app, computer, removable storage, or cloud provider must be deleted at that destination. Third-party providers keep network and account records according to their policies. We keep support emails, and crash reports you send, for up to three years after our last exchange with you and then delete them, unless we need them longer to resolve a dispute, meet a legal obligation, or establish or defend a legal claim. We do not keep website request logs ourselves; Cloudflare keeps its own as its policy describes.

11. Security

We use platform-provided app sandboxing, protected credential storage, HTTPS where supported by the selected service, and scoped file access. You should secure your device, restrict cloud and map credentials, maintain backups, and use your organization’s required encryption and retention controls. No storage or transmission method can be guaranteed completely secure.

For the information we hold, we use administrative, technical, and physical safeguards suited to its small amount and nature, such as limiting access to the people at Insight Spatial who need it to answer you, using encrypted connections to our providers, and securing the accounts and devices we use. If a breach affecting your information occurs, we will notify you and the authorities as the law requires.

12. Your choices and privacy rights

You can inspect and edit project data in Dipper Field, delete local records and projects, disable optional features, revoke device permissions, disconnect cloud providers, and export your data in supported formats. Because we do not maintain a Dipper Field user account or receive your project database, we ordinarily cannot retrieve, correct, or delete that local content for you.

For information we hold, mainly support email, you can ask us to confirm whether we hold information about you and give you a copy, correct it, delete it, restrict or object to our use of it, or give it to you in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting earlier use. We will not treat you differently for using these rights. We reply within one month, or within 30 days where local law sets that period; we may need to verify your identity, and where the law allows a longer period for a complex request, we will tell you why.

To make a request, email us with the subject “Dipper Field Privacy Request” and your country or region, or write to the address in section 1. If you are not satisfied, tell us and we will look into it and reply in writing within 30 days. You can also complain to a data protection authority, such as:

  • European Economic Area: the supervisory authority where you live, work, or where the issue arose. Switzerland: the Federal Data Protection and Information Commissioner.
  • United Kingdom: the Information Commissioner’s Office.
  • Canada: the Office of the Privacy Commissioner of Canada; in Québec, the Commission d’accès à l’information.
  • Australia: the Office of the Australian Information Commissioner, if we have not resolved your complaint.
  • Japan: the Personal Information Protection Commission.
  • United States: your state’s attorney general or privacy agency, such as the California Privacy Protection Agency.

Japan. We handle personal information only for the purposes in section 8. Under the Act on the Protection of Personal Information you may ask us to disclose, correct, add to, or delete the retained personal data we hold about you, to stop using it or providing it to third parties, or to disclose records of any provision to third parties. On request, we will tell you the name of our representative. Our security measures are in section 11, and the country where we hold data, the United States, is described in section 14.

13. Children

Dipper Field is a professional field-work tool and is not intended for anyone under 16, or a higher minimum age where local law requires. We do not knowingly collect personal information from children. If you believe a child has sent personal information to us, contact us and we will delete it.

14. International processing

Insight Spatial is in the United States. Information we receive (section 7) is held and handled in the United States by us and the providers named there. Outside providers you choose in the app may process network, account, or file information in other countries; their privacy policies explain their safeguards. If you use Dipper Field for an organization, you are responsible for choosing services and transfer locations permitted by that organization and applicable law.

The United States has no single comprehensive federal privacy law. Personal information there is protected by sector-specific federal laws and by state laws, and courts and authorities there may be able to obtain it under US law. Where your country’s law requires a safeguard for a transfer to us, we rely on a mechanism it recognizes, such as the European Commission’s standard contractual clauses or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the transfer being needed to answer a request you sent us.

15. Changes to this Policy

We may update this Policy as Dipper Field changes. We will change the effective date and publish the current version at this stable URL. If a change materially affects how the app handles information, we will give notice in the app or release notes before it takes effect, and ask for your consent where the law requires.

This Policy is available in English, French, and Chinese. Translations are provided for convenience; if versions differ, the English version controls to the extent permitted by law.

16. Contact

Insight Spatial L.L.C.
301 S McDowell St, Ste 125, PMB 1767
Charlotte, NC 28204, United States
Email: support@insightspatiallabs.com

Insight Spatial’s Managing Member is the person responsible for protecting personal information, including under Québec law, and can be reached at the email or postal address above. For a privacy request, use the subject “Dipper Field Privacy Request” and state your country or region. Please do not email sensitive project files unless support asks for a specific diagnostic item.