Privacy Policy

Effective Date: October 29, 2026

Overview

Field Pilot is a field testing and coverage verification application. This privacy policy explains how we collect, use, and protect your data.

GridRunner is the operator identified by the owner for the initial United States release. Field Pilot is intended for people aged 13 and over. If you are under 13, do not register or provide personal information. Contact support if you believe a child under 13 has provided information. The product eligibility policy is separate from Apple's App Store content age rating.

Data Collection

Location Data

Location data is collected only when you explicitly start an active test within the application. We collect:

• Fine-grained GPS coordinates during active test sessions
• Timestamp of each location fix
• Accuracy and altitude metadata associated with GPS fixes

On iPhone, a walk started with the app open continues collecting location when the screen locks or another app opens. Pause or Finish stops collection. Force-quitting, OS termination or restarting the iPhone stops recording; the app does not automatically restart it. iPhone uses When In Use permission and the system background location indicator, not Always permission.

On Android, an explicitly started recording uses a foreground location service with a persistent notification and stop action. Background location permission is not requested. Switching apps is not the same as stopping a recording.

GPS evidence is linked to your account, device identifier, assigned map and run. New iPhone uploads include time intervals since Start/Resume, not device boot time. Previously saved evidence requiring timing review stays protected on the iPhone until reviewed; recovery retains originals and acceptance references. Unsent evidence and profile drafts remain for the same account/server after sign-out. Reopen the app after reconnecting to finish uploads. Finishing a walk does not establish that all evidence was accepted.

Teammate Position Data (Optional)

Exact teammate positions are disabled by default. If enabled at the test level:

• Your position may be shared with other assigned teammates on the same test
• Clear disclosure is provided before enabling this feature
• Position sharing is limited to the active test session

Map Walk Plans and History

When you indicate a plan to walk a map:

• Your display name is shared with the map's assigned teammates and coordinator
• No location data is collected during planning
• When you upload GPS evidence matched to the course, your plan is cleared
• Your display name is visible to coordinators and administrators for walked maps with matched evidence
• Walk history is retained for the lifetime of the map

You can review your own compact walking summaries on the website within an activity you are entitled to access, including after reassignment or completion. These summaries include course version, coverage generation, unique matched length, matched segment count, and available server upload times. Upload times are not the times you walked. Unknown historical details remain unknown. This history does not restore access to old map geometry or other users' information. Map deletion removes these summaries; account deletion removes or anonymizes personal attribution across activities.

Merchant Records (Poster Activity)

If you participate in poster-related activities:

• Shop name and address are collected
• Shop permission decision is recorded
• Poster count and optional notes are stored
• Timestamp and your account ID are recorded
• No photos are collected in this version
• These records are separate from GPS coverage data

House Coverage Data

For D2D courses with mapped house positions:

• Aggregate covered house IDs are stored by run
• You receive shared covered/total counters
• Household identities are not recorded
• GPS proximity is not treated as a confirmed house visit

Crash Diagnostics

Android release builds with Firebase configured use Firebase Crashlytics to report app crashes and ANRs. Builds without Firebase configuration omit the Crashlytics SDK and do not collect crash reports. The following crash diagnostic disclosures apply only to builds with Crashlytics enabled. Reports include diagnostic stack traces, app/device version details, and a Crashlytics app-installation identifier and are processed by Google as a service provider. Debug builds do not collect Crashlytics reports. The app does not attach account identifiers, custom keys, logs, or location coordinates to these reports. Crash diagnostics are used to diagnose reliability issues; the app does not include Google Analytics or use crash reports for advertising.

The iPhone app does not integrate Firebase Crashlytics. Apple platform diagnostics and any diagnostics a user shares with support must be considered separately from Android reports.

Accounts and team communication

We store account identifiers, display names, optional public handles, provider identity bindings and provider email when supplied. Password credentials are hashed. An optional password-recovery address is private and used through the configured mail provider. Profile save receipts can contain previous submitted profile values. Shared team chat stores message text, sender and timestamps. Poster notes and map requests are also account-linked.

Service security records

Account events can include IP addresses and optional IP-derived city/region/country. Event storage is capped at 90 days or 200,000 events; current last-seen summaries do not yet have an automatic expiry. Deployment logging and backup retention require operator confirmation.

Data Usage

Your data is used to:

• Verify field coverage and test progress
• Coordinate with assigned teammates on active tests
• Generate coverage reports and analytics
• Improve the accuracy of map data
• Support field operations and activity management

Data Sharing

Operational account and field data is shared with:

• Other assigned teammates (team names, messages and shared map coverage; these can remain visible after recording ends)
• Map coordinators and administrators (for coverage and walk history)
• Your deployment owner's authorized personnel

Crash diagnostics from configured Android release builds are sent to Google Firebase Crashlytics for processing as a service provider. Location and account data are not sent to Crashlytics by the app. Data is not sold or used for marketing purposes.

