Privacy, in plain English.
CivilGPS is built on a simple principle: an app about public transparency should be transparent about itself — and an app about being watched should never watch you.
What we collect
CivilGPS has no login, no advertising IDs, and no analytics or crash-reporting SDKs. We never build a profile of you. The only things that ever leave your device are listed in "What we send when you ask us to" below — and none of them include your identity.
How the little we hold is protected
What little ever reaches our servers — your waitlist email, and community submissions tied only to a rotating tag — is encrypted in transit (HTTPS) and at rest on our infrastructure, locked behind access controls, and used strictly to operate CivilGPS. We never sell it, never use it to build a profile of you, and never share it except where the law genuinely compels us. And because we deliberately collect almost nothing, there is almost nothing that could ever be demanded, leaked, or misused. That is the design, not an afterthought.
Acceptable use
CivilGPS is a civic-transparency tool for public awareness of publicly-disclosed surveillance. It must not be used to facilitate, plan, commit, or conceal a crime, to evade a lawful police stop, or to interfere with law enforcement. We fight privacy invasion and the abuse of these systems — we do not support crime, and we do not condone using camera awareness to break the law. The full disclaimer is on the home page.
What stays on your device
- Location & heading power the augmented-reality features (showing nearby cameras and their direction) and Camera Alerts. They are processed on your phone. We do not continuously transmit your location, and we never store a location trail tied to you. (One deliberate exception: when you tap to post a community road report, that single report's coordinates are sent — see below.)
- Camera is used for the live AR view and to photograph cameras you choose to report. Photos you take in Spot are stored on your device.
- Field log (optional, toggle in Settings) records device sensor readings — GPS, compass, speed — to improve location accuracy over time. It is stored only on your device. Nothing is uploaded automatically; you can export it or turn it off at any time.
- Watch Zones, reports, and settings are saved locally on your device.
What we send when you ask us to
These are the only times data leaves your device for our own servers. Each is user-initiated and tied only to a random, weekly-rotating device tag — never an account, name, advertising ID, or device identifier.
- Community road reports. When you tap to report police, a crash, or a hazard, that report's exact coordinates, the report type, and the rotating device tag are sent to our reports server so other drivers nearby can see it. These reports are ephemeral (shown for ~2 hours) and are not linked to you. If you don't post a report, nothing is sent.
- Camera reports. When you confirm or report a camera, the camera's public location, facing, and confidence are sent (so the community map survives a reinstall and can be shared). We do not send your location or your photo.
- Precision training (only if Field Log is on). Anonymized sensor offsets (e.g. "+3 m east, +4° heading") plus a coarse ~40 km area tag are sent to improve location accuracy. These offsets cannot reconstruct where you were, and the area tag is metro-level only. Turn Field Log off in Settings to send nothing.
Third-party services
- Destination search (geocoding). When you search for a place to navigate to, the text you type is sent to third-party geocoders (Esri/ArcGIS and Komoot Photon) to turn it into coordinates, with a coarse location bias. This is how the address bar resolves addresses, as with any map app.
- Routing. Turn-by-turn routes are computed by a third-party routing service (Valhalla, on OpenStreetMap data); your start and destination are sent to it to calculate the route.
- Map basemap tiles are served by a third-party map provider (Carto, using OpenStreetMap data). Loading map tiles necessarily reveals the approximate area you are viewing to that provider, as with any map app.
- Augmented-reality Precision Mode (optional, can be turned off in Settings) uses Google's ARCore Geospatial service for precise positioning. When active, it shares camera imagery with Google to determine your location. It is disclosed in the app and you can disable it.
The website waitlist
If you join the waitlist on civilgps.com, we store the email address you typed and the time you submitted it — nothing else. It is used for exactly one purpose: telling you when CivilGPS ships. No resale, no sharing, no marketing chains. Email privacy@civilgps.com any time to be removed.
Camera data
Camera locations come from OpenStreetMap, mapped by the DeFlock community project, and are open data under the ODbL license. When you contribute a camera report, you are helping maintain that open public record.
Your control
- Turn the field log off in Settings.
- Turn Precision Mode off in Settings.
- Camera and location permissions can be revoked in your device settings.
- Uninstalling removes all locally stored data.
Contact
Questions: privacy@civilgps.com