Your field records stay yours.

At a glance

This policy covers Boundara for iPhone, iPad, Mac and Apple Watch from the App Store, and Boundara for Android phones and Wear OS from Google Play (package com.eutopixlabs.boundara). Where the platforms handle data differently, the policy says so under “On iPhone, iPad, Mac and Apple Watch” or “On Android”.

• Boundara does not require or offer a user account.
• We do not operate a backend that receives your saved parcels, notes, photos, or exports.
• The app includes no advertising or third-party tracking SDK.
• Optional usage sharing exists only on iPhone, iPad and Mac and is off by default. Boundara operates no Android usage-count collector; Google ML Kit technical telemetry is described below.
• On Android, ordinary purchase and private review checks at api.boundara.app do not receive saved field records, location or contact details. Land-data queries send a requested point and country with access evidence as described in the Android section.
• We do not sell or share personal information.

Data stored on your device

On iPhone, iPad, Mac and Apple Watch

Boundara stores saved parcels and holdings, names, notes, markers, GPS tracks, offline map packages, attached photos and audio, settings, and purchase entitlement state on your device. A paired Apple Watch can receive relevant field data. If you enable optional iCloud synchronization, your library is stored in your private iCloud account under Apple’s terms; Boundara’s usage collector does not receive it. You can choose to export or back up your records to Files, including iCloud Drive; that destination then controls the copy.

On Android

Boundara stores saved parcels and holdings, names, notes, markers, GPS tracks, offline map packages, attached photos and voice notes, client records, settings, and purchase entitlement state in app-private storage on your device. Photos and audio you add are copied into that private storage; the app does not request access to your whole photo library. Boundara excludes this data from Android’s automatic cloud backup and device-to-device transfer. A paired Wear OS watch with the Boundara app can receive relevant field data from your phone over the Wear OS Data Layer. Exports go only to a destination you choose, which then controls the copy. Optional Google Drive backup and WebDAV copies are described below.

Delete an item in Boundara to remove its current local record. On Android, previous versions and conflict alternatives may remain as described below. Deleting Boundara removes the remaining data in its app storage. Backups and exported files must be removed separately from their destination.

Network requests you initiate

Maps and location on iPhone, iPad, Mac and Apple Watch

Apple Maps supplies map content. With permission, Boundara uses location for the current-position map, automatic country selection, and field tools you choose. A GPS track is recorded only when you start it and may continue in the background until you pause or stop it. Live Activities show that user-started recording; they do not upload its contents. Offline packages are downloaded at your request.

Maps, place search and location on Android

The base map is the OpenFreeMap vector map built from OpenStreetMap data. Satellite imagery comes from the Sentinel-2 cloudless mosaic by EOX and, where available, official national orthophotos. For Field and Pro users, Esri World Imagery may be shown where no national orthophoto covers the area; those map tiles are requested from Esri’s ArcGIS servers for the visible map area. Map servers receive requests for the tiles covering the visible area or a download you start. When you submit a place search, the text you typed, the selected country, and the app language are sent to OpenStreetMap Nominatim. These services may process technical data such as IP address, request time, and user agent under their own policies.

With permission, Boundara uses location for the current-position map, automatic country selection, and field tools you choose while you use them. Optional location-triggered tasks use separate background-location permission as described below. A GPS track runs only after you start it, as a foreground service with a persistent notification, until you pause or stop it. Offline packages are downloaded at your request.

Official cadastral services

When you tap a point or search a public reference, Boundara requests the selected official provider in a supported country. Gateway-enabled versions can route that coordinate or reference through cadastre.boundara.app, operated on Cloudflare Workers, and can return a dated copy of licensed official public parcel data where available. Saved field records, notes, photos and purchase tokens are not included in cadastral requests. If the gateway is unavailable, the app can contact the official provider directly. Provider servers may process technical data such as IP address, request time and user agent under their own policies. SIGPAC and other optional map layers request the area needed for the visible map or download.