Data Retention

Automatic expiry is not implemented for every data class. The approved deletion policy targets completion within 30 calendar days of an authenticated request, minimal deletion-status receipts for 90 days after completion, security events for up to 90 days from the event, and rolling backups for no more than 30 days. These are policy targets, not proof of configured expiry or completed deletion. A complete execution/confirmation workflow, actual backup expiry and public operator configuration remain release requirements.

Published maps, route definitions and merchant targets may remain for future coordination. Shared route coverage is preserved for map accuracy only without identifiable personal attribution; deleting an account must not reset that shared coverage. Raw GPS, individual walk history and authored chat must not be retained after account deletion merely for coordination. Removing a name or replacing it with a stable identifier alone does not make data anonymous. Retained backups must be isolated and deletions applied before restoration; immediate physical erasure from backups is not promised.

Active-account data

Uploaded personal GPS evidence and individual walk history are kept while your account exists and must be removed through account deletion. This policy governs records the service actually retains; it does not promise a complete raw trail, unlimited history or recovery of records already removed. Existing bounded caches, local history limits and authorized map deletion remain applicable.

Shared authored content is kept until account deletion or explicit authorized content removal. This includes shared chat text and attributed Poster visit names, addresses and notes. No automatic age-based expiry is approved for these active-account data classes. Separately approved moderation-case, restriction-proof, security-event, deletion-receipt and backup rules are unchanged.

Unsent local evidence does not automatically expire under this decision. Signing out does not delete it. Policy approval does not establish that the account-deletion executor, backup expiry or restoration safeguards are deployed or complete. Retention for operational exports, last-seen summaries and unresolved provider-revocation material still requires separate decisions and implementation.

Crash diagnostics are retained according to Firebase Crashlytics' retention settings and applicable Google policies.

You may request deletion of your data in accordance with your deployment's retention policy. A submitted request remains pending until the operator processes it; the request alone is not proof of deletion. Local pending evidence is not removed by signing out.

Data Security

• Location data is transmitted over encrypted connections
• Data is stored securely on our servers
• Access is restricted to authorized personnel
• Debug logs are gated behind debuggable builds and exclude tokens, bodies, and raw coordinates

Your Rights

• On iPhone, use Pause or Finish to stop location tracking. On Android, use the app controls or foreground-service notification
• You can disable optional teammate position sharing in settings
• You can request access to or deletion of your data from your deployment administrator
• Location data collected for one purpose will not be reused for an unrelated purpose without new approval

Permissions

On iPhone, When In Use location permission is requested after Start, following an explanation of recording. You can browse assigned maps and help without granting it. Debug iPhone builds also describe local-network access for development servers.

On Android, the application requests the following permissions:

• Fine Location — required to collect GPS coordinates during active tests
• Coarse Location — used as a fallback when fine location is unavailable
• Foreground Service — required to display the persistent tracking notification

Background location permission is not requested or used.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be effective immediately upon posting to this page.

Contact

Contact GridRunner through the support page or admin@d2dpilot.com for privacy, account and independent support questions; contact your coordinator for assignment questions. Publishing a contact address does not establish mailbox operation or staffed response; those are separate public-release checks.

Google Places business search

Coordinators can explicitly search for businesses inside a reviewed plaza outline. Google receives the search area and optional keyword. Selected Place IDs are saved as field targets and downloaded for offline use. Live Google business names, addresses and status are fetched when requested and displayed temporarily; they are not copied into permanent course or visit storage. Field users independently enter their observed shop name and address for a visit record. Google does not receive those visit records or the uploaded plaza workbook through Places search. Google processes Maps and Places requests under its privacy policy, available at https://policies.google.com/privacy.

Service providers

On iPhone, assigned D2D maps use the Google Maps SDK when configured. Poster maps and the unconfigured D2D fallback use Apple MapKit. The map provider processes base-map requests under its privacy policy. Google Maps SDK privacy declarations include diagnostics, identifiers and usage data; their collection and purposes must be reconciled with the actual release configuration, separately from the GPS evidence and visit records uploaded to Field Pilot. App Privacy answers must include applicable third-party SDK practices.

Apple or Google handles sign-in when you choose that provider. Google Places handles explicitly requested business lookups as described above; the configured Postmark service handles password-recovery mail. API hosting, database hosting and backup providers depend on the deployment and still require operator verification. No advertising or cross-app advertising tracking is implemented by the app. Third-party SDK privacy declarations must also be reconciled with the actual released configuration.

