Privacy and Your Data

Field Service Companion is built with privacy as a core principle. Your contacts, visit notes, and personal information are protected by design.

Field Service Companion is a personal ministry tool for individual publishers. It is an independent product — not affiliated with, endorsed by, or an official product of Jehovah's Witnesses, jw.org, or the Watch Tower Bible and Tract Society of Pennsylvania.

Your Data Stays on Your Device

All of your contact records, visit notes, and personal information are stored locally on your device. In the free plan, no data is sent to any server. The app works fully offline after the initial sign-in.

Encryption

Your data is encrypted on your device, which means it is unreadable without the app. Backups are also encrypted and can only be unlocked with your recovery phrase.

There is no "forgot password" recovery path for encrypted content. This is a deliberate choice: it means that no one — not even us — can read your data.

What We Do Not Collect

Field Service Companion does not collect, store, or transmit:

• Your contact names, addresses, phone numbers, or emails.
• Your visit notes or any text you enter.
• Your photos or attachments.
• Your location history.
• Any data that identifies the people you visit.

Reminders and Notifications

When you set a follow-up reminder, the notification fires on your device only. Reminders are not sent through Apple's push service or Google's push service — they are scheduled locally on your phone.

The notification text shows only the contact's name and a short prompt ("Time to continue the conversation — Maria"). Your visit notes are never included in the notification, so they cannot appear on your lock screen, in a paired Apple Watch or Wear OS device, or in any other place that mirrors notifications. Notes stay inside the app, where they require your phone's unlock to view.

Sign-In

When you sign in with Apple ID or Google, we receive only the identity token needed to authenticate you — your name and email address. This is used solely to identify your account. At sign-in the app also records your device's language setting (for example, English or Spanish) with your account, so that emails we send you can one day arrive in your language. We do not access your Apple or Google contacts, calendar, or any other data.

Debug Reports

Debug reports contain only technical information about how the app has been running. They never include personal content. There are two ways one can be sent:

• You initiate it — Settings → Share debug report. You choose where the file goes.
• After a crash, automatically — by default, if the app crashes, the next launch sends a sanitised report so we can see and fix the problem quickly. You can turn this off at any time in Settings → "Send diagnostic data". See What Is a Debug Report for the full picture.

Automatic Local Recovery

If your phone's storage encounters a problem and Field Service Companion's local data is damaged, the app keeps a small encrypted snapshot of the database from each recent launch and uses it to recover automatically. The snapshot is stored on your device only — never on a server. This means recovery happens entirely without involving us, and your data stays under your control even when something goes wrong.

Diagnostic Data and Analytics

Field Service Companion collects anonymous diagnostic and usage data to help us improve the app. This includes information such as app version, platform, and how features are used. It does not include any personal data or the content of your records.

Diagnostic data does not include your location. The app explicitly turns off the diagnostics service's ability to estimate your location from your internet connection, and your IP address is not stored with diagnostic events.

You can turn this off at any time in Settings. When turned off, only user-initiated debug reports (which you choose to send) will leave your device.

When diagnostic data is on and you are signed in, the diagnostics service (PostHog) also receives your sign-in name and email address along with each diagnostic event. This is the same name and email you provided to Apple or Google at sign-in — it lets us correlate a crash report to your account so we can follow up if needed. None of your contacts, visit notes, or addresses ever reach the diagnostics service.

Map View and Geocoding

When you use the Map view or the "Nearest" lens on the dashboard, your phone uses your operating system's mapping service (Apple Maps on iPhone, Google Maps on Android) to:

• Display map tiles — the visual map background. This requires sending the area you are looking at to Apple/Google.
• Convert addresses to map coordinates ("geocoding"). When the operating system has not seen a particular address before, it asks Apple/Google's geocoding service to look it up. The address you typed is sent to Apple or Google for that lookup.
• Get your current location — only with your permission, and only while you are using the app.

This means contact addresses you have entered may be sent to Apple or Google as part of using the map. Apple and Google's privacy policies govern what they do with that data. Field Service Companion does not store, log, or transmit those addresses to any FSC server — there is no FSC server in the current version of the app.

If this is a concern for you, you can avoid it by not entering addresses for sensitive contacts, or by skipping the Map view entirely.

Third-Party Services

Field Service Companion uses the following third-party services. Each receives only the data described above:

• Apple Maps / Google Maps — map tiles and your current location when you use the Map view or "Nearest" lens.
• Apple / Google geocoding — contact addresses you enter, when they are looked up to display on the map.
• Apple / Google sign-in — your authentication. We never see your password.
• PostHog (diagnostics) — only when you have diagnostic data turned on. Receives crash reports, app-usage events, your sign-in name and email, and a per-installation identifier. Never receives contact, visit, or note content, and never stores your location or IP address — location estimation from your internet connection is turned off.
• Email delivery — when you create an account, your name and email address are shared with an email-delivery service so we can send you a welcome note and occasional updates about the app. You can unsubscribe at any time. It never receives your contact, visit, or note content.

Your Rights

You own your data. You can export it at any time through the Backup feature.

To delete your data, go to Settings → Delete account. This permanently deletes everything on your device — contacts, visit history, reminders, local backup snapshots, and your device encryption key — and signs you out. Before anything is deleted, the app offers to create an encrypted backup so you keep the option to restore later. Without a backup file and its recovery phrase, deletion cannot be undone.

Deleting your account removes your sign-in details from the device. If you would also like the name and email associated with your sign-in removed from our records, contact support@returnvisits.org.

You can also remove the app's data by uninstalling it, but Delete account is the more thorough path — it also signs you out and clears the encryption key that your device would otherwise keep for restoring after a reinstall.

Need More Help?

If you have questions about how your data is handled, please contact us at support@returnvisits.org.