Photos, voice notes, and dictation on Android

The microphone is used only when you record a voice note. Photos are taken or chosen through Android’s camera or picker and copied into app-private storage. If you dictate text, Android passes the audio to the speech-recognition service configured on your device, which may process it online under its provider’s terms; Boundara receives only the resulting text.

Purchases on iPhone, iPad and Mac

Apple StoreKit handles Essentials, Field one-time purchases and subscriptions, and restoration. We do not receive card details or your Apple Account credentials.

Purchases on Android

Google Play Billing handles Essentials, Field, and Pro purchases and subscriptions, and restoration. We do not receive card details or your Google Account credentials. To unlock paid features, the app sends the Google Play purchase token, product IDs, app package name and version, and a Google Play Integrity token to Boundara’s verification service at api.boundara.app, which runs on Cloudflare Workers. The service asks Google Play to confirm the purchase and the app, licence, and device integrity verdict, then returns the access level. The ordinary purchase-verification payload sent to api.boundara.app does not contain saved parcels, location, field records, name or email. The service keeps no purchase database and no request logs, apart from categories of operational failures. Cloudflare processes network data such as the IP address in transit under its own obligations, and Google processes purchase and integrity data under its own terms.

Land-data access checks

Ordinary purchase checks at api.boundara.app do not include field coordinates. For terrain, weather, solar or soil queries, cadastre.boundara.app receives the representative point and country together with a purchase token/product IDs or signed review-access grant, app package/version and fresh Google Play Integrity proof. The gateway and private verifier process this combination temporarily to check access, without a purchase database. Access evidence is removed before the land query reaches data providers; review activation codes are excluded from land queries. Providers and network operators process requests under their own policies.

Ratings on Android

After a successful task, Boundara may ask Google Play to show its in-app review prompt. Google displays the prompt and handles any rating or review under its terms; Boundara is not told whether you rated or what you wrote.

Genuine-app checks for the cadastral gateway

The gateway-enabled update uses Apple App Attest or Google Play Integrity to restrict access to genuine Boundara apps. On Apple platforms, the gateway retains an App Attest key reference, its public verification key, an assertion counter and last-use time in EU-jurisdiction Cloudflare Durable Objects. These security records expire after 90 days without use. A one-time challenge is valid for two minutes. Full Apple attestation proofs and cadastral request bodies are not stored. On Android, a request hash, app package/version and an Integrity token are checked with Google through our private verification service; the hash binds the proof to the request without sending the coordinate or reference to Google. Cadastral requests and Integrity proofs are not kept in an application request database or application request logs. Cloudflare and Apple or Google process technical network and security data under their own terms.

Optional Field land-data requests

Apple Weather on iPhone and iPad

In versions with Apple Weather enabled, Boundara uses Apple Weather as the primary forecast provider and can request forecasts directly through Apple’s WeatherKit service. Boundara sends Apple the precise latitude and longitude of the selected parcel or drawn site’s sample point to obtain the forecast; this is not necessarily your current device location. This request does not include the parcel’s name or reference, notes, photos or saved field records. Apple receives the request over your device’s connection and handles it under its own privacy policy. If Apple Weather is unavailable, Boundara can request a complete MET Norway forecast through the Cloudflare gateway instead, as described below. Android and earlier versions without Apple Weather continue to use the gateway forecast. Apple privacy policy.

For land-analysis requests made through the Cloudflare gateway, the selected sample coordinate and country hint pass through that gateway. The service requests terrain from Copernicus, IGN/CNIG or INGV/TINITALY, soil-model data from OpenLandMap or ISRIC, forecasts from MET Norway and solar models from the European Commission JRC/PVGIS. MET Norway receives the centre of a public sampling cell spaced 0.01° apart, not the exact selected point. PVGIS receives the sample coordinate; raster hosts receive a public source object and byte range, which may reveal the geographic tile. Providers see the service’s connection rather than the phone’s IP address; the gateway receives ordinary connection information.

