Privacy Policy

1. Introduction: The "Lens" Promise

We believe that professional tools should not come at the cost of personal privacy. Lens ("the App") is designed to be "Private by Design" using a "Local-First" architecture. This means that most processing stays on your device. For device clock integrity, Lens may make brief HTTPS requests to public time references (see Content Credentials below); those checks do not send your photos, videos, or location to Lens servers. Lens also uses specialized Trusted Timestamp provisions where applicable and Content Credentials to provide cryptographic provenance for supported photos and videos.

Provenance Persistence (iCloud): To ensure cryptographically-valid Content Credentials persist across app uninstalls, the app prioritizes saving signed "Master Copies" to your iCloud Drive by default. This data resides in your personal Apple storage, not on our servers.

Offline Maps is Opt-In: By default, the app uses Apple Maps which keeps your location viewing private within Apple's ecosystem. If you choose to enable Offline Maps, you'll be asked for explicit consent before any data is shared with Mapbox (a third-party service). You can disable this feature at any time.

We do not sell your data. We do not use your personal content to train public AI models. We do not track you across other apps and websites.

Who we are: Lens is made by Fieldnotes dot Dev Opc, a One Person Corporation registered in the Philippines (SEC Registration No. 2026020236752-50). Fieldnotes dot Dev Opc is the personal information controller under the Philippine Data Privacy Act, and the controller under the GDPR and UK GDPR, for the personal data described in this policy. This policy covers the Lens iOS app, lensproof.app, and Lens Proof Check (check.lensproof.app). Our contact details are in Section 12.

2. The Data Vector Audit: What We Collect & Why

To comply with Apple's App Store transparency requirements, we categorize data based on how it is linked to your identity.

A. Data Linked to You

• Contact Info (Email/Name): Collected only if you voluntarily contact 'User Support' (e.g., via email or feedback forms). We use this solely to respond to your inquiries.
• Access Requests (Email): Collected only when you voluntarily submit your email address via the "Request Access" form on our website.
  • Purpose: To notify you when access is granted or to send product updates relevant to your request.
  • Storage: Processed per our website and support workflows (see contact channels you use).
  • Retention: Retained until you request deletion or unsubscribe.
• Event offer requests (Email and answers): When you request an event offer such as the La French Tech Manila Lens Trust pass, we collect the email address you provide and your answers to the two event questions. We use this information to send the requested offer, understand who is trying Lens, and respond to your request. We allocate one unique App Store offer code from a server-side Firestore inventory and keep a keyed hash of the normalized email in the response and claim ledger so a retry receives the same code instead of consuming another one. The ledger does not store the email in plain text. We store the email as an event contact in Resend; it is marked unsubscribed from marketing broadcasts unless you separately opt in to Lens updates. The two answers are stored as event-contact properties so we can understand the audience for this campaign. Event submissions and delivery records are retained for up to 90 days after the event unless you opt in to updates, request deletion, or a longer period is needed to resolve a delivery or support issue. The email delivery service may retain message metadata and delivery logs under its own policy. You may request deletion or ask us to stop retaining event-contact data by contacting support.
• User Feedback (C2PA) & on-device history: Older Lens builds could store optional general-feedback text on your device for your reference. The app does not automatically sync that history to our servers. You can delete on-device feedback history and diagnostic log files anytime from Settings → Data & Privacy → Clear local support data. Current builds open Mail for new general feedback (see below); Lens does not receive that content until you send the email. Network features unrelated to support (for example C2PA enrollment, AI, or configuration) are described elsewhere in this policy.
• Support email (feedback & diagnostics): When you send email from Lens (for example Contact Support under Settings → Help, which opens Mail via a mailto: link with a prefilled template, or Report Problem from Settings → the version row → Diagnostics), you choose what to send. This may include:
  • Free-form text
  • Optional diagnostic log attachments (off by default; you opt in at send time in the pre-send flow)
  • Optional images (for example when attaching from the system share sheet)
  • Your email address is visible to us as the sender when you use email. Diagnostic logs are scrubbed of common sensitive fields before attachment; you remain in control of whether anything is sent.
• Developer diagnostics screen: Settings → About includes a developer diagnostics screen for troubleshooting and support. It displays information already described in this policy: your hashed trial registry identifier, trial status and dates, server sync state, Gemini usage count, and build/device info. Nothing on this screen is sent anywhere automatically; copying or sharing any of it is your choice.
• User Content (Photos/Text): Collected only when you explicitly use our AI features or Support features.
  • Example: When you turn on AI features and ask Lens to write captions or report text, Lens sends smaller copies of the selected photos and report details to the AI provider you chose: Anthropic (Claude) or Google (Gemini). See Section 2.G and Section 3.

