gOGig: GPS Map Camera

gOGig: GPS Map Camera is a work app for field executors. You pick up a branding campaign, go to the site, capture photo or video proof that you were there, and submit it. Everything the app collects exists to make that proof verifiable and to pay you for it. There is no advertising in this app and no advertising identifier. The app does measure how it is used (see “App usage measurement” in section 1), but that measurement is about the app, not about you, and it is never used to profile or advertise to you.

The app requests precise location because a task is a claim that you were at a particular place. The coordinate is used to check the task’s geofence and is embedded in the photo or video you capture.

The app does not request background location. It cannot read your location when it is closed or in the background. Android’s background location permission is not declared in the app at all. Location is read only while you have a capture or task screen open.

Two things turn a coordinate into something readable, and both are worth naming. The app asks Android’s own geocoding service to turn your coordinate into an area name (“Bank More, Dhanbad”) for the line shown on the camera screen; on most handsets that service is provided by Google. And when a task shows you a map of a geofence you are outside, the map’s tiles are fetched from OpenStreetMap’s public tile servers, which necessarily see your device’s IP address and which part of the world you are looking at. Neither receives your name, your phone number or your captures.

The app opens the camera to capture task proof. It does not browse, read, or upload your photo gallery, and it does not declare the Android media-read permissions that would let it. Only files you capture inside the app are uploaded.

Some campaigns ask the app to read a number off the photo for you, such as a vehicle registration plate or a serial code on a board, instead of making you type it. When that happens the photo, with the coordinate and the job type, is sent to our detection service at detection.gogig.in, which returns the text it read. It is an assist and it can be overruled: if the read is wrong or the service cannot be reached, you type the value in and the task submits exactly as it would have.

Sign-in is restricted to a number your handset’s own SIM answers to, so that an account cannot be signed into from somebody else’s phone. To offer you that number the app reads the numbers on the SIMs in the device, which is what the phone permission is for. That read stays on the device: nothing about your SIMs, your slots or your carrier is sent to us or stored. The only number that leaves the phone is the one you pick and sign in with.

Auto-filling the OTP uses Google Play Services’ SMS User Consent API. Play Services watches for a single incoming message containing a code and shows you a prompt; only if you tap it does the app see that one message. The app does not hold any SMS permission and cannot read your messages.

The counts in the table are sent through Google Analytics for Firebase. The event itself is one line: a campaign id, the task’s id on our server, the number of shots you took and the number you retook. It is sent once, after the task has been accepted. It carries no name, phone number, executor ID, GPS coordinate, or image.

Alongside it, Firebase records what it records for every app that uses it: that the app was opened, updated or removed, how long a session lasted, and the device model, Android version, app version and language it happened on. It also derives an approximate region, at country level, from the IP address the request arrives on. That is not the GPS location the app reads for a task; the coordinate on a capture is never sent to Firebase.

To join those records together Firebase generates an app-instance ID: a random number belonging to this installation of this app. It is not your advertising ID, not your Android ID, and not tied to your name or your phone number. The app switches the first two off by name. It is reset if you clear the app’s data or reinstall it, and it cannot be switched off while the measurement runs at all. This policy says so rather than claiming a measurement that leaves no trace.

None of it is used to advertise to you, to build an audience, or to follow you into another app. Ad-personalisation signals are switched off at the same place. It answers one question: which campaigns are hard to photograph, so the instructions and the camera can be fixed.

• No advertising ID, and no ads anywhere in the app.
• No attribution or cross-app tracking SDKs, and nothing that follows you between apps or websites.
• No contacts, SMS, or call logs. Those permissions are not declared.
• No background location.
• No access to your photo gallery or files outside the app.
• No list of other apps installed on your phone.
• No push-messaging service. Every notification the app shows is generated on your own device by the upload worker.

• To sign you in and keep your session valid.
• To show you the campaigns and tasks assigned to you.
• To verify that a submitted task was captured at the right place and time.
• To process payment for verified work.
• To notify you about your uploads and your work.
• To investigate a problem you report, to fix crashes, and to detect fraudulent or duplicated submissions.
• To measure how well the app itself works, for example how many attempts a campaign’s photo takes, so it can be improved.

We do not sell, rent, or trade your personal information. We disclose it only in these cases:

• Service providers who host and operate the platform on our behalf (hosting, storage, SMS delivery for the OTP), bound to use it only for that purpose.
• The client whose campaign you worked on, where the task proof itself, meaning the capture with its location and time, is the deliverable they commissioned. This is the work product, not your account details.
• When the law requires it, or to establish, exercise, or defend a legal claim, including investigating fraud.

When you send a problem report from the app’s menu, it carries the app’s recent log lines together with the device and queue facts listed in section 1, so that support can act on it without a phone call. Anything that looks like a login token or an inline image is stripped out of those logs before they are sent.

• Every request the app makes is HTTPS. Plain-text traffic is disabled at the app level, so an unencrypted request fails rather than silently going out in the clear. The app trusts only the certificate authorities that ship with Android, not ones added to the device later, so a network that tries to sit in the middle of the connection is refused rather than trusted.
• Captures waiting in the offline queue are encrypted on the device with AES-GCM using a key held in the Android Keystore, hardware-backed where the phone supports it. Your session tokens are stored the same way.
• Android’s automatic cloud backup is turned off for this app, so queued captures and session tokens never leave the device through it.
• Access to submitted data on our side is limited to staff who need it to run campaigns and payments.

• On your phone: a capture stays on the device until it has been uploaded and the server has confirmed it, and then for as long as it is among the twenty most recent tasks of its campaign; past that the app releases the file to free up storage and the task still opens, fetched from the server. Videos are never released this way. Nothing that has not reached the server is ever deleted automatically. An unsent capture is the only copy there is, and the app treats it that way.
• On our servers: task submissions and their proof are kept for as long as the campaign and its payment and audit records require, and afterwards for as long as the law obliges us to keep financial records.
• Problem reports and crash reports: kept while the issue is open and for a reasonable period afterwards for support history.
• The app usage measurement: held by Google Analytics for the retention period configured on our Analytics property, which cannot exceed the fourteen months Google Analytics allows for app event data. After that only aggregate totals remain.

You can withdraw the camera, location or phone permission at any time in Android Settings. The app will keep working, but tasks that need a verified place or a capture cannot be completed without them, because that verification is what the task is.

You can also ask us to:

• tell you what personal data of yours we hold;
• correct anything inaccurate;
• delete your account and its data (see below);
• have a grievance about your data addressed.

gOGig: GPS Map Camera is a work app for adults engaged as field executors. It is not directed at children and we do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.

If this policy changes, the updated version is posted at this address with a new “last updated” date. Material changes to what we collect or why will be communicated in the app before they take effect.

Questions, requests, or grievances about your data:

Email: support@gogig.in
Website: www.gogig.in