Saved names, notes, photos and tracks are not sent. The service keeps no history of individual queries. Bounded source caches contain public raster blocks indexed by object and byte range. Forecasts are shared in memory by public sampling cell and validated against their provider expiry, without installation identifiers or access histories. These models are not field measurements. Cloudflare and providers may process operational information under their own terms.

Optional Google Drive backup on Android

Google Drive backup is off until you connect it. When connected, Boundara stores your library, including parcels, holdings, notes, tracks, photos, audio, and client records, in your own Google Drive, in a hidden app-data folder that only Boundara can access. The app requests access only to that folder, not to your other Drive files. Google holds these copies under Google’s terms. They are not end-to-end encrypted by Boundara, and Eutopix Labs never receives them.

Disconnecting stops backup and revokes Boundara’s access to your Drive; your local library is kept. To delete the copies stored in Drive, open Google Drive settings → Manage apps → Boundara and delete its hidden app data. You can also send copies to a WebDAV server you choose; that server and its operator then control those copies.

Android field workflows and Google SDKs

Optional private review access

If you enter a private review code in Settings, Boundara sends it, a random installation identifier, a fresh request identifier, app package/version and a Play Integrity token to api.boundara.app (Cloudflare). Google checks the app integrity token. The code and signed installation-bound access lease are encrypted locally; the lease lasts at most 24 hours and is renewed while the app is in the foreground until you remove access. This creates no purchase or subscription. The service holds a reusable code hash in protected configuration, not a reviewer/farm database, and does not log review codes or request bodies. Network metadata, including IP addresses for abuse limits, is processed by Cloudflare/Google under their terms.

Field records and retained versions

Dated diary entries, documents, photos, audio, coordinates, inspections, templates, activity, saved versions and conflict alternatives are stored privately. Optional Drive/WebDAV copies and native backups include this content. Deleting a current record can leave earlier versions and conflict copies. To remove all local copies, clear the app’s storage or uninstall on each device; remove backups and exports separately.

Optional location-triggered tasks

Disabled until you explicitly enable them. Phone alerts require precise location, separate background-location permission and notification access. Enabled zone coordinates, radius and identifiers are registered with Google Play services for arrival detection, including when Boundara is closed. Tasks and zones remain in device-local storage. Disable alerts in Boundara or revoke permissions in Android settings. GPS tracks are separately user-started foreground services with a persistent notification.

Wear OS missions and live maps

The Wear OS Data Layer transfers selected mission geometry, notes, types, checkpoints, tasks and available licensed offline imagery; watch observations, recordings and tracks return to the phone. Independent watch proximity notices use only GPS from an already-running mission recording; they do not start background watch tracking. Live OpenStreetMap tiles are opt-in viewport requests with a local cache, not offline bulk downloads. The tile provider receives the requested area and network metadata under its terms.

Optional on-device summaries

On compatible phones, you explicitly check availability, download model assets and request a Gemini Nano draft through ML Kit/AICore. Boundara sends selected saved text and computed facts to the local model, not a Boundara cloud model; photos, audio and documents are not model inputs. Review drafts against their sources. Google’s ML Kit collects technical telemetry: device/app information, identifiers, performance, configuration, input/output sizes, event/error data and configured languages, for diagnostics and usage analytics. Model downloads use Google services. Boundara operates no Android usage-count collector; this does not exclude Google SDK telemetry.

Android: purchase verification, background location, foreground services and Google SDKs

What the purchase verification service receives and keeps

After a Google Play purchase or restore, the Android app sends api.boundara.app exactly these fields: the app package name, the purchase token, the product IDs, the app version code and a Google Play Integrity token bound to those values. Your IP address reaches Cloudflare with the connection and is used as a short-lived key to limit the number of requests. The service passes the integrity token to Google’s Play Integrity API and the purchase token to the Google Play Developer API, and returns only the access level and its expiry. It has no database or other storage: tokens, request bodies and Google’s answers are not saved, and purchase answers are never cached. Worker logging is disabled; the code writes only short failure labels (the step that failed and the names of failed integrity checks), never tokens or receipts. Card details and your Google Account stay with Google Play.