隐私政策

生效日期：2026 年 10 月 29 日

概述

Field Pilot 是用于实地测试与覆盖验证的应用。本政策说明我们如何收集、使用和保护您的数据。

GridRunner 是所有者为首发美国版本指定的运营方。Field Pilot 适用于年满 13 岁的用户。未满 13 岁者请勿注册或提供个人信息。如您认为未满 13 岁的儿童已提供信息，请联系支持团队。产品使用资格与 Apple App Store 的内容年龄分级并不相同。

数据收集

位置数据

仅在您于应用中明确开始活动测试后才收集位置数据，包括测试期间的精确 GPS 坐标、各位置点的时间戳，以及 GPS 定位的精度和高度元数据。

在 iPhone 上，您在前台开始的行走会在锁屏或切换应用后继续采集位置。暂停或结束会停止采集。强制退出、系统终止应用或重启 iPhone 会停止记录，应用不会自动重新开始。iPhone 使用“使用 App 期间”定位权限和系统后台定位指示，不请求“始终”权限。

在 Android 上，您明确开始的记录使用前台定位服务，并显示持续通知和停止操作。应用不请求后台定位权限。切换应用不等于停止记录。

GPS 证据与您的账户、设备标识、获分配地图和行走关联。新的 iPhone 上传使用从开始或继续记录起计算的时间间隔，而不是设备开机时间。需要时间审核的历史证据受保护地保留在 iPhone 上，直至审核；恢复流程保留原始记录和接收引用。退出登录后，未发送的证据和个人资料草稿仍为原账户及服务器保留。恢复联网后请重新打开应用完成上传。结束行走并不表示所有证据已被服务器接收。

可选的队友位置

精确队友位置默认关闭。若在测试级别启用，您的位置可能向同一测试中获分配的队友共享；启用前应有明确说明，共享仅限活动测试期间。

地图行走计划与历史

表示计划行走某张地图时，您的显示名称会向获分配的队友及协调员共享，但规划本身不采集位置。上传匹配路线的 GPS 证据后，计划会清除。有匹配证据的地图中，协调员和管理员可查看您的显示名称。行走历史在地图存续期间保留，同时受账户删除规则约束。

您可在网站上、于有权访问的活动中查看自己的简要行走汇总，包括重新分配或完成后的汇总。内容包括路线版本、覆盖计算代次、唯一匹配长度、匹配路段数，以及可用的服务器上传时间。上传时间不等于行走时间；未知的历史信息仍显示为未知。此历史不会恢复旧地图几何数据或他人信息的访问权限。删除地图会移除这些汇总；账户删除须跨活动移除或匿名化个人归属信息。

商户记录（海报活动）

参与海报活动时，可能记录商店名称、地址、许可决定、海报数量、可选备注、时间戳和您的账户标识。本版本不收集照片。这些记录与 GPS 覆盖数据分开。

房屋覆盖数据

具有房屋位置的 D2D 路线按行走保存汇总的已覆盖房屋标识，并显示共享的已覆盖及总数计数。应用不记录住户身份；GPS 接近房屋不等于已确认访问住户。

崩溃诊断

配置 Firebase 的 Android 发布版本使用 Firebase Crashlytics 报告崩溃和无响应。未配置 Firebase 的版本不包含 Crashlytics SDK，也不采集崩溃报告。以下说明仅适用于启用 Crashlytics 的版本：报告包括诊断堆栈、应用及设备版本和 Crashlytics 应用安装标识，由 Google 作为服务提供方处理。调试版本不采集这些报告。应用不向报告附加账户标识、自定义键、日志或位置坐标。诊断用于可靠性分析，不含 Google Analytics，也不用于广告。

iPhone 应用未集成 Firebase Crashlytics。Apple 平台诊断及用户主动向支持团队提供的诊断应与 Android 报告分别考虑。

账户与团队沟通

我们保存账户标识、显示名称、可选公开用户名、第三方身份绑定及第三方提供的电子邮箱。密码以哈希形式存储。可选密码恢复邮箱属于私人信息，由配置的邮件服务使用。个人资料保存回执可能包含先前提交的值。共享团队聊天保存消息、发送者和时间戳。海报备注和地图申请也与账户关联。

服务安全记录

账户事件可能包含 IP 地址，以及可选的 IP 推算城市、地区和国家。事件存储上限为 90 天或 200,000 条；当前最近活动摘要尚无自动到期机制。部署日志和备份保留仍需运营方核实。

数据用途

数据用于验证实地覆盖与测试进度、协调获分配队友、生成覆盖报告和分析、提高地图数据准确性，以及支持实地运营和活动管理。

数据共享

运营账户及实地数据可向获分配队友共享团队名称、消息和共享地图覆盖；这些信息在停止记录后仍可能可见。地图协调员及管理员可查看覆盖和行走历史，部署运营方的授权人员也可按权限访问。

