Mapdesk Privacy Annex

This Annex applies to Mapdesk Mobile for iOS and Android and to Mapdesk at mapdesk.app, operated by Stiple Inc. ("Stiple," "we," "us"). Sections 2 to 13 describe the phone app — what it accesses on your device, what it streams to Stiple, and what it deliberately does not do; in those sections, "Mapdesk" and "the App" mean Mapdesk Mobile. Section 14 describes Mapdesk on the web, and Sections 15 and 16 describe how your geospatial data, including point clouds, is handled and shared.

Mapdesk is a professional field surveying and mapping tool. It is used by surveyors, geomatics professionals, engineers, and field crews to capture high-accuracy positions and observations in the field and stream them to a Stiple account.

Platform parity. Except where a specific platform mechanism is described (for example, the iOS location background mode), Mapdesk behaves the same way and discloses the same practices on both iOS and Android. There is no two-track behaviour between the platforms.

2.1 Why Mapdesk Needs Precise Location

Recording accurate geographic positions is the core function of a field survey app. Location is therefore not an optional add-on — it is the purpose of the App. Mapdesk works with precise (high-accuracy) location, including the position reported by your device and, when you connect one, the survey-grade position reported by an external GNSS receiver. An approximate location is not sufficient for surveying.

2.2 Foreground and Background — Gated to an Active Survey

Field surveys are not always done with the app on screen. A long traverse can run for many minutes; a surveyor may lock the screen to save battery, take a call, or switch to another app to check a plan mid-survey. So that your survey keeps recording points reliably through these everyday interruptions, Mapdesk collects location in the background as well as the foreground. This background collection is strictly gated to an active survey session:

• Only during an active survey. Continuous location collection — foreground or background — happens only while you have started a survey session and the App is recording points. When no survey is active (for example, while you are reviewing data, editing attributes, or on the App's settings screen), Mapdesk is not collecting your location.
• It stops when the survey stops. When you end the survey session, background location collection ends. Mapdesk does not continue to collect location after the survey is over.
• Never for tracking. Location is used solely to produce the survey you are creating. It is never used for advertising, analytics, profiling, or to build a history of your movements, and it is never shared for those purposes.

2.3 How Each Platform Handles Background Location

• iOS. Mapdesk uses the iOS location background mode so that an active survey continues to record positions while the App is backgrounded or the screen is locked. iOS shows its standard background-location indicator while this is happening.
• Android. Mapdesk keeps an active survey session running while the App is backgrounded or the screen is locked, so points continue to record. During a rover survey, the precise position arrives from your connected GNSS receiver over the Bluetooth link described in Section 3. Ending the survey stops all recording.

2.4 You Are in Control

You grant location access through your device's standard permission prompts, and you can change or revoke that permission at any time in your device settings. If you revoke location access, Mapdesk cannot perform surveys, but you can still sign in and review previously synced work. See the permissions table in Section 12.

Mapdesk uses Bluetooth in the foreground and the background, on both iOS and Android, for a single purpose: to connect to and exchange data with an external GNSS receiver — for example, a Septentrio mosaic-X5, a u-blox ZED-F9P, or a SparkFun RTK device. Background Bluetooth is required because the receiver connection must stay live for the duration of a survey, including while the App is backgrounded or the screen is locked (see Section 2).

3.1 What Travels Over the Bluetooth Link

The connection to the receiver is bidirectional:

• From Mapdesk to the receiver: Mapdesk streams RTCM correction data to the receiver so it can compute a corrected, high-accuracy position.
• From the receiver to Mapdesk: the receiver returns the precise position, accuracy estimates, satellite and constellation information, and fix-quality data that Mapdesk records as part of your survey.

The version of Mapdesk submitted for this release does not request camera permission and does not use the camera. There is no camera-based data collection in the launch build.

Until that release ships, treat every statement in this Annex about images and camera use as forward-looking. The launch build collects no images and requests no camera access.

Mapdesk uses WorkOS as its identity provider. WorkOS is a U.S. company; the cross-border flows for Mapdesk Mobile are described in Section 10.

5.1 Sign-In Happens in the System Browser

When you sign in, Mapdesk hands the sign-in off to a WorkOS-hosted page in your device's system browser — Safari via SFSafariViewController on iOS, and Chrome Custom Tabs on Android. Because the sign-in page runs in the system browser and not inside Mapdesk's own screens, the Mapdesk app process never sees your password. Your password is entered into, and handled by, WorkOS.

5.2 What WorkOS Returns to the App

After a successful sign-in, WorkOS returns to the App an access token, a refresh token, and your name, email address, and profile photo.

