The longer version, for anyone who wants it
Your phone's location stays on your phone
If you allow location access, it does one thing: centres the map on where you are. It's never sent to us or to anyone else.
Nothing else leaves
Weather, imagery, boundaries and road names all come through our own server, so the archives behind them see us asking about a patch of ground rather than seeing you. The weather is asked for by grid cell, not by field, so even that request is about five kilometres coarse.
A video only goes somewhere when you send it, through the normal iOS share sheet, to whoever you choose. The app never reads your photo library and never writes to it. There's no iCloud sync, so there's no copy of your fields anywhere but the phone in your hand.
Sharing a field's season
If you share a season, we make a web page for it, so somebody without the app can watch it. That page is public to anyone who has the link, and it shows the field's outline, its position on a map, and the year of satellite pictures. It carries no name, not the field's and not yours. A shared season is a piece of ground, not a person. The map under it is Apple Maps, so opening the page asks Apple for map tiles the way any website with an Apple map does, under Apple's own privacy policy. Cloudflare keeps copies of the season's pictures at its edge so the page loads quickly wherever it's opened.
Proving the request came from the real app
Each install proves itself to our server through Apple's App Attest, which is Apple vouching that a request comes from a genuine copy of Epic Fields on a real iPhone. We keep a hash of that install's key so we can count how many phones use the app. It identifies an install, not a person, it isn't Apple's advertising identifier, and it goes when the app does.
What we keep
What our server fetches, kept so the next request for the same ground doesn't cost the public archives another download, and filed by location and never by person. Beside it, a count of which countries the app is opened in: our server works the country out from the address a request arrived from, adds one to that country's total, and discards the address. It's the only use we make of where you are, and it never sees your phone's location, only the country its connection comes from.
Field outlines we may keep indefinitely, and it's worth saying why: they're what makes the detection better over time. Real boundaries on real ground are the only thing that tells us where it gets an edge wrong.
They aren't attributed to anyone, and not because we've promised it. There's nothing stored that could attribute them. An outline is kept with its date and nothing else: no account, because there isn't one, no device, no address. It sits apart from everything else, with nothing in common that could put the two back together.
We keep ordinary server logs for 30 days, for security and for working out why something was slow. They record what was asked for, whether it worked and how long it took. The address a request came from is not among them, and nothing in them is joined up with anything else.
The servers run in Microsoft Azure's West Europe region, which is where the Sentinel-2 archive lives. Wildeye is a New Zealand company.
What we don't do
No advertising identifier and no tracking prompt, because there's nothing to ask you about. Nothing is sold, and nothing is shared for advertising.
This website, as opposed to the app
The page you're reading uses Cloudflare Web Analytics, which counts visits, where they came from and how quickly pages loaded. It sets no cookies and it doesn't follow you anywhere else. What we see is a total, not a person, and we use it to work out which parts of the site are worth keeping.
It says nothing about what you do in the app, because the app doesn't report to it, or to anything else. Everything above this is about the app; this paragraph is the whole of what the website does.
Children
Nothing here is aimed at children, and nothing is collected from anyone of any age.
Asking us what we hold
You can ask, and the honest answer is that we can't look it up. Nothing is filed under a person, so there's no record of yours to produce. There's no account to close either. Deleting the app takes your saved fields with it, because that's the only place they ever were.
Getting in touch
Wildeye
31 George Street
Mt Eden
New Zealand
Changes
If this changes, it gets a new date at the top.