The FlexiSurvey mobile apps (iOS and Android, currently in beta) are built for collection far from connectivity: surveys download to the device, interviews are captured and stored encrypted, and everything syncs when a connection returns. This page documents exactly how that behaves, including the safeguards and the current limits, so a field coordinator can plan a deployment on facts rather than assumptions.
What is stored on the device
Downloaded surveys, captured responses awaiting sync, in-progress interview drafts, and captured media (photos, signatures, GPS traces) are all stored encrypted at rest with AES-256-GCM. Encryption keys live in the platform keystore (iOS Keychain, Android Keystore) and never leave the device. Data written to disk survives app restarts and device reboots.
How sync works
- Captured interviews join a per-device queue and upload automatically in the background when connectivity allows, with exponential backoff between retries.
- Every response carries a client-generated idempotency key. If a sync is interrupted and retried, the server recognises the response it already has: a retry can never create a duplicate record, even when the same interview is uploaded twice from an unstable connection.
- Each queued response shows its own state in the Offline screen: queued, syncing, or failed. A response that exhausts its retries (5 attempts) is kept on the device and marked failed, never discarded; it retries again on the next manual sync.
- Sync order does not affect data integrity. Responses are independent records; there is no cross-response merge and therefore no merge conflicts.
Interview drafts
A partially completed interview saves automatically as an encrypted draft, on every answer and page turn. Coming back to the survey restores the draft where you left off, and the draft is removed once the interview is submitted or queued. The Drafts section lists open drafts per survey; one draft is kept per survey and assignment pair.
Practically: a phone call, an app switch, or a device restart in the middle of an interview costs nothing.
Session expiry never costs data
If an enumerator's session expires or is revoked while they are offline (for example a security sweep back at the office), the app asks them to sign in again and keeps the entire offline queue intact. After re-authenticating, sync resumes where it stopped. Erasing offline data is an explicit, separate action that warns with the count of unsynced interviews; it never happens as a side effect of signing out or a failed token refresh.
Storage safeguards
The apps check free storage before writing:
| Free space on device | Behaviour |
|---|---|
| Below 500 MB | A persistent warning banner appears |
| Below 200 MB | New photo and media capture is blocked (text answers continue to work) |
A failed write is always surfaced as a visible error. The app never reports success for data it could not persist.
Current limits
| Limit | Value |
|---|---|
| Pending responses per device | 1,000 |
| Media file size | 10 MB per file |
| Media upload | single-shot per file today; an interrupted large upload restarts that file |
The 1,000-response ceiling exists to bound on-device storage; hitting it blocks new capture with a clear error until a sync drains the queue. For deployments expecting more than a few hundred interviews per device between syncs, plan a periodic connectivity window. General platform ceilings (instrument size, request sizes, API limits) are on the Technical Limits page.
Form versions and offline devices
When a survey is revised while devices are in the field, responses are stamped server-side with the survey version that was deployed when they arrive. Compatible revisions (added questions, reworded labels, relaxed validation) are designed so in-flight offline responses remain valid. Structural changes to a live survey are blocked in the builder precisely to protect offline devices mid-collection.
Planned, not yet available
In the spirit of documenting what exists rather than what is intended, the following are on the roadmap but not in the current apps: resumable (chunked) media upload for large files on poor connections, a supervisor rescue export for retrieving the queue from a damaged device, and offline map basemaps for geographic capture. The apps remain labelled beta until the published hardening criteria are met.