Background location for task alerts

Only the optional “Location alerts” feature (Field or Pro plan) uses location in the background. It stays off until you tick the in-app consent box and allow precise location, “Allow all the time” location and notifications. Boundara then registers the enabled zones (coordinates, a radius of 100 m to 5 km and a random ID; at most 100 zones) with the Google Play services Geofencing API, and registers them again after the device restarts or the app is updated. Android tells Boundara only when you enter a zone; Boundara then shows a local notification with your task, at most once every 30 minutes per zone. Boundara keeps no location history for this feature and sends no arrivals or positions to Eutopix Labs. Google Play services determines your location on the device; depending on your Android location settings (such as Google Location Accuracy), Google may process location data under its own privacy policy. To stop it, use “Disable all reminders” or remove the permission in Android settings.

Foreground services

Boundara uses two foreground services, each with a visible notification. GPS track recording (location type) starts only when you tap “Record track”, reads GPS about every 2 seconds, saves the points only on your device and stops when you pause or tap “Stop” in the notification; it never restarts automatically. Offline map downloads (data sync type) start only when you download an area, show progress with a cancel button and end when the download finishes, is cancelled or after 30 minutes; the map providers receive the tile requests for that area. Neither service sends data to Eutopix Labs.

Google ML Kit and other Google SDKs: what we know and what we cannot verify

The summary model (Gemini Nano through ML Kit GenAI and Android AICore) runs on your phone. Boundara starts ML Kit only after you confirm the notice on the summary card and tap “Check availability”; the automatic ML Kit start-up at app launch is removed. Boundara passes the selected text only to the on-device model, not to a cloud service. According to Google’s ML Kit data disclosure, ML Kit sends Google technical telemetry (device and app information, identifiers, performance and latency, input and output sizes, events, error codes and configured languages), encrypts it in transit and does not transfer it to third parties. Boundara does not receive this telemetry and cannot inspect it, so we cannot confirm exactly when it is sent, how long Google keeps it, or whether Google acts as controller or processor for it. Model downloads come from Google. Other Google libraries in the app (Play Billing, Play Integrity, Play services location, Google authorization for Drive, and Wear OS) run under Google’s terms and may send Google technical data that Boundara does not receive. Google ML Kit data disclosure.

Optional Google Drive and WebDAV copies

Google Drive: Boundara uploads a complete snapshot of your library, including attachments, to the hidden app-data folder of the Google Account you connect, using only the drive.appdata permission. Google stores it under Google’s terms, and Boundara does not encrypt it end to end. WebDAV: a manual upload of a single library file, over HTTPS only, to the address you enter; the user name and password you enter are sent only to that server. Eutopix Labs receives neither copy. Google or the server’s operator controls those copies; delete them there.

Optional diagnostic support files

On iPhone, iPad and Mac

Apple may make crash and performance diagnostics available to Boundara. The app stores these files locally, together with fixed technical error codes. It does not add parcel references, coordinates, notes, photos, or document contents to those codes. It keeps at most 16 diagnostic files for up to 14 days, with a maximum of 1 MiB per report. These files are excluded from device backups.

There is no automatic upload to the developer. In Settings, you can review the local diagnostic summary, delete the files, or explicitly export them using the system share sheet. A chosen recipient receives only what you share. Support uses submitted diagnostics to investigate the requested problem, not for advertising or tracking.

On Android

The Android app keeps no diagnostic file store and uploads no diagnostics to Eutopix Labs. Depending on your device’s usage and diagnostics settings, Google may make crash and performance reports for the app available to the developer through Google Play.

