Plotero Privacy Policy

Effective date: 2026-10-15
App: Plotero (Android, iPhone, and the web version)
Operator: Hyper Koala Studio
Contact: privacy@hyperkoalastudio.com
Terms of service: rom3odelta.github.io/plotero/terms/

What this app is

Plotero draws the shape of a land lot from the bearings and distances written in a Philippine land title's technical description. You photograph the title and Plotero reads it, or you type the description in yourself. The app plots the boundary, closes it, reports the area, and can put the shape on a map. It is a drawing and checking tool for landowners and brokers. It is not a survey instrument, and it does not produce an official survey document.

In short

Plotero keeps almost nothing about you. Everything you type and everything Plotero draws stays on your phone, unless you choose to back it up or to share it, and a backup goes to storage you already own. The one record on our side is the count of title reads you have left, filed under a number rather than a name. Your account below says exactly what is in it and how long it stays.

A few things do leave your phone, and each one only when you ask for it: reading a title, finding a printed line on the page, naming a document off its heading, putting satellite imagery under a drawing, searching for a place on the map, and sharing a portfolio with somebody. What Plotero sends explains exactly what goes out and what comes back.

There is an optional sign-in. You never have to use it. Every part of Plotero works signed out.

What Plotero stores

When you save a lot, Plotero writes it to your device's own app storage. A saved lot contains:

From version 0.27, if you send somebody a map link, the words you chose to put on that link are saved with the lot so the next link says the same thing. They are your own words, so they are kept and backed up like a folder name is. Leave that box blank and nothing is stored.

From version 0.21 you can also sort saved lots into folders. The folder's name is whatever you typed. If you name one after a family, that name is stored on your phone and goes into your backup like anything else here. A folder holds no other information, and a folder name is never printed on an exported plan.

From version 0.29 you can put several lots into one drawing, called a plot. Its name works the same way: whatever you typed, stored on your phone, in your backup. The only other thing a plot holds is where you dragged each lot: a distance north and east in metres, measured against the other lots on the same sheet. That is not a location on Earth and does not turn into one. Where your land actually sits comes from the map pin described further down, and from nowhere else.

Up to version 0.19 the second half of that list was not saved. Those details were shown on screen and thrown away when you closed the lot, which meant photographing the same title twice to get a name back. From version 0.20 they are kept with the lot, so a lot in your library is a record of the paper rather than only of its shape. They are kept on your phone, and they are in your backup (see below).

They are still not printed on the PDF you export. A plan you send to somebody else carries the drawing, the measurements and the name you typed, and nothing that was printed on the title.

From version 0.29 a lot can be one of several on a drawing. If it is, the sheet also carries the other lots as outlines, each one's name, and a line per lot saying how it got where it is, plus the drawing's name, if you gave it one. Those are all names you typed. Nothing off the title goes on it.

You can read and correct all of it on the Title details sheet, and deleting the lot deletes it.

Portfolios, buyers and deals. A portfolio is a folder for one property: its lot, the files you attach (photos, videos, documents, scanned pages) and the notes you type. A buyer is a name, with the phone number or email you chose to type beside it. A deal joins a buyer to a property and keeps the stage it is at, the checks you have ticked and the notes you wrote. All of it is on your phone, all of it goes into your Drive backup if you sign in, and none of it is sent to us. Buyers and deals never go into a portfolio you share with somebody else; Sharing a portfolio below says what does.

From version 0.99.26 a deal's working step and its checklist are kept on this phone only. They are not in the Drive backup yet, so a new phone starts them blank. From version 0.99.29 the deal's step and its checks are in the Drive backup too.

Your profile. Your name, nickname, the numbers and emails you type in Your profile, the chat apps you allow and your role (broker, agent, landowner, buyer or other) are kept on your phone. If you sign in, they also go into your Drive backup, so a new phone gets them back. They are never sent to us. Your role only changes wording in the app and is never in anything you share. Your name and the contacts you tick for a buyer travel only in a share you send.