B. Data Not Linked to You

• Usage / feature analytics: We do not run in-app usage analytics, ad profiling, or similar tracking. We do not collect product-interaction events for marketing analytics.
• Automatic crash or diagnostics upload: We do not send automatic crash reports or upload diagnostic telemetry to our servers. Optional support email may include attachments only when you explicitly add them.
• Location Data (Precise): Used locally for weather, address/coordinate lines on the overlay, and capture metadata. Photo and video capture do not start unless Lens has When In Use (or Always) authorization and Precise Location is enabled for the app—Denied, Restricted, or Approximate Location only blocks the shutter and record actions until you fix this in iOS Settings (the app shows in-app guidance). These checks and any coordinates stay on your device; Lens does not send your GPS fixes to our servers to enforce this gate. If you turn on AI features and ask Lens to write captions or report text, the GPS coordinates of the selected photos are sent to the AI provider you chose (see Section 2.G).
• Location spoofing resistance (on device): For integrity of documentation-grade captures, Lens ignores location updates that iOS marks as simulated by software (for example Xcode / GPX) or produced by an accessory, and invalid readings. That filtering happens locally; it is not a separate upload to us.
• Location Data (Approximate): If you use opt-in third-party offline maps, approximate location and related data may be processed by that provider under its policy—not for ad analytics from Lens. Approximate-only access for Lens itself is not sufficient for photo/video capture (see above).