Profile photo. Your profile photo is served from WorkOS's content-delivery network (CDN) and is fetched fresh each time it needs to be displayed. As a result, the WorkOS CDN may receive your device's IP address and a timestamp each time an avatar loads. Mapdesk does not store the photo — it is displayed from the CDN, not saved on the device or on Stiple's servers.

5.3 How Tokens Are Stored and Protected

The access and refresh tokens let you stay signed in. Mapdesk stores them using each platform's hardware-backed secure storage:

• iOS. Tokens are stored in the iOS Keychain with the afterFirstUnlockThisDeviceOnly protection class, and iCloud Keychain sync is turned OFF — so the tokens never leave the device.
• Android. Tokens are encrypted with AES-256 in GCM mode; the encryption key is held in the Android Keystore (hardware-backed where the device supports it), and the resulting ciphertext is kept in the App's private storage.

Tokens are transmitted only over HTTPS/TLS, and they are deleted on sign-out.

To achieve survey-grade accuracy, Mapdesk uses real-time correction data. These corrections travel over a secure WebSocket (wss://, encrypted with TLS) directly from your device to the NTRIP service you configure — for example, the Stiple NTRIP Caster. Mapdesk then forwards those corrections to your connected GNSS receiver over Bluetooth (see Section 3), and the receiver returns the corrected position.

You choose which NTRIP service to use. The correction stream is a technical data exchange that carries the information the service needs to deliver corrections; it is not used to track you or to build a profile.

Mapdesk is server-streamed by design. As you work, your field data is streamed to Stiple's servers in real time. The App is not intended to be a permanent archive of your projects on the device.

7.1 Why There Is a Local Cache

Field work happens in places with unreliable connectivity. To make sure you never lose in-progress work, Mapdesk keeps a local cache of survey data on the device. The cache provides offline resilience — it protects your work against a loss of network, an app crash, or your battery dying mid-survey. Once an upload is confirmed, the cached data is reconciled and cleared.

7.2 How the Local Cache Is Protected — and What You Should Do

The local cache is not separately encrypted by Mapdesk at the application layer. Instead, it relies on your device's operating-system at-rest encryption — iOS Data Protection on iPhone/iPad, and file-based encryption on Android — which protects the data on the device while the device is locked.

No analytics SDK. Mapdesk does not contain an embedded product-analytics SDK and sends no analytics events. (Stiple runs no product analytics anywhere, on the web or in the App.)

No crash-reporting or diagnostics SDK. The App contains no crash-reporting or diagnostics SDK. When the App encounters an error or stops unexpectedly, no automated report is created or sent. If you choose to tell us about a problem yourself — for example, by emailing support — that is something you initiate, not something the App collects. This applies to Mapdesk Mobile only: Mapdesk at mapdesk.app sends error reports to Sentry, as described in Section 14 and the umbrella Stiple Privacy Policy.

No advertising or tracking SDK. Mapdesk does not build advertising or marketing profiles and does not track you across other apps or websites.

8.1 How the Map Renders — No Map-Vendor Telemetry

Mapdesk renders its maps with MapLibre and PMTiles, drawing from self-hosted basemaps. There is no Mapbox or Google Maps backend behind the map, and therefore no map-vendor telemetry: displaying the map does not send your position or activity to a third-party mapping service.

8.2 A Note on Google Play Services Location (Android Only)

On Android, Google Play Services Location is bundled as a system component that Mapdesk uses as an operating-system wrapper for location. It runs on-device. Mapdesk transmits nothing to Google through it — it is used only as an OS-level location interface, not as a data-sharing channel.

Mapdesk sends no push notifications and no marketing notifications.

The launch build shows no notifications at all, on either platform. If a future build adds one — for example, a survey-in-progress notification on Android — this Annex will be updated together with it.

Cross-border transfers for Mapdesk Mobile. Two flows involve U.S. companies: your sign-in, which is handled by WorkOS in the United States (including the profile-photo CDN described in Section 5), and the hosting of the service the App talks to by Vercel, whose functions run in Montreal but which is a U.S. company, so we treat it as a cross-border transfer. Your survey, project, and file data are not sent to WorkOS. Mapdesk Mobile sends no error reports and no feedback to Sentry or Linear.

Mapdesk Mobile involves no payment processing and no Stripe. Mapdesk Mobile is free, never sells anything, and contains no in-app purchases, so there is no payment processor in the App's data flow at all. Paid Mapdesk plans are bought and managed on the web only, where Stripe processes the payment (see Section 14).