Camera, photos and microphone. Plotero uses the camera only while you take a picture or a video in the app, and the microphone only for a site video's sound when you turn sound on. Picking from your gallery opens your phone's own picker, so Plotero gets the files you pick and no others. Plotero never reads your photo library. On an iPhone, saving a lot image asks once for permission to add photos, which lets Plotero put the picture in your library and nothing more.

Your own reading key. If you paste your own Google AI key into Plotero, it is kept on this phone, in the app's own storage, and it is not in your backup. It is sent inside each read it pays for, and nowhere else. See What Plotero sends.

Backing up

Plotero offers two ways to keep a copy of your saved lots. Both are optional, and neither sends anything to us.

To a file. Plotero writes your saved lots to a .json file and hands it to you. Where it goes after that is entirely your business. This needs no account and works offline.

To your own Google Drive. If you sign in with Google, Plotero keeps your saved lots, drawings, portfolios, buyers and deals in sync with your Drive, so every phone signed into the same account holds the same library. It asks for one permission, drive.appdata, which gives an app a private folder of its own inside your Drive and access to nothing else. Plotero cannot see, list or touch any other file you keep there. That folder is hidden from the normal Drive view; you can inspect or remove it from your Google account's settings for connected apps.

What goes into that copy is exactly what is on your phone: everything listed under What Plotero stores, including the title details, the registered owner's name, your buyers, and your folder and plot names. From version 0.20 that is a real change: before it, a backup held only geometry and nicknames. If you would rather those details never left the phone, clear them on the Title details sheet, or do not sign in and use file backup instead. The photograph you scan a title from is never uploaded.

From version 0.82.0 the files inside your portfolios go to that folder too: photos, videos (including drone footage), documents and scanned pages you attached to a portfolio or a deal. Photos and videos can carry where they were taken, a phone's GPS position or a drone's recorded flight path, and that travels with them. If you would rather a file stayed on the phone, do not attach it to a portfolio, or do not sign in.

When you sign in, the app reads the email address and name on the account so it can show you which account it is backing up to. Plotero stores no access token: it asks Android for a short-lived one at the moment it writes to Drive, and holds nothing afterwards. On an iPhone, Google's own sign-in kit keeps the sign-in in the iPhone's keychain, as it does in every app that uses it, and Plotero asks it for a short-lived token the same way.

From version 0.77.2, signing in also makes that Google account your Plotero account, so your scan credits and free allowance follow you to a reinstall or a new phone, and a different email is a different account. Your account says what that record holds.

Google stores the backup, so Google's own privacy policy covers it while it sits there. We never see it.

Syncing merges: a change or a deletion you make on one phone reaches the others the next time they sync, and nothing is removed that was not deleted on one of your devices. Restore is different and is only ever something you ask for: it makes this phone exactly what is in your Drive, deleting what is only on this phone. The app asks you to confirm it first.

Sign-in is available in the Android and iPhone apps. The web version has file backup only.

Your account

Reading a title costs us money: every page goes to Google's document reader, and Google charges for the read. So reads are counted, and the count of what you have left has to sit somewhere we can see it. That count is the heart of the one record Plotero keeps about you.

It is filed under a random number, not under your name. When the app starts it asks Google's sign-in service (Firebase Authentication) for an anonymous account number: 28 characters that mean nothing anywhere else, made for that installation of the app. No screen asks you anything. Signing in with Google later attaches that same number to your Google account, so your credits and your free allowance follow you to a reinstall or a new phone. The sign-in carries your email address inside the signed token, the way every Google sign-in does. Our server checks the signature, reads the account number out of it, and keeps the number. Google's sign-in service keeps your email with the account on its side.

Signing in with Apple is the iPhone's other way in, from version 1.0.11, and it works the same way. Plotero asks Apple for your email address and never for your name. Apple sends an account number of its own, which other developers' apps never see, and sends the email only on the first sign-in. If you chose Hide My Email, the address is a relay address from Apple that forwards to you, and we never learn the real one. Google's sign-in service keeps that email with the account, the same as for Google. Signing in with Apple does not reach your Drive: to back up, you connect a Google account as well, and it joins the same Plotero account.

Here is the whole record, item by item.

