Timestamped GPS is a field camera and reporting tool. This policy explains what the app handles, what stays on your device, and what may be sent to service providers.
Information Timestamped GPS handles
- Photos and videos you capture, plus the company, project, note, checklist, and report information you enter.
- Capture time, a verification code, and a SHA-256 fingerprint of the original file.
- An app-instance attestation key identifier and security counter when Apple App Attest is supported and public verification is enabled.
- Precise coordinates, location accuracy, and a derived street address when you grant location access.
- For Premium Weather Context, capture coordinates and time sent to the Timestamped GPS service and Apple Weather to return nearby conditions.
- Clock punches and local timesheet information.
- A purchase identifier (anonymous until sign-in links it to your account) and App Store product, transaction, and entitlement status when Timestamped GPS Pro is enabled.
- Advertising, product-interaction, performance, and diagnostics data processed by the advertising SDK when ads are enabled.
Local storage and sharing
Photos, videos, Gallery records, project links, stamp profiles, inspection templates, reports, and timesheets are stored on your device unless you choose to save, share, or export them — or sign in with Pro, whose automatic cloud backup (on by default, Wi-Fi only) stores your originals in a private, integrity-checked vault linked to your account until you turn it off in Backup settings. A recipient or storage provider handles anything you share according to its own terms and privacy practices.
Optional public verification records
Public registry publishing is off by default. If you enable it, Timestamped GPS sends the verification code, original-file fingerprint, device-reported capture time, time-source label, and limited lifecycle information to the verification service. On supported Apple devices, the service also receives an app-instance attestation key identifier, assertion, and replay-prevention counter so it can check that registration came from a genuine copy of Timestamped GPS. The service adds its own server registration time and a cryptographically signed proof receipt. The photo itself is not uploaded to the registry.
Precise coordinates and street address have separate controls and remain off unless you independently enable each one. A verification result confirms that a record and fingerprint were registered; it does not independently prove what the camera saw or authenticate a physical location.
Weather is published on a proof record only when Premium Weather Context is present and exact-location publishing was also enabled. Weather values are provider-reported near capture time and are not independently verified by Timestamped GPS.
Advertising, purchases, and measurement
Advertising
Timestamped GPS may use Google Mobile Ads on approved low-pressure screens. The initial design requests non-personalized ads and does not ask for access to Apple’s advertising identifier. Consent choices are available in the app where required.
Timestamped GPS Pro
When purchases are enabled, Apple processes payment and RevenueCat processes an app user identifier plus product, transaction, subscription, and entitlement information needed to purchase, restore, and manage Pro. That identifier is anonymous until you sign in; after sign-in it is linked to your account so your subscription follows you across devices. Timestamped GPS does not collect your payment-card number.
Privacy-minimized measurement
Checking for app updates at launch contacts Expo's update service with a random installation identifier and basic device details; no capture data is involved. When remotely enabled, the app may also send a random measurement identifier (stored in the device keychain, so it can outlive a reinstall; it is deleted whenever measurement is disabled) and a small allow-listed set of Gallery, ad, capture-detail, and Pro-preview events. The service replaces the install identifier with a salted one-way pseudonymous value. This event contract rejects media, verification codes, file fingerprints, coordinates, addresses, and timesheet content.
Accounts and sign-in
The camera and public verification work without an account. Timestamped GPS Pro and Business need one, and you can create it three ways: a one-time link sent to your email address, Sign in with Apple, or Continue with Google. Whichever you choose, Timestamped GPS receives an account identifier and the email address associated with it, and uses them to attach your subscription and your stored originals to you.
Signing in with Apple or Google means that company also learns you signed in to Timestamped GPS, and passes back the identifier and email address described above. Apple offers a private relay address if you would rather not share your real one. Timestamped GPS never receives your Apple or Google password. Signing in with a one-time email link involves neither company.
Business workspaces and cloud storage
Timestamped GPS Business is optional and account-based. When your company adds you to a Business workspace, the projects, evidence records, reports, and original photos you choose to back up are stored in private cloud storage owned by that company workspace, together with your work email, workspace role, and an audit history of workspace activity. Workspace access is limited to seated members of that company, and downloads use short-lived authorized links. Stored originals are verified against their SHA-256 fingerprint after upload.
Company administrators control workspace membership and can access records synced to their workspace. Backing up a capture never removes or alters the phone-local original, and Business billing changes never delete anything stored only on your device.
Retention and deletion
Local records remain until you delete them or remove the app. New public verification records normally expire after 365 days. The device stores a separate deletion credential for new public records; deleting the local capture queues deletion of its public record and retries after an offline deletion. Older records without a device-held deletion credential require support.
Business cloud files a workspace deletes stay recoverable and continue to count against workspace storage for 30 days before permanent deletion. If an eligible Business subscription ends, stored workspace files stop accepting new uploads and remain recoverable for 60 days so the company can export or restore access; after that window they may be permanently deleted. Permanent deletion removes the stored bytes before the storage record is released.
Privacy-minimized product and advertising events are retained for no more than 90 days when that service is enabled.
Your choices
You can control camera, microphone, location, and Photos permissions in system Settings. About & Privacy contains separate controls for public verification publishing, exact-location publishing, address publishing, and advertising privacy choices. You may request privacy assistance or legacy-record deletion using the contact below.
Children
Timestamped GPS is a work-documentation tool and is not directed to children under 13.
Policy changes
Material changes will be reflected by updating the effective date on this page. The policy in effect when you use the service applies to that use.
Contact
Email privacy@timestampedgps.com.