Because some processing occurs with U.S. companies, that information may be subject to U.S. law, including laws such as the CLOUD Act. We have deliberately kept your substantive field data in Canada to minimize this exposure. See the umbrella Stiple Privacy Policy and the Sub-Processor List for the full cross-border picture.

You can delete your Stiple account and associated data at any time. Sign in to Mapdesk at mapdesk.app (or any other Stiple web app), open your account settings, and go to Profile → Delete account. The "Delete Account" option inside Mapdesk Mobile takes you to this same deletion flow.

If you pay for a plan, you must cancel it first; if you own an organization that is still paid for, you must delete the organization first. A delete request locks your account at once. Your account and your data — including the projects you own, survey data, files, and images — are then deleted together: for a Free account, after 14 days; for an account whose cancelled plan is still running, when that plan ends, but never sooner than 14 days. You can undo the request by signing back in before then. After deletion, this cannot be undone, and no refund is given for any unused time.

What deletion does for Mapdesk Mobile. Completing deletion purges your server-side data — including the field data stored on Backblaze B2 in Toronto — and clears the local cache on your device. For security, fraud-prevention, audit, and legal-compliance purposes, Stiple retains a limited set of account and access logs after deletion (for example, sign-in records and a record of which projects were downloaded and when); these logs do not include your project, survey, or file content, are retained for 24 months, and are then deleted unless a longer period is required by law. For the broader timelines, exceptions, and backup-rotation windows that apply to deletion, see the umbrella Stiple Privacy Policy.

Mapdesk requests only the permissions it needs to function. Each is requested through your device's standard prompt and can be changed or revoked in your device settings. The launch build requests no camera, no microphone, no contacts, no photos-library, and no calendar permission.

• Location (precise) — iOS & Android. Foreground + background, only during an active survey. Used to record precise survey positions; continues through screen-lock / app-switch during a survey (Section 2). Never collected when no survey is active.
• Bluetooth — iOS & Android. Foreground + background, while connected during a survey. Used to connect to an external GNSS receiver and exchange RTCM corrections / position data (Section 3). Not used to scan for other devices.
• Camera — not in the launch build. Camera-based geodetic imaging is an upcoming feature; the current build does not request camera permission (Section 4).
• Internet / network — iOS & Android. As needed for signing in, streaming survey data to your Stiple account, and receiving NTRIP corrections.
• NFC — Android only. Used solely to read a Stiple tap-to-connect tag when you tap your phone on one: the tag carries a stiple.ca link that tells the App which base or rover to connect to. Mapdesk does not write tags and does not use NFC for anything else. On iOS, these tags are read by the operating system itself, so the App requests no NFC permission there.

Not requested: camera (launch build), microphone, contacts, photos library, calendar. If a feature requiring a new permission ships later, this Annex and the App's declared permissions will be updated together.

Our current sub-processors and their data locations are listed at stiple.ca/legal/sub-processors. Of those, Mapdesk Mobile touches only:

• WorkOS — authentication and the profile-photo CDN (United States; see Sections 5 and 10).
• Backblaze B2 — storage of your survey data and files in Toronto, Canada.
• Vercel — hosting of the service the App talks to (Montreal, Canada; a U.S. company — see Section 10).

On Android, the bundled Google Play Services Location system component is also present as an on-device OS wrapper (Section 8.2); it is not a data-transmitting sub-processor. Mapdesk Mobile involves no Stripe, no payment processor, no Sentry, and no Linear. Mapdesk on the web additionally uses Stripe, Sentry, and Linear, as described in Section 14.

Mapdesk at mapdesk.app is the web app where you work with Mapdesk projects and files, maps, georeferencing, drafting, and point clouds in the 3D viewer, and where Mapdesk plans and organizations are managed. It uses the same Stiple account and the same projects as Mapdesk Mobile.

• Sign-in. You sign in through a WorkOS-hosted page in your browser. Mapdesk keeps its own sign-in session on mapdesk.app, separate from Caster. Stiple does not store your password.
• Your data. Your Mapdesk projects, maps, and files are stored on the same Canadian infrastructure as your field data (Section 10). The web app runs in Vercel's Montreal region.
• Plans and billing. Paid Mapdesk plans and organization seats are bought and managed here, on the web only. Payments are processed by Stripe; Stiple does not store your full payment-card number.
• Error reports. Unlike Mapdesk Mobile, Mapdesk on the web sends error reports to Sentry, with a masked replay only when an error happens, exactly as described in the umbrella Stiple Privacy Policy (Section 2.4). Reports identify you only by a random id; IP addresses are not stored, and the map is never recorded.
• Feedback. If you use Send feedback in the account menu, what you send is delivered to Linear, as described in the umbrella Stiple Privacy Policy (Section 2.5).
• Cookies, no analytics. The web app uses the strictly necessary and functional cookies described in the Cookie Policy (stiple.ca/legal/cookies). It runs no analytics and no advertising or tracking technology.