Nothing about your land is in it. No lot, no title number, no owner's name off a title, no location, no file, not even a count per document. The record can say a page was read. It cannot say what was on the page.

Buying credits or a plan. From the version that sells them, you pay through Google Play on Android or the App Store on an iPhone, under that store's own terms, and we never see your card, your bank or your e-wallet. Buying needs a signed-in account, so what you paid for survives a reinstall. The store is given a scrambled form of your account number with each purchase, so a purchase can only land on the account that made it. The app sends our server the store's reference for the purchase, our server checks it with the store, and the credits or the plan go into your record. If the store refunds a purchase, it tells our server, and what the refund covered is taken back out of your record. On an iPhone, Apple may also ask us how much of a purchase was used before it decides a refund. We answer only if you ticked the box in the Store that allows it, and the answer is whether the purchase was delivered and what share of it you used, nothing about your lots. Untick the box and we stop answering. Nothing can be bought in the versions before that one.

How long it is kept. For as long as the account exists. Delete the account and the record is erased within 30 days; in practice it goes the moment you press the button. Scans are never stored at all, on any route: the reader passes the page through and keeps nothing.

Deleting it. "Delete my Plotero account", on the same screen as the backup settings, empties the record: the balance, the dated lines, the Store record with your email, the device code, the shared portfolios you own (they close for everyone in them) and the ones you had joined. Before you confirm, it tells you what goes: the balance, because deleting takes the reads you paid for along with it, anything you unlocked, free or paid, and how many of your shared portfolios close. Deleting does not refund a purchase, and the store keeps its own record of what you bought. What you bought goes with the account: a new account made later, even with the same Google account or Apple ID, cannot restore it. Deleting the account does not touch the lots on your phone, and uninstalling the app does not by itself delete the account. An anonymous account that was never signed in is simply lost with the installation.

From version 1.0.11 deleting also removes the account from Google's sign-in service, with the email it kept there. If you signed in with Apple, the iPhone asks you to confirm with Apple first, and after the delete the app tells Apple to end Plotero's Sign in with Apple. If that last step fails the account is still deleted, and you can end it yourself under Settings › your name › Sign in with Apple.

Three marks stay behind, and it is fairer to say so than to claim a clean sweep. One says that this account's free allowance has been used, so the free reads cannot be claimed over and over by deleting and starting again. The second is the phone code, on Android, which keeps the count of free items that phone has already been given. The third, from version 1.0.11, is made the first time you sign in: it ties your Google or Apple sign-in to this account number, with the date, so signing up again with it does not bring the free allowance back. It is filed under Google's or Apple's own number for you, not your email. None of them holds a balance, a name or anything about a title.

We also keep a deletion receipt, so we can show that a deletion was asked for if anyone later says it wasn't. It holds the account number, when it was deleted, whether you did it in the app or we did it on request, how you were signed in (Google, Apple or anonymous), whether the app that asked was on Android, an iPhone or the web and which version it was, a scrambled form of the email that cannot be turned back into the address, how long before the delete you last signed in, and how many reads and unlocks went with the account. No name, no title, no lot, no file. Receipts are erased after two years.

If you cannot use the app, email the address under Contact from the Google account you signed in with, and we will delete the account for you within 30 days. If you signed in with Apple only, write from any address and tell us the email on the account. If you hid your email, that is the relay address your iPhone lists under Settings › your name › Sign in with Apple. We write to that address to confirm before we delete anything.

Sharing a portfolio

From the version that switches sharing on, you can give other people a view of one portfolio, or let them add to it. It is off in the versions before that one, and this section is here first because that is the rule under Changes.