Information you send us

If you email support, we receive the address, message, and attachments you choose to provide. We use them only to answer the request, prevent abuse, and meet legal obligations. Support correspondence is retained only as long as needed for those purposes and no longer than 24 months after the last message, unless the law requires longer.

On Android, a support email started from the app is pre-filled with the app version, Android version, device model, app language and region, plan tier, Wear OS app status, and the number and size of offline areas. It contains no parcel names, references, coordinates, or library content. Nothing is sent unless you send the email from your email app, and you can edit it first.

Website hosting

This website sets no analytics or advertising cookies and does not use browser storage for tracking. Cloudflare provides website delivery and security and may temporarily process standard technical request information such as IP address, browser headers, requested page, timestamp, and diagnostic or security data. Worker observability logging is disabled. Cloudflare may process data outside the EEA using applicable safeguards under its own contractual and legal obligations.

Optional usage sharing

Platforms: usage sharing is offered only in Boundara for iPhone, iPad and Mac. Boundara operates no Android or Wear OS usage-count collector. Google ML Kit technical telemetry for the optional Android summary feature is described above.

Boundara does not track you across apps or websites and does not use an advertising identifier. In versions that offer Usage analytics in Settings, you can choose to share basic counts to help Eutopix Labs improve Boundara. Sharing is off by default and normal features remain usable without it. Counts cover app opens, successful tasks, paywall and plan choices, purchase outcomes and useful returns, plus app version, platform, UTC day and consent-cohort week. We do not send field records, document contents, text, recordings, precise locations, financial amounts, name, email, advertising identifiers or persistent account, installation or device identifiers. Purchase outcomes are categories, not transaction identifiers or amounts; locally used transaction identifiers are not uploaded. A temporary random batch identifier recognizes retries. When you opt in, we also send a one-time coarse summary of onboarding completion, core usage (0, 1–2 or 3+ uses), whether a free limit was reached and install age (0–1, 2–7 or 8+ days), categorized by plan, when this existing local information is available. No exact counts or install dates are sent. Nothing is collected or queued for analytics before consent. Turning sharing off and later opting in can send a fresh summary.

Eutopix Labs operates the collector using Cloudflare Workers and Cloudflare D1. The database is restricted to the European Union, but Cloudflare's network may process requests elsewhere and necessarily sees the network address during transport. The collector does not retain IP addresses, request headers or raw bodies; invocation/application logging is disabled. Cloudflare may still process infrastructure and security information under its own obligations and applicable safeguards. Requests are not guaranteed anonymous or entirely processed within the EU. No advertising personalization or cross-company tracking is added.

Unsent counts expire after 7 days. Daily cleanup removes retry identifiers older than 8 days and aggregate counts older than 400 days. Provider recovery copies may retain earlier database states for an additional recovery window, currently up to 30 days depending on the Cloudflare plan. Turning sharing off deletes unsent counts and local sharing metadata; requests already sent may already have been accepted. Combined totals contain no person identifier, so we cannot locate or erase a person's past contribution. Questions and applicable rights requests can be sent to privacy@boundara.app.

Apple ad attribution (iPhone and iPad)

Boundara shows no ads, does not use the advertising identifier (IDFA), never shows an App Tracking Transparency (ATT) prompt and does not track you across other companies’ apps or websites.

Apple’s own measurement. If you install Boundara after tapping an Apple Ads advertisement, Apple may count the install and attribute it to that ad using its own App Store measurement. Apple is responsible for that processing; see Apple’s privacy policy.

EU/EEA, UK and Switzerland. From the first update of Boundara released after 14 October 2026, the app sends no SKAdNetwork or AdAttributionKit conversion value in these regions. Earlier versions may send the coarse, aggregate value described below in every country.