User content, not personal information. Geospatial data you upload to Mapdesk — including point clouds, laser scans, survey data, drone imagery, and related files — is treated as user content. While we protect it with the same rigour as personal information, it is governed by the data-ownership provisions of our Terms of Service rather than as personal information under privacy legislation, unless a specific dataset contains identifiable personal information.

Purpose-limited processing. Stiple processes your geospatial data solely to provide the Services you have requested — hosting, rendering, format conversion, QA/QC tool execution, and any other platform feature you choose to use. We do not process your geospatial data for any other purpose.

No mining, no analysis, no sharing. Stiple does not:

• Mine, analyze, or extract insights from the content of your geospatial datasets for our own purposes;
• Sell, license, or share your geospatial data with any third party;
• Use your geospatial data to train artificial-intelligence or machine-learning models;
• Combine your geospatial data with data from other users;
• Access the content of your geospatial data except as necessary to provide the Services or as directed by you.

Ownership. You retain all ownership rights in your geospatial data at all times. Uploading data to Mapdesk does not transfer any intellectual-property rights to Stiple. You may export or delete your data in accordance with the retention provisions of the umbrella Stiple Privacy Policy (see Section 17).

Data integrity. Mapdesk preserves the accuracy of your geospatial data at the precision at which it was ingested. We do not modify, downsample, or alter the source data. What you upload is what you get back.

5.1 Point Cloud Anonymization

Geospatial data — particularly point clouds captured through indoor scanning (for example, terrestrial laser scanners or mobile mapping systems) — may contain identifiable features such as human faces, licence plates, or signage displaying personal information. Stiple does not automatically anonymize, blur, or redact point cloud data. Users are responsible for reviewing and, where appropriate, anonymizing or redacting identifiable content from their datasets before uploading them to the Platform. If Stiple introduces automated anonymization tools in the future, their availability, capabilities, and limitations will be documented in this section.

5.2 Indoor Scan Consent

Users who capture indoor scan data of occupied or privately-owned spaces — including offices, residential properties, retail locations, and industrial facilities — are responsible for obtaining appropriate consent from building owners, occupants, and other affected parties before uploading that data to the Platform. This may include consent under applicable privacy legislation, property-access agreements, or contractual obligations to the site owner. Stiple does not verify whether such consent has been obtained and assumes no liability for data uploaded without proper authorization.

5.3 Point Cloud & Project Retention

Geospatial datasets, including point clouds, follow the same retention schedule as other user content: data is retained while your account is active, plus a ninety (90) day export window following account termination, after which it may be permanently deleted from production systems. You may request deletion of a specific dataset at any time by contacting support@stiple.ca; deletion requests are processed within thirty (30) days. Because backups rotate, residual copies of deleted data may persist in backups for up to ninety (90) days. The full retention and deletion schedule is set out in the umbrella Stiple Privacy Policy (Data Retention) and the Terms of Service. For full-account deletion, see Section 11.

Mapdesk lets you upload files, organize them into projects, and share projects or datasets with collaborators.

• Uploads. Files you upload are stored as described in Section 10 (Backblaze B2 Toronto; AWS ca-central-1 compute).
• Sharing you control. When you share a project or dataset with a collaborator, you direct that sharing. Stiple facilitates the access you grant and does not share your content with third parties on its own initiative.
• Collaborators. A collaborator you invite will be able to access the content you share with them according to the role and permissions you assign within the Platform. If you administer an organization account, you are responsible for managing collaborator access, including removing access when it is no longer appropriate.
• Activity records. To operate sharing and collaboration securely, Stiple records limited activity (for example, who accessed or modified a shared item, and when) for account-security and audit purposes.

For the topics common to all Stiple products — your privacy rights (under PIPEDA and Quebec Law 25), data retention, breach notification, children's privacy, and how to contact our Privacy Officer or file a complaint — please see the Stiple Privacy Policy at stiple.ca/legal/privacy. Those sections apply to your use of Mapdesk and Mapdesk Mobile and are not repeated here. Where this Annex and the umbrella differ on a Mapdesk-specific matter, this Annex governs.