The shared copy lives in your own Google Drive, not with us. Sharing asks Google for a second permission, drive.file, which lets Plotero make folders of its own in your Drive and touch nothing you did not make with it. Plotero creates one folder per shared portfolio, inside a folder it names "Plotero Workspace (App data)", and shares that one folder by link: Google Drive lets anyone who has its address read it, and nobody can find it by searching. The address is sealed inside the portfolio, so our server stores it but cannot read it, and only the people you let in get it. They read the folder without giving Plotero any permission on their own Google account. Somebody you allow to edit does give it: their additions go in a folder Plotero makes in their own Drive, shared the same way. The files in it are named by random codes, never by a name, a title number or an address. Everything inside is sealed with a key that only the people in the portfolio hold, so Google stores it and Google's own tools cannot read it. Your buyers, your deals and anything you marked private never go into that folder. Because the folder is in your Drive, Google shows the people you share with your Google name, email address and profile photo as its owner, and does the same for anybody you allow to edit. The app says so before you share.

What a person sees is what you chose to share, folder by folder, and their phone keeps its own copy of it once they have joined. Taking a folder back stops new copies. It cannot pull back what somebody already pulled down, and Drive keeps old versions of a file for a while in the usual way.

The invite link carries the key. A link you send holds the key to the folder in the part of the address after the #, which browsers never send to any server. Our server knows the link exists, as a scrambled code with the role it grants, for seven days, and it is spent the first time it is used. Anybody who holds the link within that week can ask to join, so send it to the person you mean.

What our server keeps for a shared portfolio. Google holds the files; our server holds who is in. For each shared portfolio that is the name you gave it, who owns it, who the members are and in what role, when each one joined, a public key each member's phone made so the others can tell their edits are really theirs, and a scrambled form of each member's email address, which lets you share with an email and lets the server match it without being able to read it back. Somebody asking to join sends their name and email address sealed so that only you, the owner, can open them, plus that scrambled form for the server. It also keeps the sealed address of each shared folder, which it cannot open. A request that is not answered in seven days is deleted. All of it is kept while the portfolio stays shared, and erased within 30 days of the portfolio closing or the owner's account being deleted; in practice it goes at once.

The join page. A link opened on a phone without Plotero, or on a computer, shows a page from our server offering to open the app. The page cannot send the key anywhere, and the server learns only that the page was fetched, which, like any web page, means an IP address.

Where you are

Three things in Plotero use your phone's location, and they do different things with it. Your phone asks for permission the first time you tap into one of them, and not before. Everything else (reading a title, drawing the lot, browsing the map, searching, placing it on the map by hand, exporting) works with location refused, and will keep working that way.

Walkaround shows where you are standing against a lot you have already placed. Your position draws the blue dot and works out how far you are from the boundary, and that is all it does. It is not saved with the lot, it is not put in your backup, and it is not sent anywhere. Close the screen and Plotero stops asking your phone where you are.

Placing a lot from a corner is the other one, and here your position is the thing you are asking to keep. You stand on a corner of the land, tell Plotero which corner it is, and that reading becomes where the lot sits on the map. So it is saved with the lot, exactly like a placement you make by hand, and it is in your backup if you make one. It still goes nowhere else: we have no copy of it.

Find properties near me, the target button on the Map tab, is the third. It reads your position once, marks which of your own properties are close to it, and moves the map. The reading is not saved with anything and is not in your backup; the next time you press the button it asks your phone again.

You can take the permission back at any time in Android's app settings, or in the iPhone's Settings under Plotero. Only those three things stop working, and a lot you already placed stays where you put it.

A property entrance is a point you choose by hand, not a reading from your phone. You drag the map until a pin sits on the gate or the road access, and Plotero keeps it so directions lead there instead of to the middle of the field. It is saved with the lot and it is in your backup if you make one, the same as a placement. It goes nowhere else, and you can remove it.

The map itself is drawn by Google's map kit, the same one many apps use. Moving it asks Google for the squares you are looking at, which says where you are looking, not where you are standing, and Google's own policy covers what their kit records. Searching for a place sends the words you typed to Android's own place finder, which on most phones is Google's, and gets a position back. On an iPhone the words go to Apple's place finder instead. It is not saved. A coordinate typed into the same box is read on the phone and sends nothing.

Making a satellite plan sends where the land is, because there is no other way to fetch a picture of it. It goes to Plotero's reader and on to the company that publishes the imagery, as a square of map and nothing else: no name, no title number, nothing saying whose land it is or who asked for it. See What Plotero sends.

