Currently, any user with access to a synchronized project in QField can use the “Send compressed folder to...”/“Send to” function to package the entire project (or individual datasets) and send it by email, messaging or another app, without any control from the server. This completely overrides the access control that is configured in QFieldCloud (users/passwords, roles), since once the data is synchronized locally, there is no way to prevent it from leaving the device.

Proposal: Add a project/role level permission in QFieldCloud (e.g. an allow_local_export flag or similar, configurable by the administrator from the project's users/role management panel) that, when synchronized with the device, communicates to QField if the user is allowed to use local export functions (“Send to”, “Export to folder”, “Send compressed folder to”). If disabled, those options should appear locked/hidden in the project menu within QField for that user.

Why it's feasible: It doesn't require DRM or complex encryption — it's just another permission, similar to those that already exist to edit/add/delete features. The server already controls other permissions per role; extending it to “export/share locally” would be consistent with that architecture. If a user changes roles and logs back in, the new permission would normally be applied at the next synchronization, as is the case today with other permissions.

Use case: I manage my own QFieldCloud with sensitive field data. I need to be able to restrict which users can take copies of the project from their devices, without relying on third-party MDM or purely organizational policies.