App Privacy

The organisation you work for — your employer, or the company whose sites you record — is the data controller for the information you enter in Arrol Field. Arrol Ltd is the data processor: we hold and handle that information on your organisation's instructions.

Everything Arrol Field stores is something you create in the course of your work. It originates the following records:

• Sites — the places and jobs you work on, with their boundaries.
• Waypoints and tracks — points you drop and the routes you walk, with their positions.
• Voice notes — recorded and transcribed to text (see “On your phone only” below).
• Species captures — a photo of a plant, fungus or insect, with where it was seen.
• Site reports and field reports — the record of a visit, including who was on site (see “Other people's names” below).
• Tariff surveys and trees — mensuration: diameters, heights and volumes.
• Log stacks (logscan) — measured stacked timber.
• Sketches, ink notes, and annotations on photos and documents — the marks you draw.

When you delete any of these, it is marked as deleted — records are never hard-deleted from under you.

• The Arrol database (Supabase). Your records sync to a managed PostgreSQL database, and you sign in with an email address and password (Supabase Auth). Access is enforced per organisation, in the database.
• The Arrol portal at app.arrol.cloud, which the app talks to over an authenticated connection using your sign-in token.
• Amazon Web Services (S3), directly. Photos, voice recordings, species images, sketches and imported PDFs are uploaded straight from your phone to storage, using a one-time link the portal issues. The storage key includes your user id (of the form app-media/{your-id}/…) — worth stating plainly rather than hiding. Your phone never holds an AWS credential and never sees a bucket name, and it can only ever write under your own prefix.
• OpenStreetMap — the map tiles you see are fetched from openstreetmap.org. This is the only genuine third party the app contacts, and it receives only what any request for a map tile does.

Arrol Field records precise location to place your waypoints, tracks, photos and sightings. It uses location in the background in exactly three situations, and no others:

• while you are recording a track;
• while a lone-working session is active — your position is sent roughly every five minutes so someone can find you if needed;
• when a lone-worker event happens — an SOS, a check-in, a man-down or a stand-down.

There is no geofence, no “significant location change” monitor, and nothing that wakes the app silently. When background location is running, you can see it: on Android a persistent notification is shown the whole time, and on iOS the blue status bar appears. Your position is never shared without that being visible to you.

• Speech recognition runs on your device. When you dictate a voice note, the audio is transcribed on the phone itself — it is never sent to Apple, Google or anyone else for recognition. Only the resulting text is uploaded, and it is tagged so a machine transcription can be told apart from something you typed.
• Your PIN never leaves the device. If you set an app PIN, it is stored only on your phone (in the iOS Keychain / Android Keystore) as a one-way value — PBKDF2-HMAC-SHA256 with 100,000 iterations and a random salt. No fingerprint or face data is held by the app; the device biometric check only ever returns a yes or a no.

Ask Arrol (the in-app assistant) sends your question, along with the recent conversation — up to the last eight exchanges — so it can answer in context. Anything typed within those recent exchanges travels again with each new question; anything older does not.

Species identification sends the single photograph you are identifying together with its latitude and longitude to a specialist identification service (Plant.id, mushroom.id or insect.id, operated by Kindwise), which returns a suggested name. Only that photo and position are sent, and only for that identification; the suggestion and photo are then stored with your record as described above.

This is the part we want to be straight about. When you write a site report, the app can record the names of other people connected with the work — a manager, a contractor, a site safety coordinator, a client, and how many people were on site. A field report records who signed it. Those people are not Arrol users and may never have been told that a record naming them is kept.

We hold this because it is part of an honest health-and-safety record of a site visit. It is kept as such — for at least three years — and it is visible only within your organisation. There is no free-text incident or accident log in the app: a site report's incident, accident and near-miss fields are simple yes/no markers, not a place to write a narrative about a named person.

If you are named in an Arrol Field record and want to know what is held, or to ask about it, contact enquiries@arrol.uk. Because your organisation is the data controller, we may pass your request to it.

Arrol Field contains no crash reporting, no analytics, no advertising, and no push-notification tokens. It builds no advertising profile, reads no advertising identifier, and does not track you across apps or websites. This was verified against the app's full dependency list (196 packages) and its Android manifest — not merely intended.

We keep your data while your organisation's account is active, so your history stays intact; when you delete an item it is marked deleted and removed from your views immediately. Health-and-safety records — including site reports — are kept for at least three years. You can ask us to delete your data at any time, and we will do so except where a record must be retained.

Under UK data protection law you have the right to:

• ask for a copy of the personal data held about you (access);
• have inaccurate data corrected (rectification);
• ask for your data to be deleted (erasure);
• ask to restrict or object to how it is used;
• ask for your data in a portable form (portability).

To exercise any of these, email enquiries@arrol.uk. Your organisation is the data controller, so we may pass your request to it or ask you to raise it there. If you are unhappy with how your data is handled you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Arrol Field is a professional tool and is not directed at children.

If we change how the app handles your data we will update this page and the date at the top.

Questions about this policy or your data: enquiries@arrol.uk.