C. Content Credentials (C2PA)

• Cryptographic Provenance: If you enable Content Credentials, Lens cryptographically signs your photo and video files using a Hardware-Backed Key stored in your device's Apple Secure Enclave. This feature is built on the C2PA Technical Specification (see the current conformance record below).
• Embedded Data & Data Minimization: This process embeds a tamper-evident "Manifest" directly into the image or video file. To protect your privacy, we implement Data Minimization through user-controlled settings:
  • Context: Date, time, device info, and (for photos) capture settings (e.g., ISO, aperture, exposure). Location (GPS) is off by default; users can opt-in via Settings > Content Credentials (or Privacy Controls).
  • Privacy Controls: Users can opt-out of embedding specific metadata (e.g., Location, Device Model, Capture Settings) via Settings. If disabled, those assertions are completely omitted from the manifest (Soft Redaction).
  • Video: Video manifests include device info and optionally location and creation time; capture settings (ISO, aperture, exposure) are not available for video and are omitted from video manifests.
  • Identity: The application identity ("Lens App Signer").
  • Integrity: A hash of the pixel data to prove no pixel-level edits were made.
  • Temporal integrity (device clock): Before you start a photo or video capture, and when preparing Content Credentials signing, Lens may run a short HTTPS check against public endpoints (https://www.apple.com, https://www.cloudflare.com, https://www.google.com). The app compares the response Date header with your device clock. No photos, videos, GPS coordinates, or manifest payloads are sent in those requests. Those providers may receive standard HTTP/TLS metadata (for example IP address) as described in their respective privacy policies; Lens does not use this for advertising or cross-app tracking. Verification results are cached briefly on your device to limit repeat requests.
    • Tampering protection: If manipulation between your device clock and trusted network time is confirmed while online, capture may be blocked and Content Credentials signing may be blocked until the device clock is corrected (for example Settings → General → Date & Time → Set Automatically).
    • Offline, timeout, or inconclusive checks: Photo and video capture may still proceed. Content Credentials may still be available depending on your settings, sometimes with lower trust for timestamps—for example when signing cannot obtain a trusted network time check or an RFC 3161 timestamp (verification tools may reflect reduced certainty). Enrollment and in-app status surfaces describe limited-trust flows when they apply.
• Hardware-Backed Key Lifecycle (Revocation): Your private signing key is generated inside the Apple Secure Enclave and never leaves your device.
  • Non-Exportable: The key cannot be accessed, backed up, or cloned by us or any third party.
  • Revocation Logic: Because keys are bound to the specific application installation on your device, uninstalling the App or clearing App Data effectively revokes the keys by rendering them permanently inaccessible. A subsequent fresh installation will trigger the generation of a new, unique signing key.
• Current Trust Status (photos and videos): Lens is C2PA conformant at Max Assurance Level 1 for photo and video signing (confirmed by the C2PA Conformance Program). Lens currently uses a Trufo CA-signed certificate for the dated production-trust sample. SSL.com provides RFC 3161 trusted timestamps.
  • ✓ Cryptographic integrity is fully valid — the signature proves the file has been unaltered since capture on your hardware.
  • ✓ Current conformance record — The C2PA public list records Lens Proof-of-Work as conformant at Max Assurance Level 1 under Conformance Program v0.2 for C2PA Specification v2.4 (record 019fe372).
  • ✓ Formally C2PA conformant — Lens's Generator Product has been deemed conformant at Max Assurance Level 1 by the C2PA Conformance Program.
  • ! Older files or validators may show "Unrecognized Signer" — this is a signer-recognition result for that file and validator; it does not reflect file integrity or our conformance status.
  • Doc Compliance Documentation: See our Content Credentials page for detailed security and UX compliance information.
• External Transmission: Content Credentials signing (manifest creation and media signing) happens on your device. Signed "Master Copies" are saved to iCloud Drive by default to ensure persistence (Cloud Sync). You can change this to a local-only folder in Settings. No photos or videos are uploaded to our servers for signing. If you enroll in CA-signed Content Credentials, the app may send a certificate signing request (CSR) and related enrollment metadata to our signing backend so a certificate chain can be issued—see Lens signing service in Section 3.
• Control: This feature is Opt-In and requires Lens Trust. Enrollment requires your explicit action. You can disable signing at any time in Settings.
• PDF reports: When Content Credentials are enabled, Lens signs generated PDF exports on your device by default unless you turn off Content Credentials for PDF reports in Settings. PDF document generation is included in the current public C2PA conformance record. This does not mean Lens declares application/pdf as a Validate media type. No PDF file content is uploaded to our servers for signing.
• Storage & Persistence: Signed media is saved as "Master Copies" to your device's Files app. To ensure persistence across app uninstalls, Lens prioritizes iCloud Drive or allows you to select a Custom Folder.
  • Naming Convention: Filenames include a sanitized organizational prefix and a unique 4-character device hash to prevent collisions in shared storage environments.

Terminology: In this policy, "Content Credentials" refers to the provenance data embedded in your media, while "C2PA" refers to the open standard and ecosystem that defines how this data is structured, signed, and verified.

D. Lens Trust subscriptions

What we collect

• Purchases: Apple processes all payments. We do not receive your name, payment card, or Apple Account details.
• Subscription check: When you enroll in or use CA-signed Content Credentials, the app sends our signing service the Apple-signed transaction record for your Lens Trust subscription. If your subscription is in Apple's billing grace period, the app also sends Apple's signed renewal record. These records contain product and transaction identifiers and purchase, expiry, and renewal dates. Our signing service checks them with Apple's certificates to confirm that your subscription is active. They do not contain your name, email, or payment details.

Purpose

• To confirm your Lens Trust subscription, issue and manage your signing certificate, and prevent unauthorized use of CA-signed Content Credentials.
• To show your purchase status in the app.

Legal basis

• Contract: Providing the Lens Trust features you buy.

Retention

• Enrollment and certificate records: for as long as your certificate is valid, and after that for as long as certificate authority rules require us to keep an audit record.

Your rights

• You can cancel a subscription in your Apple Account subscription settings.
• To ask about enrollment records, contact us (Section 12).

E. App trial eligibility (server registry)

When you use Lens's free app trial (before or without a paid subscription), the app may verify eligibility with our signing service. This prevents repeated trials after the trial window has ended on the same device (for example after deleting and reinstalling the app).