配置 Crashlytics 的 Android 发布版本将崩溃诊断交由 Google Firebase Crashlytics 作为服务提供方处理。应用不向 Crashlytics 发送位置及账户数据。数据不被出售，也不用于营销。

数据保留

并非所有数据类别均已实现自动到期。已批准的删除政策目标为：收到经身份验证的请求后 30 个日历日内完成，完成后最小化删除状态回执保留 90 天，安全事件自发生起最多保留 90 天，滚动备份最多保留 30 天。这些是政策目标，不代表到期已配置或删除已完成。完整执行及确认流程、实际备份到期和公开运营配置仍为发布要求。

已发布地图、路线定义和商户目标可为后续协调保留。为保证地图准确性而保留的共享覆盖必须不含可识别的个人归属；账户删除不应重置这种共享覆盖。不得仅为协调而在账户删除后保留原始 GPS、个人行走历史或用户聊天。仅移除姓名或替换为稳定标识并不构成匿名化。保留的备份须隔离，并在恢复前应用删除抑制；不承诺立即从备份物理抹除。

活跃账户数据

已上传的个人 GPS 证据和个人行走历史在账户存续期间保留，并须通过账户删除流程移除。本政策适用于服务实际保留的记录，不代表保存完整原始轨迹、无限历史或可恢复已移除的记录。现有的有界缓存、本地历史上限及经授权的地图删除仍然适用。

共享的用户创作内容保留至账户删除或经明确授权的内容移除，包括共享聊天文字以及可关联到用户的海报走访名称、地址和备注。这些活跃账户数据未获批准按存储时长自动到期。已另行批准的审核案件、限制证明、安全事件、删除回执及备份规则保持不变。

未发送的本地证据不会因本次决定而自动到期，退出登录也不会删除这些证据。政策获批并不代表账户删除执行程序、备份到期或恢复保护已部署或完成。运营导出文件、最近活动摘要及尚未解决的第三方撤销材料仍需单独决定保留规则并实现相应处理。

崩溃诊断按 Firebase Crashlytics 的保留设置及适用 Google 政策处理。您可按部署保留政策申请删除数据。请求在运营方处理前仍为待处理，提交本身不是删除证明。退出登录不会移除本地待上传证据。

数据安全

位置数据通过加密连接传输，服务器数据采用存储与访问保护，仅授权人员可访问。调试日志限可调试版本，并排除令牌、请求体及原始坐标。

您的权利

在 iPhone 上可用暂停或结束停止定位；在 Android 上可用应用控件或前台服务通知停止。可在设置中关闭可选队友位置共享。您可向部署管理员申请访问或删除数据。为特定目的收集的位置数据不得在未经新批准的情况下用于无关目的。

权限

iPhone 在您选择开始并阅读记录说明后请求“使用 App 期间”定位权限。不授予定位也可浏览获分配地图和帮助。iPhone 调试版本还说明用于开发服务器的本地网络访问。

Android 请求测试期间采集 GPS 所需的精确定位、精确定位不可用时作为回退的粗略定位，以及显示持续记录通知所需的前台服务权限。不请求或使用后台定位权限。

政策变更

本政策可能更新；变更在本页面发布后生效。

联系方式

隐私、账户和独立支持问题请通过支持页面或 admin@d2dpilot.com 联系 GridRunner；任务分配问题请联系协调员。公布邮箱不代表已验证邮箱可用或配备响应人员，这些仍须单独通过公开发布检查。

Google Places 商户搜索

协调员可主动在已审核的广场范围内搜索商户。Google 会收到搜索范围和可选关键词。所选 Place ID 作为实地目标保存并下载供离线使用。实时商户名称、地址和状态按需获取并临时显示，不复制到永久路线或走访存储。实地用户自行填写其观察到的店名及地址。Google 不会通过 Places 搜索收到这些走访记录或上传的广场工作簿。Google 按 https://policies.google.com/privacy 处理 Maps 和 Places 请求。

服务提供方

已配置的 iPhone D2D 地图使用 Google Maps SDK。海报地图及未配置 Google Maps 的 D2D 回退使用 Apple MapKit。地图提供方按其隐私政策处理底图请求。Google Maps SDK 隐私声明包含诊断、标识符和使用数据；须根据实际发布配置核对其采集及用途，并与上传至 Field Pilot 的 GPS 证据及到访记录分别评估。App Privacy 答案须包含适用的第三方 SDK 数据处理。

选择相应提供方时，Apple 或 Google 处理登录。Google Places 处理上述明确请求的商户查询，配置的 Postmark 服务处理密码恢复邮件。API、数据库及备份托管方取决于部署，仍需运营方核实。应用不实现广告或跨应用广告跟踪；第三方 SDK 隐私声明仍须与实际发布配置核对。