Privacy Policy

Last updated: October 16, 2026  |  Effective: October 16, 2026

1. Who We Are

ScanCrypt ("we," "us," or "our") is a mobile application for Android that provides document scanning and PDF management tools. By using ScanCrypt, you agree to this Privacy Policy.

For questions, contact us at: support@cryptonstudio.app

2. Data We Do NOT Collect

We want to be crystal clear about what we don't do:

• We do not upload your documents, scans, or PDFs to any server
• We do not collect or store your name, email, or personal information
• We do not require account registration to use the app
• We do not track your location
• We do not share or sell any data to third parties
• We do not read your contacts, messages, or other apps

If you have Pro, the app sends one thing to a server of our own: the purchase confirmation described in Section 6. It never includes document content or payment details.

3. Data Processed On-Device

All document processing — scanning, OCR, PDF editing, compression, encryption — happens entirely on your device. Your files are stored only in your device's local storage or wherever you choose to save them (e.g., Google Drive via Android's native share sheet).

4. Camera and Storage Permissions

ScanCrypt requests the following Android permissions:

• Camera: Required to scan documents and capture ID cards. Photos are processed locally and never sent anywhere.
• Storage (Read/Write): Required to open existing PDFs and save your work. We only access files you explicitly open or save.

5. Advertising

The free version of ScanCrypt displays advertisements served by Google AdMob. AdMob may collect device identifiers and usage data to serve relevant ads. This is governed by Google's Privacy Policy.

Pro users see no ads. If you purchase a Pro plan, AdMob is completely disabled for your session.

6. In-App Purchases

Purchases (Pro Lifetime and Annual Pro) are processed through Google Play Billing. ScanCrypt never sees or stores your payment information. All billing is governed by Google Play's Terms of Service.

Purchase confirmation. If you have Pro, the app also confirms your purchase with our own server, a Firebase Cloud Function. This lets us check with Google Play that the purchase is valid, and that the request comes from a genuine copy of ScanCrypt. The app sends it over HTTPS, about once a day while you are online and again right after you buy Pro or restore a purchase. The request carries:

• the purchase token and product ID that Google Play issued for your purchase;
• the anonymous installation ID described in Section 7;
• the version number of the app; and
• a limited-use Firebase App Check token, also described in Section 7.

It carries no payment details and no document content.

Our server checks the purchase with Google Play. It stores only SHA-256 hashes of the purchase token and the installation ID, never the values themselves. What it keeps is:

• for each purchase, what Google Play says about it: the product, whether it is valid, when a subscription expires, whether it was refunded and, if Google Play cannot find it, when that was first seen;
• for each purchase, the hashed IDs of the installations that confirmed it, each with the time it was last seen (entries older than 30 days are dropped whenever the purchase is confirmed again, and at most 50 are kept), so that we can detect a purchase being shared across installations; and
• for each installation, a daily request counter that limits how often it can ask.

Our server also writes ordinary function logs, which record the hashed installation ID, the app version number, the product ID and the result of each check.

7. Firebase Services

ScanCrypt uses the following Firebase services from Google:

• Firebase App Distribution: Used internally for beta testing. End users receive the app through Google Play only.
• Firebase Remote Config: Used to manage feature flags and promotional pricing configurations without requiring an app update. No personal data is collected through this service.
• Firebase Crashlytics (if enabled): May collect anonymized crash reports to help us fix bugs. No document content is ever included in crash reports.
• Firebase Analytics: Records anonymous usage events, such as which tools you use and which screens you open, to help us improve the app. No document content is ever included. It is on by default: the app asks about it the first time you open it, and you can switch it off at any time in Settings → Privacy & Data → Usage Analytics. That switch also turns off crash reports.
• Firebase Installations: Gives each installation of the app an anonymous installation ID. ScanCrypt has no account or sign-in, so the ID is not linked to your name or email address. With Pro, the app sends it with the purchase confirmation described in Section 6; our server stores only a hash of it.
• Firebase App Check (with Play Integrity): About once a day the app asks Google Play to confirm that it is a genuine, unmodified copy of ScanCrypt, and Firebase App Check turns the answer into a limited-use token. With Pro, the token goes to our server with the purchase confirmation described in Section 6. Without Pro, it is not sent to us. No document content is involved.
• Firebase Cloud Functions: Runs the server code that receives the purchase confirmation described in Section 6. It is the only server code of our own that the app contacts.

8. ScanCrypt Web Toolkit

In addition to the Android app, we offer a free browser-based document toolkit on this website. The same privacy principles apply:

• 100% in-browser processing: All document and image processing happens locally in your browser. Your file contents are never uploaded, transmitted, or stored by us — files never leave your device, and tool outputs are downloaded directly to your device.
• Camera access: The QR and barcode scanner tools can use your device camera. The camera feed is processed locally in your browser and is never recorded or transmitted.
• Local storage: We use your browser's localStorage only to store tool preferences and the daily-use counter for the OCR tool. You can clear it at any time through your browser settings.
• No tracking: The web app currently uses no analytics, no tracking cookies, and no third-party scripts.
• Hosting: This website is hosted on Vercel. Like any web host, Vercel collects standard webserver request logs (such as IP address and user agent) in order to serve pages — never your file content.

9. Children's Privacy

ScanCrypt is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Data Security

Since we never collect your documents, and the app sends them nowhere unless you choose to share or export them, there is no server-side risk to your documents. The only server code of our own that the app contacts is the purchase confirmation described in Section 6. It is reached over HTTPS and never receives document content. Your files are as secure as your device. We recommend using device encryption and a strong lock screen for maximum protection.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of ScanCrypt after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: support@cryptonstudio.app