# Can You Build Your Own Field Data System with AI? Tips and Pitfalls

> What AI coding tools do well for restoration and carbon teams, where AI-built systems break (photos, backups, offline collection, security and costs) and how to build one safely.

Date: October 18, 2026

Yes, you can build a field data system with AI, and a first version takes days, not months. Getting it to keep working for years is the hard part: offline sync, photos, backups, security and maintenance. That's where AI-built systems break, and where most of the work goes.

AI coding tools such as Claude Code, Cursor, Lovable and Replit turn plain-language instructions into working software. For restoration and carbon teams that's a real change: a monitoring lead can now build the dashboard they've been asking for, without waiting for a developer.

**Disclosure:** we sell a field data platform, so weigh what we say accordingly. We also build it with AI coding agents every day. The tips below come from what has broken for us and what we now do about it.

**Figures and prices checked October 18, 2026** against the sources linked in each section.

## What is AI good at when building software?

First versions, and anything you can check by looking at it:

- **Prototypes.** Try a form, a map or a workflow with your team before anyone commits to it.
- **Dashboards.** A monitoring lead at one of our partners built a survival dashboard with AI to work out how their team should see the data. That's a great use: cheap to try, easy to check, nothing lost if it's thrown away.
- **Scripts.** Cleaning a spreadsheet, converting coordinates, renaming a folder of photos.
- **Internal tools** for a few people, where a mistake is noticed quickly.

It's weaker where mistakes are hard to see: security, data that syncs between phones and a server, and code that has to run for years. Developers feel this too. In Stack Overflow's [2025 survey](https://survey.stackoverflow.co/2025/ai), 46% distrusted the accuracy of AI tools, and the top frustration, named by 66%, was answers that are "almost right, but not quite".

## How should you store field photos?

Photos are usually most of the data, and the first thing to go wrong.

- **Measure before you choose a plan.** Check the size of a few of your own field photos. At 4 MB a photo, 50 field staff taking 20 photos a day for 200 days produce 200,000 photos, or 800 GB, a year. Supabase, a database service many AI tools use, includes [1 GB of file storage](https://supabase.com/pricing) on its free plan: about 250 photos.
- **Storage is cheap; downloads may not be.** Amazon S3 charges [$0.023 per GB a month](https://aws.amazon.com/s3/pricing/), so 800 GB costs about $18 a month. Sending photos out to people costs $0.09 per GB after a free 100 GB a month, and a dashboard that loads full-size photos adds up. Cloudflare R2 charges [$0.015 per GB and nothing for data sent out](https://developers.cloudflare.com/r2/pricing/).
- **Keep photos private.** In July 2025, the Tea app leaked about [72,000 images](https://bleepingcomputer.com/news/security/tea-app-leak-worsens-with-second-database-exposing-user-chats) from a storage bucket anyone could read, including selfies and ID photos. [Many photos still had their GPS location](https://simonwillison.net/2025/Jul/26/official-statement-from-tea/). That leak wasn't caused by AI-written code, but it's the mistake to avoid: field photos show landowners, homes and farms, with coordinates.
- **Keep the original file.** Resizing or compressing photos can strip the location and date. Store the original and make smaller copies for display. Our guide to [why field photos lose their GPS location](https://restorationscope.com/blog/field-photos-missing-gps) covers where it happens.
- **Back up the photos too.** Supabase's database backups [don't include files](https://supabase.com/docs/guides/platform/backups) in its storage. Many backup plans cover the records but not the photos.

## How do you keep backups safe?

Turn them on before the first real record goes in, and keep one copy out of reach of the AI.

- **Check your plan.** Supabase's free plan has [no automatic backups](https://supabase.com/pricing) and pauses a project after a week without activity. Its $25 Pro plan keeps daily backups for seven days. Restoring to a chosen minute needs a larger compute add-on and costs about $100 a month extra for each seven days kept.
- **Follow the 3-2-1 rule.** CISA, the US cybersecurity agency, recommends [three copies, on two types of storage, one off-site](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data), and testing that you can restore them.
- **Keep the AI away from production.** In July 2025, Replit's AI agent [deleted the production database](https://www.theregister.com/2025/07/22/replit_saastr_response/) of an app SaaStr's founder was building, during a code freeze. In April 2026, an agent in Cursor found an access key in an unrelated file and [deleted a company's data and the backups stored with it](https://www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/) in nine seconds; its hosting provider restored the data two days later. In both cases the agent could reach production. A backup the same key can delete isn't a backup.

## Why is offline field data collection the hardest part?

Because the data lives on a phone, out of sight, sometimes for weeks. A prototype that works on office Wi-Fi tells you little about a week in the field.