What Plotero sends

Your saved lots are never sent to us, with or without an account. Nothing Plotero has drawn or stored on your phone leaves it on its own. A shared portfolio goes to your own Drive, as Sharing a portfolio says, and not to us.

Reading a title is the exception, and it happens only when you press "Smart Scan". That sends every page of the document you have open, one page at a time, to Plotero's reader, which passes each one to Google's document-reading service to pick out what is printed on it.

From version 1.0.11 the app asks once on each phone, before the first page goes, whether you agree to send pages to Google's AI. Say no and nothing is sent. You can change your answer in Advanced settings.

What comes back is what the title says about itself: the title number, the registered owner's name, the lot and block number, the plan number, the location, the area, the survey dates, the adjoining lots, the tie line and its monument, and the list of bearings and distances. The verbatim technical description, the long block of prose, is not part of an ordinary scan. Plotero's reader is told not to transcribe it, and refuses to pass it back even if it arrives.

There is one button that changes that. "Read the exact wording", on the Title details sheet, sends the pages a second time and asks for that paragraph word for word. It is off unless you press it, it is the only way that text reaches the app, and what comes back is saved with the lot like the rest of the details.

Plotero's reader keeps none of it either way: it reads the page, hands the answer back, and holds nothing. Nothing from a scan is stored on our side.

The page you send is not stored, not by us and not as a copy anywhere on our side. We count how many reads happened and how long they took, so we can tell when the reader is broken. That count holds nothing about you or about the document, not even a fingerprint of it. Google receives the image, and nothing that says who sent it.

Which Google service reads your page depends on how the read is paid for, and that is worth knowing before you press the button.

If you would rather no title left your phone at all, type the bearings in by hand. That draws the same lot and sends nothing.

Tapping a line to find it on the paper sends that page as well. On a lot read from a title, tapping a side highlights the row that describes it, and the only way to know where that row is printed is to let the reader look. Same reader, same rule: it answers and holds nothing. It happens once per page, and the answer is kept on your phone, so tapping the same row again sends nothing.

Naming a document by dragging a box over its heading sends the piece you boxed and only that piece, to read the words inside it. The heading comes back as the file's name. Nothing else on the page goes with it.

A satellite plan sends the patch of ground it is a picture of. The second sheet, the one with the land under the drawing, needs squares of imagery that cover your lot. Plotero asks its own reader for them and the reader fetches them from Esri, who publish the pictures. Asking for a square of the map says where that square is, and for this sheet that is where your land is. It carries nothing else with it, nothing is kept on our side, and Esri are handed a map coordinate the same way any map app hands them one.

If you never press any of those, no page and no location is ever sent. The app does check in with our server about your account when it starts, as Your account describes, and the rest of the app works with the phone in airplane mode.

The only other thing Plotero may send is a request for a small file asking "is there a newer version of the app?", and only in builds where that check is switched on. That request carries no information about you or your lots; like any request to a website it reveals your device's IP address and which version you are running, and nothing is stored about it.

Your phone's device id, for the free allowance. The free portfolios, properties and scan credits are counted per phone as well as per account, so that reinstalling or signing in with a second email does not start them over. To do that, the app sends Android's device id (the ANDROID_ID Android gives each app, which changes on a factory reset) along with its account requests only, never with a scan. On arrival it is scrambled with a secret key into a code that cannot be turned back into the id, and only that code is kept, with how many free items that phone has used and which account first used Plotero on it (that account gets the free allowance; any other account on the same phone gets a smaller one). Once per account the app also asks Google Play to confirm the phone is a real device and not an emulator; the answer says yes or no and nothing else about you. It is fraud prevention, it is not used for advertising, and it is not shared.

On an iPhone the app makes its own id the first time it runs and keeps it in the iPhone's keychain, on that iPhone only. It is not the advertising identifier, and it is not shared with other apps. It is sent and scrambled the same way as on Android. Before the free allowance counts it, the app asks Apple to confirm the request comes from the real Plotero app on a real iPhone; Apple's answer says yes or no and nothing else about you. It is fraud prevention, it is not used for advertising, and it is not shared.

