Privacy Policy

Last updated: October 5, 2026

This policy explains what information Andersonation LLC, the operator of ColombiaCad ("ColombiaCad", "we", "us"), collects through the ColombiaCad apps for iOS and Android, the ColombiaCad web app at app.colombiacad.com, and the colombiacad.com website (together, the "Service"), how it is used, who it is shared with, and the choices you have. ColombiaCad shows no advertising inside the Service and does not sell personal information. It relies on a small set of service providers to run accounts, subscriptions, map delivery, notifications, security, and the measurement of our own advertising, and this policy describes each of them. It should be read together with our Terms of Use. Section 12 explains how this policy applies under Colombia's data-protection law, Ley 1581 de 2012.

The parcel maps in the Service are public cadastral data published by Colombia's Instituto Geográfico Agustín Codazzi (IGAC) and other public sources. They show lot outlines, numbers, areas, and descriptive attributes such as economic use. They do not include the names or identity numbers of owners, and the Service does not show who owns a lot.

1. Information you give us

Account details. If you create an account, we store your email address, the first and last name you enter, and your password, which is held only in hashed form by our authentication provider. Signing in with Apple or Google shares your email address and name from that provider, under your control on their consent screens; Apple may give us a private relay address instead of your real email. If you turn on two-factor authentication, the secret used to verify your codes is stored with your account.
Saved content. Places you pin, the names and notes you give them, and the measurements and drawings you save are stored with your account so they can sync across your devices.
Your location, if you ask for it. The app can show where you are on the map and let you walk the edges of a plot to measure it. It asks your device for your location only when you tap one of those features, never when the app starts, and it never uses your location while the app is closed or in the background. While you are walking, your position is used on your device to draw the shape, guide you to a corner, and tell you how far the border is. That position reaches us only if you choose to save the result: a saved place or a saved walk carries the coordinates of the plot, and of the corners you marked, with your account so they can sync across your devices, exactly like any other saved content. If you never save one, it never leaves your phone. You can refuse or withdraw the permission at any time in your device settings, and everything else in the app works without it.
Support messages. If you email support@colombiacad.com, we receive your address and the contents of your message, and we keep the correspondence so we can help you and handle any later question or dispute.

2. Information collected automatically

Purchase status and identifiers. Subscriptions are processed by Apple or Google, who hold your payment details; we never see them. Our purchase-management provider receives your store subscription receipt and status, a random app user id or your account id, your account email and name, your device's advertising and vendor identifiers where available (see "Ads measurement" below), and your IP address, and it passes the subscription status to the app so paid features can be unlocked. If you request a refund or dispute a charge, we may give Apple or Google a record of what was delivered to your account and when, the platform it was delivered to, and the network address and general location of the delivery, which the stores ask developers for when deciding refunds and disputes.
Device registration. A subscription works on a limited number of devices. To count them, the app generates a random identifier for each installation and sends it with your platform and a general model name such as "iPhone 15". That identifier is created by the app, is not your hardware serial or phone number, and identifies an installation rather than you. You can see and remove registered devices in the app.
Zones you download. When you download a zone in the app (which stores it on your device for offline viewing inside the app), we record which zone it was and when, linked to your account or subscription. This is what lets you open a zone you already hold without it counting again, and it is how we notice bulk copying of the map library. It records the zone, not anything you did inside it.
Request records. Every request to our servers carries technical details: your IP address, the app or browser identifier, the app version and platform, the installation identifier, the account or subscription making the request, and what was requested. Our infrastructure provider keeps these in short-lived logs. We keep aggregated counts and, for security, records of failed, unusual, or unauthorized requests, including credentials used outside the app.
Integrity and bot checks. On a phone, the app obtains an attestation token from Apple (App Attest or DeviceCheck) or Google (Play Integrity) through Google's Firebase App Check and sends it with requests, so our servers can tell that they come from the genuine app on a real device. In the web app, a bot-protection challenge from our security provider runs in your browser when you sign in; it may examine browser characteristics and set a cookie, under that provider's privacy policy. We keep only the outcome of these checks, not the tokens.
Abuse-prevention records. Where we limit or deny access under our Terms of Use, we keep a record of the account, subscription, and installation identifiers involved, the reason, and the date, so the restriction can be applied consistently, including after an account is deleted or recreated.
Push notifications. If you allow notifications, the app registers with Google's Firebase Cloud Messaging for occasional announcements in the language the app displays. We do not store your notification token ourselves, and you can turn announcements off in the app's settings at any time.
Ads measurement. To know whether the advertising we buy for ColombiaCad works, the app includes the Meta (Facebook) App Events SDK. It reports app installs and launches, together with device information such as model, operating system, app version, language, time zone, and IP address, to Meta Platforms, which processes this data under its own privacy policy. On iOS, the device's advertising identifier is shared only if you allow tracking when the app asks; if you decline, Apple's privacy-preserving SKAdNetwork reports are used instead. On Android, the advertising ID is shared unless you have deleted or reset it in your device settings. Subscription events (a purchase and its value, never your payment details) may be reported to Meta through our purchase-management provider so that advertising results can be measured. This measurement does not change anything inside the app.
Map imagery. When you view the street or satellite basemap, map tiles are fetched from third-party map providers. Those providers receive your IP address and the tile coordinates of the area on your screen, under their own privacy policies. Turning the basemap off stops these requests. Directions open in a separate maps app, subject to its own policy.

