JobStamp for Android
JobStamp is a GPS timestamp camera and field-report app. This Privacy Policy explains what stays on your device and what is sent to service providers when you use network-backed features.
JobStamp stores photos, stamped copies, PDF reports, location evidence, and project data on your device. JobStamp has no server of its own and never uploads your photos, reports, or project content to one. It has no account system and no advertising SDK, and it shows no ads. It does send usage statistics and crash reports, which are described under "Usage statistics and crash reports" below; those never contain your photos, the GPS location of your photos, or anything you typed.
If you choose to connect Google Drive (see "Google Drive" below), JobStamp uploads stamped photos and PDF reports to your own Google Drive account. That is the only case in which content leaves your device automatically, it happens only after you connect it yourself, and it stops the moment you disconnect.
JobStamp lets you keep a list of the people who use this phone and pick which one is taking the next photo. That list is stored on your device only; JobStamp never sends it anywhere. The name you pick is frozen onto each photo you take, so it appears in the photos, PDF reports and data files you choose to share or export, and — if you connected Google Drive — in the copies uploaded to your own Drive account. Removing a name from the list stops it being offered; it does not change the photos already taken with it. JobStamp has no accounts, no sign-in and no way to verify who anybody is: a staff name is a label you chose, not an identity we confirmed.
Cloud backup of JobStamp app data is disabled. Android may copy app data during a direct device-to-device migration to a new phone; that is not an upload to a JobStamp server. The usage-statistics and crash-report identifiers are not copied: the new phone starts with new ones.
If you grant location permission while the camera is open, JobStamp obtains a device location fix. To produce an address, it may pass the full latitude and longitude to Android's platform Geocoder. The Geocoder may use a network-backed system implementation. A three-decimal grid cell is used only to cache the result; it does not round the coordinates before the live Geocoder request.
Google Maps is the only map provider JobStamp uses. There is no second map service and no fallback between providers. When you take a photo with the "Map in stamp" setting on, JobStamp asks the Google Maps SDK for a small map snapshot of that photo's full coordinates, centered at zoom level 17, to draw inside the stamp. The stamp job waits up to 1.5 seconds for that snapshot to arrive or finish rendering; if it is not ready in time, JobStamp renders the stamp without a map (the timestamp-only layout) rather than delay the photo. Separately, opening a stored photo's or a project's interactive map screen sends that photo's or project's saved coordinates to the Google Maps SDK to draw a pannable, zoomable map.
While the camera viewfinder is open and "Map in stamp" is on, JobStamp also pre-requests that same map snapshot ahead of time: as your location updates, it sends the coordinates of your current ~111-metre location cell to the Google Maps SDK so a snapshot is already on the device by the time you take a photo there, rather than only starting that request after the shutter. This pre-request repeats at most once per cell you enter, plus, if you stay in one place after moving a longer distance, one more round for the cell you settled in and its immediate neighbors. Turning "Map in stamp" off stops these pre-requests immediately, in addition to the capture-time request described above.
On a build with no Google Maps API key configured, or on a device without Google Play services, JobStamp uses an on-device placeholder instead: no map request of any kind is made, every stamp uses its no-map layout, and the interactive map screens show no map surface.
The "Map in stamp" setting controls whether your location is sent to Google Maps during camera use at all: with it off, neither the viewfinder's periodic pre-request described above nor the stamp job's capture-time snapshot lookup sends any coordinates, so no snapshot request is made. Opening a stored photo's or a project's map screen is a separate, user-triggered action and is not controlled by that setting. You can prevent camera-location, reverse-geocode, and capture-time and pre-request map requests together by denying or revoking location permission; you can avoid a stored-location map request by not opening a photo's or project's map screen.
Map and Geocoder providers receive network information such as an IP address. The Google Maps SDK also automatically collects request and device metadata, SDK/build information, stack traces and crash metrics from SDK code, an Internal Usage Attribution Identifier, and a Maps SDK-specific pseudonymous identifier. Because JobStamp invokes the Map Camera APIs, Google may also collect map camera events. Google states that it uses these data to maintain and improve Google services.
Google's current Maps Platform terms state that Google receives and may retain IP addresses and latitude/longitude coordinates and that Google and the app publisher act under controller-to-controller data protection terms. Use of Google Maps features is also subject to the Google Maps End User Additional Terms and the Google Privacy Policy.
JobStamp can upload your stamped photos and PDF reports to your own Google Drive. This is off until you turn it on in Settings ▸ Storage, and it is part of the Pro subscription.
When you connect it, Google shows you its own account picker and permission
screen. JobStamp asks for one permission and no other:
https://www.googleapis.com/auth/drive.file. That permission lets an
app see and manage only the files it created itself. JobStamp therefore cannot
read, list or change anything else in your Google Drive — not your documents,
not your other photos, not your folders.
JobStamp does not create an account, does not sign you in, and does not ask for offline access or a refresh token. The short-lived access token Google issues is held in memory only, for as long as an upload is running; it is never written to the app's database, its settings, a file, or a log. Your account's e-mail address is read once, so the Settings screen can tell you which account you connected, and it stays on your device.