Handing a property to somebody

Sending a map link puts the lot's location in a message you write to somebody else. Nothing about that reaches us; it is your phone's own share sheet handing the text to whichever app you pick, and where it goes after that is between you and them. Before it is sent you are shown the exact message and can change every word of it, which is there so a link can go out without the name you file the lot under. The link points at the middle of the lot and carries no title number, no owner name and nothing else off the paper.

Handing over a copy of a property can be done three ways, and none of them passes through us: a code the buyer's phone scans from yours, a direct phone-to-phone link over Wi-Fi with no network in between, and a web page for somebody who does not have Plotero. The copy carries what you ticked and nothing you left unticked; the seller's name is off unless you turn it on. The web page comes from our server, but the property itself travels in the part of the address after the #, which the browser never sends, so the server draws a page it cannot read. That page fetches its map squares through our server the way a satellite plan does, which says where the land is and nothing about who is looking. Like any web page it sees the reader's IP address, and nothing is stored about it.

Adverts

There is no advert in Plotero today, and nothing in the app will show you one. The Android app does carry Google's advertising kit, AdMob, because a later version will offer a short video to watch in exchange for a few free reads, and the kit has to be in the app before that can work. A kit that ships in the app starts with the app, and Google's kit may read your phone's advertising ID when it does: a number Android keeps for ad networks, which you can reset or switch off in Android's settings. That goes to Google, not to us. Plotero receives none of it, and the kit is never handed anything about your lots, your titles or your account.

When the video arrives, this policy will say so first. It will be the only advert in the app, you will have to go and ask for it, and you will be asked how you want it handled before the first one is shown. Plotero in a browser carries no ad code at all.

On an iPhone there are no adverts and no tracking. The iPhone app never starts Google's advertising kit, never reads the iPhone's advertising identifier (IDFA) and never shows Apple's "Allow tracking" prompt. From version 1.0.14 the kit is not in the iPhone app at all.

Third parties

Plotero has no analytics and no tracking libraries. Nothing in it reports what you tap, how long you stayed, or that you opened the app at all.

Google is in it in several ways, and each one is named where it happens: the sign-in service that gives your account its number, your own Drive for the backup and for shared portfolios, the document reader that reads a title, the map kit and the place finder on the Map tab, Google Play for the once-only check that the phone is real and, once credits can be bought, for taking the payment, and the advertising kit in the Android app described above, which shows nothing yet.

Apple is in it on an iPhone: Sign in with Apple, if you use it, and Apple's place finder for a search on the Map tab.

Esri publish the satellite imagery. Make a satellite plan, or open a shared web page, and the map squares it needs are fetched from them, through us.

Our own server runs on Cloudflare, who carry the connection the way any hosting company does and see what any host sees: your IP address, and nothing we have written down about you.

Nothing else about you reaches anyone else.

Your control

Saved lots, portfolios, buyers and deals are removed when you delete them in the app, or when you uninstall Plotero.

If you used Drive, the app has a button that deletes the synced copy and its files from your Google Drive. You can also sign out, which stops any further syncing, or revoke Plotero's access entirely at myaccount.google.com/permissions. Revoking removes our access but leaves the folders behind, so use the delete button first if you want them gone. A shared portfolio is closed with "Stop sharing" on the portfolio, which takes everyone's access away and removes its Drive folder.

Nothing you have drawn or saved is on our side, so there is no copy of your lots for us to delete and none for us to hand to anybody. The one record we do hold is the account described under Your account, and "Delete my Plotero account", beside the backup settings, empties it. Without the app, email the address under Contact from the Google account you signed in with, or as "Deleting it" says if you signed in with Apple, and we erase the record within 30 days.

Children

Plotero is a property tool intended for adults. It is not directed at children under 13, and we do not knowingly collect any data from a child.

Changes

This policy is updated before the version it describes is released, and the app tells you what is being sent at the point you press the button.