Apart from the location features described in section 1, which you switch on yourself and which reach us only through what you choose to save, we do not collect your location, and our servers do not record which lots you search, view, or measure. That happens on your device; downloaded zones are stored locally and work offline. The map-imagery providers described above are the only exception, since the tiles they serve reveal the area you are looking at.

3. How we use information

To operate the Service: accounts, sign-in, sync, subscriptions, map delivery, and paid-feature access.
To apply the limits that come with a subscription, such as the number of devices it covers and how much can be downloaded.
To secure the Service, detect and prevent scraping, fraud, and other abuse, and enforce our Terms of Use.
To provide support and respond to your messages.
To send service messages about your account, security, purchases, or changes to the Service, and optional announcements if you allow notifications.
To measure the results of our own advertising, as described above.
To comply with the law, resolve disputes, and establish, exercise, or defend legal claims.

Where the law of your country requires a legal basis, we rely on the performance of our contract with you (operating the Service), our legitimate interests (security, abuse prevention, support, and measuring our advertising), your consent (tracking on iOS, notifications), and compliance with legal obligations. We do not use your information for profiling that produces legal effects for you, and we do not show you advertising based on it.

4. Sharing

We share information only as follows:

Service providers that process data on our behalf and may not use it for their own purposes: cloud database and authentication hosting, purchase management, content delivery and network security, bot protection, push notifications, email, and app-integrity services. A current list of providers is available on request.
Apple and Google, as app stores, sign-in providers, and providers of the attestation and notification services described above, under their own policies.
Meta Platforms, for ads measurement, as described in Section 2. Some laws treat this as "sharing" for cross-context advertising; Section 6 explains how to opt out.
Map-imagery providers, which receive tile requests directly from your device when a basemap is on.
Legal and safety. We may disclose information if required by law, subpoena, or court order, to enforce our Terms of Use, to investigate fraud or abuse, or to protect the rights, property, or safety of users, the public, or the Service. This includes sharing evidence of abuse of the Service with legal advisers and, where appropriate, authorities.
Business transfers. If the Service or the business behind it is sold, merged, or reorganized, information may be transferred to the successor, who will be bound by this policy.

We do not sell personal information, and we do not share it with data brokers.

5. Data retention and deletion

Account data and saved content are kept while your account exists. You can delete individual pins, measurements, and drawings in the app at any time.
Device registrations are kept while your subscription is active. A registration that goes 30 days without use is released automatically, and you can remove one yourself in the app.
Zone download records linked to your account are deleted when your account is deleted, except for a delivery record (the zone, the time, the platform, and the network address and general location of the delivery) that is kept for up to 180 days after the delivery so that we can answer refund requests and payment disputes, and is then deleted. Records linked only to an app store subscription may persist while that subscription can still be restored, and you can ask us to remove them.
Request logs held by our infrastructure provider are short-lived. Security alerts are kept for up to 90 days, or longer where they relate to an ongoing investigation. Aggregated statistics contain no personal data.
Abuse-prevention and legal records are kept for as long as needed to apply a restriction, protect the Service, or establish, exercise, or defend legal claims, and may be retained after your account is deleted.
Support correspondence is kept for as long as needed to handle your request and any related dispute.
Purchase records are kept by Apple, Google, and our purchase-management provider under their own retention rules and as required by tax and accounting law. The customer record held by our purchase-management provider includes the email address and name you gave at sign-up, and it is not removed when you delete your ColombiaCad account, so that a subscription, refund, or dispute can still be traced afterwards. You can ask us to have that record removed as well.

To delete your account, use Delete account in the app's account screen, or email support@colombiacad.com from the account's address. Deletion removes your account, sign-in identities, saved content, device registrations, and download records within 30 days, subject to the exceptions above. Deleting your account does not cancel a subscription; manage that in your app store account. Maps stored on your device are removed by uninstalling the app.