What we collect

• Device integrity token: Lens uses Apple DeviceCheck to obtain a device token. The token is sent to our backend only to validate integrity and derive a one-way cryptographic hash. We do not store the raw DeviceCheck token.
• Trial record: We store the hashed device key, trial start and end dates, trial status (for example active or expired), whether the trial was grandfathered from an earlier policy, and a count of AI reports used during the trial (capped in the app).
• App integrity: Requests include an app-integrity token so only the genuine Lens app can call trial endpoints.
• What we do not link: Trial records are tied to the device hash, not to your name, email, or Apple Account. Using a different Apple Account on the same device does not start a new trial after the device trial has expired.

When this applies

• Our server registry can be enabled or disabled remotely by us. When enabled (including in current production builds), first-time trial access may require a short online setup sync. If you are offline with no prior successful sync, trial features may be unavailable until you connect.
• If the registry is unavailable, the app may fall back to local-only trial timing until server sync succeeds; once synced, server state governs eligibility.

Purpose

• To provide the time-limited free trial.
• To enforce one trial per device and trial usage limits (fraud prevention).

Legal basis

• Contractual necessity: Providing trial access you request.
• Legitimate interest: Preventing trial abuse with minimal device-level data.

Retention

• Trial registry records are kept in Google Cloud Firestore for as long as needed to enforce trial and subscription eligibility, resolve disputes, and maintain service integrity, then deleted or anonymized when no longer required.

Your rights

• Deleting the app removes local trial flags; it does not reset an expired server trial on the same device.
• Because we do not maintain a named account for trials, contact us at reneboygarcia@field-notes.dev to ask about trial registry data tied to your device. We may need information you provide voluntarily to locate the correct record.

F. Website and Lens Proof Check

This section covers lensproof.app and Lens Proof Check (check.lensproof.app).

• No tracking: The websites do not use tracking cookies, analytics, or advertising scripts. The site saves your language choice in your browser's local storage. This setting stays in your browser.
• Server logs: Our hosting provider, Vercel, processes standard request data, such as IP address, user agent, and request time, to deliver the site and protect it from abuse. These logs are kept for a short time and then deleted automatically.
• File checks run in your browser: Lens Proof Check reads and verifies files in your browser. It does not upload your files to our servers or keep a copy.
• Explain Credentials (optional, when available): If you ask for an AI explanation, the site sends your question and the credential data read from the file to our server. Credential data is the manifest and validation results, not the image or video pixels. It can include details that the file's creator embedded, such as capture time or location. Our server sends the request through the Vercel AI Gateway to an AI model provider. To limit abuse, we keep a request counter linked to your IP address for 60 seconds, and a session record (a hash of the credential data and a turn count) for 15 minutes, in Upstash Redis. Vercel and the model provider process the request under their own policies.
• Live OCSP checks (optional, off by default): If you turn on live revocation checking, your browser contacts the certificate authority's OCSP service to check whether a signing certificate was revoked. These requests contain certificate identifiers, not file content. The certificate authority receives your IP address.
• Forms: For access requests and event offers, see Section 2.A.

G. AI features (Lens app)

Lens can use AI to write photo captions, summaries, and report text. AI features require Lens Pro or Lens Trust. The free trial does not include AI features.

Your choice and consent

• One AI features switch in Settings → AI controls all AI in Lens. It is off by default on every plan.
• You choose the AI provider under AI model on the same screen. The default is Claude by Anthropic (Claude Sonnet 5.5). The other choice is Gemini by Google, through Firebase AI Logic.
• When you turn on AI features, or tap an AI action while they are off, Lens shows a consent sheet that names the company that receives your data. Lens sends nothing to an AI provider until you tap Turn On.
• You can turn AI features off at any time. Lens then stops sending data to the AI provider.

What we send

When AI features are on and you ask Lens to write captions or report text, Lens sends the following to the provider you chose:

• Smaller copies of the photos you select. Each copy is a JPEG about 384 pixels in size, not the original photo file.
• A label for each photo with its capture time and, if the photo has GPS data, its coordinates to five decimal places.
• Report details: project name, dates, location, and weather.
• Your AI instructions and activity names.

In versions of Lens that offer Claude, Lens takes a photo's location only from the photo's own GPS and EXIF data and does not use AI to suggest a location.