Changed on 17 October 2026, for version 1.1: the iPhone app sells credits and plans through the App Store, and "Buying credits or a plan" says what the App Store is given, what happens on a refund, and what we tell Apple when it asks about one. The iPhone keeps its own device id for the free allowance, and asks Apple to confirm it is the real app on a real iPhone. Deleting the account takes what you bought with it.

15 October 2026. this policy now covers the iPhone app. Your account describes Sign in with Apple, what Apple sends and what deleting does with it, the mark that ties a Google or Apple sign-in to the account it was first used with, and what a deletion receipt now records. The iPhone sends no device id, shows no adverts and does no tracking, and a search there goes to Apple's place finder. What Plotero sends says Smart Scan asks once before any page goes to Google's AI, and What Plotero stores says when the camera and the microphone are used.

13 October 2026. Sharing a portfolio now says the shared folder is shared by link rather than to each person's Google account, that our server keeps its address sealed, and that the people you share with see your Google name, email address and photo.

3 October 2026. "Deleting it" now says that what you unlocked goes with the account, that deleting refunds nothing, that Google Play keeps its own record of a purchase, and that the app says how many shared portfolios close before you confirm.

1 October 2026. this policy now describes the account record our server keeps (the count of reads, the free allowance, the Store record, the phone code and the shared portfolios you are in), how long it is kept, and the button and the email that delete it, and what a purchase adds to that record once credits can be bought. It describes sharing a portfolio through your own Google Drive, which arrives with the version that switches it on. It says that a read on Plotero's own key goes through Google's free tier, where Google may keep and read what is sent, and what using your own key changes. It names the map kit and the place finder on the Map tab, the three ways of handing a property to a buyer, and the advertising kit the app carries, which shows no advert yet. Buyers and deals are written down under What Plotero stores, where they had been missing.

27 September 2026. a tap in the Store records your email, only to stop abuse of the free unlock. See Your account.

18 September 2026. free portfolios, properties and scan credits are now counted per phone as well as per account. The app sends your phone's device id with account requests, and it is kept only as a scrambled code that cannot be turned back into the id. See What Plotero sends.

13 September 2026. a property you have placed on the map can have a second plan with satellite imagery under the drawing. Making one sends the map squares it covers, which is where the land is and nothing else, to Plotero's reader and on to Esri, who publish the pictures. See What Plotero sends and Where you are.

13 September 2026. this policy now also describes two smaller things that were already sending a page and were not written down here. Tapping a line to highlight it on the paper, and naming a document by boxing its heading, both go the same way as Smart Scan, and nothing is kept.

8 September 2026. several lots can now go on one drawing, called a plot. A plot holds the name you typed and where you dragged each lot on the sheet, in metres, against the other lots. Export a lot that sits on a drawing and the sheet shows the others as outlines with their names, and says how each one was positioned. See What Plotero stores. Nothing off the title is on it.

8 September 2026. a saved lot now keeps the monument's whole name, as your title writes it: "BLLM No. 1, Mp. of Montalban, Rizal", not just "BLLM No. 1". Earlier versions cut it back before saving. The town and province are printed on your own title, they were never hidden from anyone else, and Plotero needs them to tell two markers of the same number apart.

6 September 2026. you can now place a lot by standing on one of its corners. The reading is saved with the lot as its position on the map, and is in your backup if you make one. See Where you are. It is not sent anywhere.

6 September 2026. Plotero can now use your phone's location, on the Walkaround screen only, to show where you are standing against a lot. The position stays on the phone; see Where you are. Nothing about this changes what is saved or backed up.

6 September 2026. what a title says about itself (the title number, the registered owner's name, the plan number, the location, the survey dates, the adjoining lots) is now saved with the lot and included in your backup. Before this version it was shown on screen and discarded. A new button, "Read the exact wording", fetches the verbatim technical description on request and saves that too. Nothing from a title is printed on an exported PDF, then or now.

30 August 2026. Smart Scan replaced the older "Read this title", which sent one page. Smart Scan sends every page of the open document, and the details it reads back now include the title number and the registered owner's name. See What Plotero sends.

Contact

privacy@hyperkoalastudio.com

© 2026 Hyper Koala Studio · Terms of Service