What is uploaded: stamped photos and PDF reports, into a
JobStamp folder in your Drive with one subfolder per project. What
is not uploaded: your original unstamped photos, the app's database, and your
settings.
Uploads run only while JobStamp is open — there is no background service — and, unless you turn "Wi-Fi only" off, only over an unmetered connection. Files already uploaded belong to you and stay in your Drive: disconnecting removes only JobStamp's local queue and its record of the folders. Deleting a photo inside JobStamp does not delete it from your Drive. JobStamp does not revoke its own access; to remove it completely, use the permissions page of your Google account, which the Settings screen links to.
Each time the app starts, JobStamp asks RevenueCat whether this install has an active subscription. RevenueCat receives a random app user ID generated on your device, basic device and app information, your IP address and, when you buy or restore, the Google Play purchase token. If you buy or restore a subscription, Google Play processes the payment, and RevenueCat retains the purchase information needed to validate and restore entitlement status.
While usage statistics are on, JobStamp also gives RevenueCat the Google Analytics app-instance ID so the subscription events RevenueCat reports to Google Analytics can be matched with the usage statistics; turning statistics off removes it from RevenueCat. JobStamp does not give RevenueCat a JobStamp account name, email address, or photo/project content.
RevenueCat's privacy policy is available at www.revenuecat.com/privacy.
JobStamp sends usage statistics to Google Firebase Analytics so we can see which parts of the app are used and where they fail. The app itself sends only a screen or event name, bucketed counts and durations, the app version, your language and region setting, and whether you are on Free or Pro. Google adds to every event the time it happened, your device model and Android version, an approximate location derived from your IP address, the Firebase installation ID and a random app-instance ID. Once statistics are on, Google Analytics also records which Google Play store link or campaign led to the install (the Play install referrer). This is not an advertising identifier.
These statistics are pseudonymous, not anonymous: they are tied to that random app-instance ID, never to your name. They never carry a photo, a coordinate, an address, a project, report or note name, a staff name, a file path, an evidence hash, or the advertising identifier. That is a property of the app, not a promise about our intentions: the events are defined as a closed set of types with no free-form text field, and an automated test fails the build if any of those values is even named in that code.
Whether these statistics are collected depends on where you are. In the European Economic Area, the United Kingdom and Türkiye — as reported by your mobile network, otherwise by your SIM card — they stay off until you switch them on, and they also stay off on a phone that reports neither (for example a Wi-Fi-only tablet), whatever its region setting. Everywhere else they start on: after your first photo the app shows a notice that says so, with a "Turn off" button, and collection begins only once that notice has been on screen. You can switch them off any time in Settings ▸ Privacy, and that applies from the moment you use it. Nothing is collected before you have seen that choice, and nothing is held back to be sent later. Google Analytics deletes event-level data after two months and user-level data after fourteen months, the retention periods set on JobStamp's property.
Crash reports go to Firebase Crashlytics so that a crash can be found and fixed. A report contains the stack trace, your device model and Android version, the app state at the moment of the crash, and an installation identifier used to count how many devices a crash affects; while usage statistics are on, it also includes the last few usage events before the crash. It contains no photos, no location, and no text you typed. Crash reporting is not covered by the switch above, because the most valuable crashes happen before the app can ask anything; Google deletes this data after 90 days. The separate session signal that normally ships with Crashlytics (Firebase Sessions) is switched off. Crashlytics itself still contacts Google from time to time when the app starts, to fetch its settings and send any pending crash report; that request carries its installation identifier, your device model and Android version, and no usage data.
JobStamp does not collect the Android Advertising ID. The permission for it is removed from the app before it is built, and an automated gate fails the build if it reappears.
Separately, when the Google Maps SDK is invoked, that SDK may collect stack traces for crashes in SDK code, crash metrics, diagnostics, request/device metadata, and its pseudonymous SDK identifier as described above. Standard Google Play system reporting (Play Vitals) may also provide Google with crash or ANR statistics from devices whose users enabled Android usage and diagnostics sharing.
For more information, see the Firebase data disclosure, the Google Analytics for Firebase SDK disclosure, the Maps SDK data disclosure and Google Play crash and ANR help.
On the free tier, JobStamp keeps photo originals on the device for at least 7 days after capture and removes an original only after its stamped copy has been saved to the device gallery. Pro keeps originals on the device. You can delete local data with JobStamp's deletion controls or remove the app and its private data by uninstalling it.
To stop usage statistics, switch them off in Settings ▸ Privacy; collection ends immediately. Crash reports are deleted by Google after 90 days, and analytics data after the retention periods described above (two months for event-level data, fourteen months for user-level data).
For a request concerning billing data held through RevenueCat or data that we can reasonably link to JobStamp's provider records, contact jobstampapp@gmail.com. We will process a verifiable request where identification is possible. Google also applies its own retention and deletion rules; the policies linked above explain the rights and controls it offers.
JobStamp is not directed at children.
We may update this Privacy Policy when JobStamp's data practices change. We will post the updated policy at https://jobstamp.github.io/privacy.html and update the effective date.
For privacy questions or deletion requests, contact jobstampapp@gmail.com.