How requests travel

• Claude: Lens sends the request to the Lens signing service, which we operate on Google Cloud. The signing service forwards the request to Anthropic with our Anthropic API key. The key stays on our server and is not stored in the app. The signing service does not log prompts, images, or AI replies. It logs only technical details, such as the model, the number of images, the request size, and timing. Requests include an app-integrity token so only the genuine Lens app can use this service.
• Gemini: Lens sends the request to Google through Firebase AI Logic.

How providers handle the data

• Anthropic: We use Anthropic's commercial API. Under Anthropic's Commercial Terms, Anthropic may not train models on this content. Anthropic deletes API inputs and outputs within 30 days. It can keep them longer to enforce its Usage Policy (up to 2 years for flagged content) or to comply with the law. See How long do you store personal data? in Anthropic's Privacy Center.
• Google: We use Google's paid Gemini API, so Google does not use this data to improve its products. Google keeps each request, including the photos, and its response for a limited time, only to detect misuse and meet legal requirements. See the Gemini API Terms.

Earlier app versions

Versions of Lens that do not offer Claude use only Google Gemini for AI. In those versions, if the selected photos have no location data, Lens can also send up to five of them to Google Gemini to suggest the report's location. Versions of Lens that offer Claude do not do this.

Purpose

• To write the photo captions, summaries, and report text you ask for.

Legal basis

• Consent: You turn on AI features on the consent sheet. You can withdraw consent at any time by turning AI features off.

Retention

• We do not keep your AI requests or the AI replies on our servers. The text that AI writes is saved in your report on your device. Each provider's retention is described above.

3. Third-Party Service Providers

We limit our partners to those essential for the App's functionality.

4. Your Rights

Depending on where you live, the Philippine Data Privacy Act, the GDPR, the UK GDPR, and similar laws give you these rights:

• Be informed: Know what data we process and why. This policy does that.
• Access: Ask for a copy of the personal data we hold about you.
• Correct: Ask us to fix inaccurate or incomplete data.
• Delete: Ask us to delete your data when we no longer need it, or when you withdraw consent or object.
• Restrict: Ask us to limit how we use your data, for example while we check that it is accurate.
• Object: Object to processing based on legitimate interests. You can object to direct marketing at any time.
• Portability: Ask for data you gave us in a machine-readable format, or ask us to send it to another provider.
• Withdraw consent: Withdraw consent at any time. This does not affect processing that happened before you withdrew it.
• Complain: Complain to a privacy regulator. In the Philippines, contact the National Privacy Commission. In the EEA, contact the data protection authority in your country. In the UK, contact the Information Commissioner's Office.

How to make a request: Email us at the address in Section 12. We reply within one month. For complex requests, we can take two more months, and we tell you why. We do not have user accounts, so we may ask for details that help us find your records, such as the email address you used or the trial identifier shown on the developer diagnostics screen. We may also ask for information to confirm your identity. If we refuse a request, we tell you why.

How these rights work in a local-first app

Because we are a "Local-First" app, we do not have a central user database to "search" for your data. You possess the ultimate control:

• Right to Delete: You can delete all your stored data (Projects, Photos, Settings) by simply deleting the App from your device.
  • Exception (Persistent Storage): If you have enabled Content Credentials and chose to save them in iCloud Drive or a Custom Folder, those files are considered user-owned data and will not be deleted when the app is uninstalled. They must be deleted manually from the Files app.
  • Feedback on device: Local copies of general feedback are removed when you delete the app. Support email is between you and our inbox—retention follows normal email/support practices. You do not need to “disable analytics” to stop automatic cloud feedback sync, because the app does not perform that class of background upload.
• Revoking Permissions: You can revoke access to the Camera, Microphone, Photo Library, or Location at any time via your iOS Settings. Turning Location off for Lens, or switching Lens to Approximate Location only, blocks new photo and video capture until access is restored to While Using the App (or Always) with Precise Location on—consistent with the capture gate described above.
• Opt-Out of Third-Party Services:
  • Mapbox (Offline Maps): Go to Settings → Offline Maps → Disable Offline Maps. This immediately stops data sharing and deletes all downloaded map tiles from your device.
  • AI Features: Leave the AI features switch off in Settings → AI. It is off by default. While it is off, Lens sends nothing to Anthropic or Google for AI. If you turned it on, you can turn it off at any time to stop sharing. Versions of Lens that do not offer Claude can also send photos without location data to Google Gemini to suggest a report location. Versions that offer Claude do not.
  • Diagnostics in email: Bug reports and support flows that use email may offer an optional diagnostic file attachment, off by default—only attach what you are comfortable sharing.
• Trial registry: There is no in-app toggle to disable server trial verification while the registry feature is enabled. To stop further trial sync calls, discontinue use of the trial or contact us (Section 12). Paid subscribers with an active StoreKit entitlement are not subject to trial registry checks.

