Privacy

The app

Where your records live

• Notes and resources are stored only on your phone, in an encrypted database (SQLCipher).
• The database key is protected by Android Keystore and your phone’s screen lock.
• The vault locks when you leave the app, unless you choose a short wait. You can also lock it with the Lock button, a shake, or five presses of volume down. Locking closes access; it doesn’t erase anything.
• Sensitive screens are blocked from screenshots and the Recents view.

What leaves the phone

• Nothing, unless you send it. Sharing always goes through Android’s share sheet, you pick the parts, and you see the exact text first.
• A portable backup is a readable, unencrypted file. Keep it somewhere private.
• Sharing the app sends only the APK, never your records or keys.
• Copied text is marked sensitive. Text you copy from the vault is cleared when it locks. Details copied with a resource card’s Copy button stay, so you can paste them into the dialer or maps. Panic lock clears everything. Clipboard clearing is best effort.

Permissions

None of these are needed for notes, resources or travel calculations. Each is asked for the first time you use the tool that needs it, and you can refuse.

• Nearby devices and location: Bluetooth scans, the Wi-Fi survey, and the watch’s check that a tracker moved with you. Positions are held in memory during a watch and never stored.
• Notifications: the watch’s ongoing notification and alerts.
• Camera: the lens finder and QR reader. No frame is saved.
• Microphone: the 10-second high-tone listen. Audio is analysed in memory and never saved or sent.
• App list: the app audit.
• Network: the local network tools, on the Wi-Fi you joined. Field Watch does no internet lookups.
• Device administrator (optional): only to log wrong lock-screen entries. It can’t lock, wipe or change anything. Turn it off in the app before uninstalling, or Android won’t let you uninstall.

The watch journal

While the vault is locked, a running watch writes to a separate encrypted journal that doesn’t need your unlock, so it can keep working with the screen off. It holds times, states and findings, never a position, a Bluetooth address, audio or a camera image. It moves into your vault and is deleted the next time you unlock.