- **Web apps can lose offline data.** Browsers treat a website's stored data as [best-effort](https://developer.mozilla.org/en-US/docs/Web/API/Storage_API/Storage_quotas_and_eviction_criteria) and can clear it when the phone runs low on space. Safari deletes it [after seven days of Safari use without opening the site](https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/); in 2020, WebKit said web apps added to the home screen were exempt. For long trips offline, use a native app or an established field app such as KoboToolbox or ODK.
- **Phones don't update at the same time.** Some phones in the field will run last month's version for weeks. Your server has to accept what older versions saved.
- **Android apps need yearly updates.** Google Play requires apps to [target a recent Android version](https://developer.android.com/google/play/requirements/target-sdk) to publish updates. An app nobody maintains stops being available to new users on newer phones.

The rule we build by: **the phone captures, the server decides.** The phone saves every record and photo and keeps trying to hand them over. It only clears an item once the server confirms it has it. It never deletes field work because a check said it was wrong. The server keeps everything it receives, applies what it can and sets the rest aside with the reason, so a person can fix it. Work set aside on the server is safe. Work stuck on a phone is very hard to find.

Before trusting any field app, ours included, test it like this:

1. Collect a week of data in airplane mode, then sync.
2. Close the app halfway through an upload.
3. Install an update while records are still waiting to sync.
4. Have two people edit the same record offline.
5. Fill the phone's storage, then collect more.

## Is AI-written code secure?

Not by default. In [Veracode's 2026 tests](https://www.veracode.com/blog/spring-2026-genai-code-security/) of more than 150 AI models, only 55% of coding tasks produced secure code.

- **Database rules.** In 2025, researchers found that [170 of 1,645 apps](https://mattpalmer.io/posts/statement-on-CVE-2025-48757/) showcased by Lovable, an AI app builder, let anyone read their data, including emails, phone numbers and payment details, and in at least one case change it. The apps' databases had no rules saying who could see which rows. Lovable disputes that the flaw was in its platform.
- **Made-up packages.** AI tools sometimes suggest software libraries that don't exist. In a [2025 study](https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen), 19.7% of the packages suggested by 16 AI models were invented. Newer models still invented about 5% in [2026 tests](https://www.alphaxiv.org/abs/2605.17062), and attackers can publish real packages under those names.
- **Sensitive data.** Landowner names, farmer IDs, phone numbers and plot locations need the same care as payment details. Ask: who can read each table? Who can see each photo? What happens when a field worker leaves?

If nobody on your team can answer those questions from the code, have someone who can review it before real data goes in.

## What does an AI-built system cost to run?

The AI tool and the servers are the small part. The people are the big one. Prices checked October 18, 2026:

| Item | Typical cost |
| --- | --- |
| AI coding tool | $10 to $200 a month per person, plus usage charges on some plans ([Claude](https://claude.com/pricing), [Cursor](https://cursor.com/pricing), [GitHub Copilot](https://github.com/features/copilot/plans), [Lovable](https://lovable.dev/pricing), [Replit](https://replit.com/pricing)) |
| Database with daily backups | $25 a month (Supabase Pro), plus about $100 a month for each week of minute-by-minute restore |
| Photo storage | $15 to $23 a month per terabyte (Cloudflare R2, Amazon S3) |
| Photo downloads | Free on R2; $0.09 per GB on S3 after 100 GB a month |
| Android publishing | Yearly updates to keep up with Google Play's rules |
| People to run and fix it | About $200,000 a year per US developer with benefits, and we'd plan for two ([details below](#people)) |

If your app calls an AI model itself, for species identification or reading documents, budget for changes. AI companies retire models: Anthropic says [requests to retired models fail](https://platform.claude.com/docs/en/about-claude/model-deprecations) and gives at least 60 days' notice, and OpenAI shut down [its whole Assistants API](https://developers.openai.com/api/docs/deprecations) in August 2026.

## Who will maintain it?

All software needs maintenance, AI-built or not. Servers fail at night. Phones and libraries update. Security problems are found. Field teams ask for changes every season, and funders ask for new numbers. Someone on your team has to be ready to manage the system, fix it and improve it, for as long as the project runs.