5. Global Compliance (Philippine Data Privacy Act, GDPR, CCPA, & PECR)

Jurisdictional Locking: Regardless of where you live, we apply the strictest data protection standards to everyone. As a Philippine-incorporated company, we also comply with the Data Privacy Act of 2012 (R.A. No. 10173) and the issuances of the National Privacy Commission (NPC).

Legal bases for processing

International transfers

We are based in the Philippines. Our service providers, including Apple, Google, Anthropic, Mapbox, Vercel, Upstash, Resend, SSL.com, and Trufo, may process data in the United States or other countries. Some of these countries do not have an EU or UK adequacy decision. When the GDPR or UK GDPR applies to a transfer, we rely on the provider's Standard Contractual Clauses (with the UK addendum where needed), or on its certification under the EU-U.S. Data Privacy Framework and its UK extension where available. You can ask us for more information about these safeguards.

Automated decisions

We do not make decisions based only on automated processing that have legal or similarly significant effects on you. The trial registry checks automatically whether a device already used its free trial. This decision affects only trial access. If you think it is wrong, contact us.

6. Retention

We keep personal data only for as long as we need it for the purposes in this policy, including legal, accounting, and dispute needs. To set a retention period, we consider the amount, type, and sensitivity of the data, the risk of harm from misuse, whether we can meet the purpose another way, and legal requirements. When we no longer need data, we delete or anonymize it. If that is not possible yet, for example because the data is in a backup, we isolate it until we can delete it.

Specific periods are in Section 2. In summary:

• Event offer data: up to 90 days after the event, unless you opt in to updates.
• Access request emails: until you unsubscribe or ask us to delete them.
• Support emails: until your request is resolved and for as long as we need a record of it. You can ask us to delete them.
• Trial registry records: see Section 2.E.
• Lens Trust enrollment records: see Section 2.D.
• Explain Credentials rate-limit data: 60 seconds (counter) and 15 minutes (session record).

7. Other Disclosures

We may share personal data with:

• Authorities: Law enforcement, regulators, or courts, when the law requires it or when we believe in good faith that it is necessary to protect our rights, your safety, or the safety of others.
• Professional advisors: Lawyers, accountants, auditors, and insurers, when they need it to advise us.
• Business transfers: A buyer, investor, or successor, if we are involved in a merger, acquisition, financing, or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

8. Security

We use technical and organizational measures to protect personal data. These include signing keys in the Apple Secure Enclave, encrypted HTTPS connections, app-integrity checks on our services, one-way hashing of device identifiers, and restricted access to our systems. No system is fully secure. If a breach affects your personal data, we notify you and the regulators when the law requires it.

9. Operational Compliance (Audio/Video)

To support professionals operating in jurisdictions with strict wiretapping laws (e.g., Two-Party Consent states), Lens includes a Hardware-Level Mute feature.

• Video Mute: You can physically disconnect the microphone input for video recordings via the top settings bar.
• Verification: This setting persists across sessions, allowing you to operate safely in sensitive environments (e.g., hospitals, secure facilities) without risk of accidental audio capture.

10. Children's Privacy

Lens is a professional utility and is not directed at children under the age of 13. We do not knowingly collect personal information from children. If your country sets a higher age for using online services without parental consent, you must meet that age or have permission from a parent or guardian. If you think a child gave us personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this policy as the App evolves. When we do, we change the "Last Updated" date. We announce significant changes in the app or in the App Store "What's New" text before they take effect.

12. Contact Us

For privacy questions, or to use your rights, contact our Data Protection Officer:

• Email: reneboygarcia@field-notes.dev
• Mail: Fieldnotes dot Dev Opc, 146 Sitio Kanluran, Wawa, Batangas City, Batangas 4201, Philippines