| Data or capability | Purpose | Processing/storage | Transmission |
|---|---|---|---|
| Placement photo | Registered tracing background | Bounded normalized copy in the private projects/<id>/ directory |
None by TatMapper |
| Artwork still image | Placement preview and PDF content | Original project-owned copy plus bounded normalized/processed working copy and reversible local preparation settings | None by TatMapper |
| Trace/calibration/transform | Save and resume project | Atomic project.json in the private project directory |
None by TatMapper |
| Appearance preference | Restore System/Light/Dark selection | Atomic local settings JSON in app-support storage | None by TatMapper |
| Print Setups | Reproduce and verify physical print/copy settings | Atomic local JSON with stage metadata, Android app-owned print-job attributes when available, and append-only measurement history | None by TatMapper |
| Camera | Optional placement-photo capture | OS permission; audio disabled | None by TatMapper |
| User-requested stencil output | Generated in memory; user chooses share/print destination | Only to destination chosen in OS share sheet | |
| Advertising/consent state | Free banners, explicit rewarded export, and legal consent choices | Google Mobile Ads/UMP SDK state plus local opaque export-revision unlock hashes | Google advertising/consent services; never includes project/client content |
| Purchase token and entitlement | Optional TatMapper Pro verification, restore, renewal, cancellation, grace, hold, expiry, and revocation | Raw token is transmitted over HTTPS, stored only as Cloud KMS ciphertext plus a one-way hash; minimal plan/state/timestamps are in Firestore and scheduled for TTL deletion 90 days after latest expiry/update; an opaque signed refresh receipt is stored privately on-device | Google Play Developer API and owner-controlled verifier only; never includes project/client content |
| Play Integrity verdict | Bind an entitlement request to the recognized, licensed TatMapper app and an integrity-qualified device | Request hash and encrypted token originate on-device; backend validates Google-decoded package, signing certificate, freshness, app/license, and device verdicts; verdict payload is not persisted | Google Play Integrity API and owner-controlled verifier |
| RTDN message ID | Deduplicate subscription lifecycle notifications | Pub/Sub message ID and processing/deletion timestamps only; automatic 90-day TTL | Google Cloud Pub/Sub and owner-controlled verifier |
The monetized dependency graph includes official Google Mobile Ads/UMP and official Play/App Store purchase plugins. It excludes App Tracking Transparency, Sentry, Firebase Analytics, and an app-owned analytics or account system. The Android build also includes the official Play Integrity library. The entitlement service uses Google Cloud Run, Firestore, Cloud KMS, Secret Manager, and authenticated Pub/Sub; it has no endpoint for project content or user accounts and does not log raw purchase tokens.
Android requests camera, Internet, advertising-ID, and Play Billing permissions. Imports use the system picker; broad storage and audio permissions remain excluded. CI allowlists the monetization plugins and rejects telemetry SDKs.
Android backup is explicitly disabled. backup_rules.xml excludes every
supported internal, external, database, preference, root, and
device-protected-storage domain on Android 11 and lower.
data_extraction_rules.xml applies the same complete exclusions independently
to Android 12+ cloud backup and device transfer. CI verifies both rule files,
the merged manifest, and their presence in the packaged Android artifact.
iOS declares camera/photo usage. The final archive must be inspected for Google Mobile Ads/UMP, purchase, Flutter, and other contributed privacy manifests. First-party project processing remains local, but the final App Privacy answers must include actual monetization SDK behavior.
Deleting a saved project removes its JSON, owned placement photo, owned design, temporary files, and project directory. Bundled sample assets are read directly and never copied into permanent project storage. Exported PDFs already handed to a user-selected destination are outside TatMapper’s ownership.
Store privacy forms and a public privacy-policy URL are still owner-controlled release requirements. They must be drafted from the final signed binary and updated if dependencies or behavior change.
The profile-independent Placement Card contains no user data. A Print Setup PDF contains only setup metadata entered by the user or made available by Android for that TatMapper-labelled app-owned print job. It must not include client names, personal photos, file paths, device identifiers, or secrets. This release includes no QR payload.
Technical and privacy contact: tatmapper@gmail.com. Opening the support
composer uses an Android mailto: intent; monetization independently requires
Internet permission.
TatMapper supplies app version, version code, Android version, device model,
and an empty problem-description field. It never attaches client media,
projects, PDFs, logs, identifiers, or other personal information.