6. Your choices and rights

Tracking. On iOS, you can allow or refuse tracking when the app asks, and change your answer at any time in Settings under Privacy and Security, then Tracking. On Android, you can delete or reset your advertising ID in your device's Google settings. Doing so limits the ads measurement described above.
Location. The app asks for your location only when you tap a location feature. You can refuse, and you can withdraw the permission later in your device settings. Every other part of the app works without it, and a walk you have already saved can be deleted like any other saved content.
Notifications. Turn announcements off in the app's settings, or withdraw notification permission in your device settings.
Map imagery. Switch the basemap off to stop tile requests to third-party map providers.
Access, correction, export, and deletion. You can see and change your name in the app, delete your content and account as described above, and ask us for a copy of the personal data we hold about you.
Other rights. Depending on where you live, you may have the right to object to or restrict certain processing, to withdraw consent, to receive your data in a portable format, not to be treated differently for exercising your rights, and to complain to a data-protection authority. Section 12 sets out the rights Colombian law gives you. To exercise any right, email support@colombiacad.com from your account's address; we may ask for verification and will respond within the time the law requires.

7. Security

Data is encrypted in transit. Passwords are stored only in hashed form by our authentication provider, and you can add two-factor authentication to your account. Access to production systems is limited to those who need it and protected by authentication. Map data on our servers is served only to authenticated, authorized requests. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information with industry-standard measures and will notify you and the relevant authorities of a breach where the law requires it.

8. International transfers

We and our service providers may store and process data in the United States and other countries whose data-protection laws differ from those of your country. Where required, transfers are protected by contractual safeguards, such as standard contractual clauses, and other measures appropriate to the data. For people in Colombia, Section 12 explains how these transfers meet Colombian law.

9. Children

ColombiaCad is not directed at children under 13, and we do not knowingly collect personal information from them. Our Terms of Use require account holders to be adults or to have a parent's or guardian's consent. If you believe a child has provided us personal information, contact us and we will delete it.

10. Cookies and local storage

The colombiacad.com website sets no cookies of its own. The web app stores your sign-in session, settings, and cached map data in your browser's local storage so that it can work; clearing site data in your browser removes them. The bot-protection challenge on the web app may set a cookie under its provider's policy. We do not use advertising or analytics cookies.

11. Changes to this policy

If we change this policy, we will post the new version here and update the date above. Material changes will be announced in the app, on the website, or by email where appropriate, and where the law requires it we will ask for your consent.

12. People in Colombia (Ley 1581 de 2012)

This section applies to personal data of people in Colombia and is our policy for the processing of personal data (política de tratamiento de datos personales) under Ley 1581 de 2012 and Decreto 1074 de 2015. Where it differs from the rest of this policy, this section prevails for those people.

Who is responsible. The data controller (responsable del tratamiento) is Andersonation LLC, operator of ColombiaCad, Rhode Island, United States. Contact: support@colombiacad.com. Our service providers process data for us as processors (encargados del tratamiento).
What we process and why. The data and the purposes are those in Sections 1 to 3: running your account, subscription, sync, and support; security and abuse prevention; service messages and, if you allow them, announcements; and measuring our own advertising. We process no sensitive data (datos sensibles) as Colombian law defines them, and we do not need any to provide the Service.
Your authorization. We process your data with the prior, express, and informed authorization you give when you create an account or turn on a feature that needs it, or where the law allows processing without it. You may revoke your authorization or ask us to delete your data at any time, unless a legal or contractual duty requires us to keep it (Section 5).
Your rights. As the owner of your data (titular), you may: know, update, and correct your personal data; ask for proof of the authorization you gave; be told, on request, how your data has been used; revoke your authorization or ask for deletion (supresión); access your data free of charge; and file a complaint with the Superintendencia de Industria y Comercio (SIC), Colombia's data-protection authority, after you have first raised it with us.
How to exercise them. Email support@colombiacad.com from your account's address, saying who you are and what you are asking for. We answer a query (consulta) within 10 business days of receiving it, and a claim to correct, update, or delete data or to revoke authorization (reclamo) within 15 business days. If we need longer, we will tell you why before that time runs out and answer within a further 5 business days for a query or 8 for a claim, as the law allows. If a claim is incomplete, we will ask you within 5 business days for what is missing; a claim not completed within two months of that request is treated as withdrawn.
Transfers outside Colombia. Your data is stored and processed in the United States and other countries where our providers operate (Section 8). We transfer it to countries the SIC recognizes as offering an adequate level of protection, or under the safeguards and contracts that Colombian law allows. By accepting this policy you authorize these transfers.
Validity. This policy applies from the date at the top of this page. Your data is kept for as long as Section 5 describes. Material changes will be announced as described in Section 11 before they take effect.

13. Contact

Andersonation LLC, operator of ColombiaCad, is responsible for your data. Questions about privacy, or requests about your data: support@colombiacad.com

← Back to colombiacad.com