Field Notes
Privacy

Last updated 28 August 2026 · applies to the Field Notes Android app

The short version

Field Notes has no account, no analytics, no advertising and no telemetry. We do not operate a server that your records go to, and we cannot see your data. Everything the app records is stored on your phone. It leaves only when you set up a backup or ask for a species identification, and this page lists every one of those cases.

What the app stores on your phone

Photos, audio notes, GPS coordinates and accuracy, timestamps, and whatever you type — species, tags, conditions, notes. Plus the structure you build: properties, management zones, boundaries, plant batches, check-ins, tracks. It is kept in a SQLite database and a folder of files in the app’s private storage, and you can export the whole thing at any time in open formats.

The app asks for camera, microphone, location and storage permissions. Camera and microphone are used only while you are making a capture. Location is used to place a record and to draw your position on the map; a capture that has no fix is saved and flagged as unlocated rather than given a made-up coordinate.

When data leaves the phone

Five cases. Backups, identification and the context lookup only happen because you asked; map imagery loads whenever the map is open, and can be switched off.

1 · Backup to your own computer

The app pushes an encrypted copy across your local network to a machine you own, running the Field Notes desktop receiver. Nothing touches the internet, there is no account, and the receiving computer only ever holds files it cannot read.

2 · Backup to your own Google Drive

If you connect a Google account, the app requests one permission — drive.appdata — which grants access to a hidden folder Drive creates for this app. That folder is not visible in your Drive, no other app can open it, and the app cannot read anything that was already in your Drive. It cannot see your documents, your photos or your email.

The phone encrypts every object before it is uploaded, so Google stores ciphertext under meaningless names and holds no key. Signing in creates no account with us and sends us nothing; the access token stays on your device. You can revoke it at myaccount.google.com/permissions and the app keeps working, minus the uploads.

3 · Species identification, if you set it up

Identification is off until you supply your own API key. There are two paths and you may use either, both, or neither.

Pl@ntNet receives the photograph and nothing else — no coordinates, no notes, no identifiers. Their handling of it is governed by Pl@ntNet’s own terms, under your key.

A language model of your choosing (Anthropic, OpenAI, or any compatible endpoint you point it at) receives the photograph plus a short description of the circumstances — the month, the ground, what you have already recorded nearby, and the location rounded to roughly a kilometre. That rounding is deliberate: it is enough for a model to rule out the wrong hemisphere and not enough to find your gate. Your key, your account, their terms.

Nothing a machine suggests is ever written down as fact. Every suggestion is kept as a suggestion until you accept it.

4 · Map tiles

The map’s standard view is satellite imagery, drawn from the USGS National Map whenever the map is on screen and the phone has signal; downloading an offline basemap requests tiles from Protomaps. A tile request necessarily reveals which part of the world you are looking at, in the same way loading any map does — it does not carry your records and is not tied to an identity. If you would rather the map ask nothing of anyone, switch the satellite layer off under Layers and use only the offline basemap; imagery tiles can also use mobile data, which is worth knowing on a metered plan.

5 · Weather and soil context, if you switch it on

Off by default. Turned on in Settings, it looks up the weather on the date of a record and the soil under it, so a note written in a wet March still reads correctly three years later. It sends the date and a rounded location to two public services: Open-Meteo for the weather archive and the USDA-NRCS Soil Data Access for the soil survey. No photo, no note, no account, no device identifier.

The location is rounded to about a kilometre before it goes — the same rounding the identification path uses. Weather at that resolution is the same weather; a soil map unit occasionally resolves to the one next door. That is a trade we are happy to make in exchange for not broadcasting a gate.

What we never do

No analytics or crash reporting SDK. No advertising identifier. No selling or sharing of anything, because there is nowhere for it to be sold from. No account, so no profile. We have no ability to read a backup you have made, encrypted or not — there is no service on our end that receives one.

Encryption and the thing you can actually lose

Encrypted backups use a key wrapped by both a passphrase you choose and a twelve-word recovery phrase the app shows you once. Either one opens it. Neither is stored anywhere but your device and wherever you wrote the recovery phrase down.

The consequence is worth saying plainly: if you lose the passphrase and the recovery phrase, the backup is gone. Not gone-as-in-file-a-support-ticket. Gone. We cannot recover it, and an app that could would be an app whose promises were false.

Deleting things

Records you delete are marked deleted and dropped from the app; uninstalling removes the database and the files with it. Copies you have already sent to Drive or to your own computer are yours to remove — Drive’s hidden app folder can be cleared from Google’s storage settings, and revoking the permission stops any further uploads.

Children

The app is not directed at children and collects nothing about anyone’s identity, age or contacts.

Changes

If this changes we will change this page and move the date at the top. There is no mailing list to notify because we don’t have your address.

Contact

Short’s Resort Field Station, Lampasas County, Texas. shortsresorttx@gmail.com.