That person is the real cost of building your own:

- **Hiring developers is expensive.** In the US, a software developer earns a [median of $135,980 a year](https://www.bls.gov/ooh/computer-and-information-technology/software-developers.htm), and wages are [about 69% of what an employer pays](https://www.bls.gov/news.release/ecec.t04.htm), so one costs close to $200,000 a year with benefits. One person can't cover holidays, illness and resignations, so we'd plan for two: about $395,000 a year. Even at the [global median for full-stack developers](https://survey.stackoverflow.co/2025/work), $72,509, two developers cost about $145,000 a year in salary alone.
- **Hiring is slow.** For non-executive roles in the US, the median time from opening a job to an accepted offer is [44 days](https://www.shrm.org/content/dam/en/shrm/research/2025-recruiting-benchmarking-report.pdf), and developers who also understand GIS, offline apps and field work are much harder to find.
- **Using your own staff isn't free.** A GIS or monitoring lead who maintains the system on the side spends that time away from the work they were hired for. Without experience, problems take longer to find and fix: in Stack Overflow's [2025 survey](https://survey.stackoverflow.co/2025/ai), 45% of developers named "debugging AI-generated code is more time-consuming" as a frustration, and they write code for a living.
- **People leave.** In the US, people in computer and mathematical jobs have been with their current employer a [median of 4.6 years](https://www.bls.gov/news.release/tenure.t06.htm). When the one person who understands the system leaves, the knowledge goes with them.

This is the cost we built Restoration Scope to share. Your subscription pays for a team that keeps the platform running, fixes problems and improves it for every project that uses it, and our service layer fits it to your workflow. Your staff stay on restoration. Our guide to [in-house software teams](https://restorationscope.com/blog/in-house-software-development-team) covers the costs in more depth.

## How do you build with AI safely?

What we've learned building Restoration Scope with AI agents:

1. **Write the workflow down first.** One page: who collects what, where, offline for how long, and who uses it. The AI builds what you describe, not what you meant.
2. **Treat the first version as a prototype.** Show it to the field team, learn, and expect to rebuild parts of it.
3. **Keep development and production apart.** Let the AI try changes on a copy of the database, and keep keys that can delete your data or backups out of its reach.
4. **Turn on backups on day one,** for records and photos, with one copy the AI can't reach. Test a restore.
5. **Keep the phone simple.** It captures and hands over; the server checks and decides.
6. **Ask for a failing test before each fix.** A test that fails first proves the fix fixed the right thing.
7. **Get a second opinion.** We have two different AI models review the plan and then the change before it goes in.
8. **Write your rules where the AI reads them.** Tools like Claude Code read a project file of instructions. When you correct the same mistake twice, add an automatic check that catches it.
9. **Check every change in the real app,** as the person who will use it, on the phone they use. Tests passing isn't enough.
10. **Name who maintains it next year.** If the answer is "the AI", plan again.

Google's [DORA research](https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report) found that AI "amplifies what's already there". Good habits get faster. So do bad ones.

## When should you build it yourself, and when not?

- **Build it yourself** for prototypes, dashboards, scripts and internal tools, where a mistake is cheap and visible.
- **Think twice** when the system holds field data that reports, payments or carbon credits depend on, when teams work offline for days, or when nobody on staff can read the code.
- **Use an established tool** such as KoboToolbox, ODK or QField for field forms. Our guide to [field-data apps](https://restorationscope.com/blog/field-data-capture-apps) compares them.
- **Work with a partner** when your workflow doesn't fit a ready-made tool and you don't want to run a development team. That's what we do: we configure Restoration Scope around each project's workflow and maintain it, and we use AI to do that faster.

A good mix for many teams: AI for prototypes and analysis, and a maintained system for the field data. Whatever you choose, make sure you can get all your data out. To check the data in any system, yours included, run our free [restoration data audit skill](https://restorationscope.com/blog/restoration-data-audit-skill) on an export.

## Frequently asked questions

### Can I build a field data collection app with AI?

You can build a working first version in days with tools such as Claude Code, Cursor, Lovable or Replit. The hard parts come later. Offline sync, photo storage, backups, security and app updates need someone who understands the code, and they are where AI-built systems usually break.

### Is AI-generated code secure?

Often not without review. In Veracode's 2026 tests, only 55% of AI coding tasks produced secure code, and in 2025 researchers found 170 apps built with Lovable that exposed their users' data. Check who can read every table and every photo before real data goes in.

### Should a field data app be a web app or a native app?

For long periods offline, a native app or an established field app is safer. Browsers treat a website's offline storage as best-effort and can clear it, and Safari deletes it after seven days of Safari use without opening the site, unless the web app was added to the home screen. Web apps work well for office work and short offline gaps.

### How much does it cost to store field photos?

Storage itself is cheap. Amazon S3 charges $0.023 per GB a month and Cloudflare R2 charges $0.015, so a terabyte of photos costs about $15 to $23 a month. The bigger costs are downloads, backups of the photos, and mistakes such as public storage or photos that lose their location.

### Do I still need a developer if I build with AI?

For a prototype, no. For a system that holds field data for years, yes, or a partner who plays that role. Someone has to review what the AI writes, keep backups, fix security problems and update the app when phones and libraries change. In the US, one developer costs close to $200,000 a year with benefits, and one person can't cover holidays, illness and resignations.