Other regions. Outside these regions (and, in earlier versions, everywhere) the app may send a coarse, aggregate conversion value through Apple’s SKAdNetwork/AdAttributionKit: a number from 0 to 3 describing progress during the first days after installation (opened, first result, viewed plans, or verified access). It contains no identifier, no IDFA and nothing about you, and no ATT prompt is shown. Apple passes it on delayed and combined with other installs; Eutopix Labs receives only aggregated postbacks that identify no one. Legal basis for those regions: our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR where applicable).

Children, security, and transfers

Boundara is a general field utility and is not directed to children. Local data benefits from iOS and Android device protections. Neither the usage collector nor the Android purchase verification service receives saved field records. External providers, Apple, and Google process their own request data under their respective terms.

Legal bases, recipients and retention

• Contract (GDPR Art. 6(1)(b)): showing maps and running the lookups, searches, downloads, syncs and backups you request; delivering and restoring purchases; verifying Android purchases and private review access.
• Consent (Art. 6(1)(a)): optional usage sharing. You can withdraw consent at any time in Settings; this does not affect processing before withdrawal.
• Legitimate interests (Art. 6(1)(f)): answering support messages, keeping the website, the verification service and the usage collector secure and free of abuse (including rate limits and Cloudflare request data), and measuring advertising through Apple’s aggregate attribution. You can object to this processing.
• Legal obligation (Art. 6(1)(c)): keeping records required by tax, accounting or consumer law, and answering lawful requests from authorities.

Apple, Google, Cloudflare and the map and data providers named in this policy process the requests they receive. Where data leaves the European Economic Area, for example to Cloudflare, Apple or Google in the United States, the transfer relies on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s standard contractual clauses.

Retention: data on your device or in your own iCloud or Google Drive stays until you delete it. Usage counts follow the periods in the usage-sharing section. Purchase verification requests are not stored. Support correspondence is kept only as long as needed to handle your request and no longer than 24 months after the last message, unless the law requires longer. Records we must keep under accounting and tax law are kept for as long as Polish accounting and tax law require — usually 5 years from the end of the calendar year in which the related tax fell due (Accounting Act art. 74; Tax Ordinance arts. 70 and 86). App purchases are sold by Apple (or Google), so your purchases do not appear in our accounting records.

Your choices and rights

Data on your device or in your own iCloud or Google Drive is under your control: you can view, export, correct or delete it in Boundara, or delete the app. We cannot see that data and cannot access, correct or delete it for you. You can deny or revoke location, camera, microphone and photo access in your device settings and turn usage sharing off at any time.

On Android, you can also revoke location or microphone permission in Android settings, disconnect Google Drive backup, and delete its copies as described above.

For personal data Eutopix Labs processes, such as support correspondence, usage counts, verification requests and website request data, you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. Usage counts carry no account or device identifier and purchase verification requests are not stored, so we may be unable to identify you in them (GDPR Art. 11); tell us what you can and we will help. Write to privacy@boundara.app; we reply within one month.

You may lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the data-protection authority where you live or work.

We do not sell or share personal information, as those terms are defined by the California Consumer Privacy Act (CCPA/CPRA). The only categories we may receive are the contact details and messages you send to support, technical request data such as IP address, and, if you opt in, aggregate usage counts. Do Not Track: this site and our apps do not track you across third-party sites or services, so they behave the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

Changes

30 October 2026 (Android): clarified how land-data queries combine a requested point and country with access evidence.

Material changes will be published on this page with a new effective date. We will not retroactively introduce tracking into an installed version without the disclosures and permissions required by Apple, Google, and applicable law.

14 October 2026 (Android): added what the purchase verification service receives and keeps, background location for task alerts, the two foreground services, the limits of what we know about ML Kit and other Google SDK telemetry, and Drive and WebDAV copy details.

14 October 2026: added legal bases, full controller details, the complete list of rights and the UODO complaint route, Apple ad attribution, international transfers, retention and the CCPA statement.

14 October 2026 (update): clarified Apple ad measurement by region, accounting-record retention and Do Not Track; the regional exclusion applies from the first app update released after 14 October 2026.