Last updated: June 27, 2026
This Privacy Policy explains how Scan & Store processes personal data in connection with the Scan & Store mobile application and its included extensions.
No Data Protection Officer has been appointed unless expressly stated otherwise here.
This Privacy Policy does not automatically cover a separate companion or standalone application unless that product is separately distributed and expressly linked to this notice.
Scan & Store is a local-first document app. We do not operate a general hosted document storage backend for user documents.
Core scanning, local storage, OCR, archive organization, editing layers, and many viewer functions are designed to work primarily on-device.
In the current public V1, archive documents are intended to remain in the app's private local storage area on your device unless you export, share, or enable a cloud connection. If you enable cloud sync or cloud-linked restore, the selected provider may also receive readable PDF files, filenames, folder structure, and technical restore or sync metadata used by the app.
Split Bill is a limited sharing feature and an exception to the general local-only archive model. If you create or open a Split Bill link, structured receipt item data and participant selection status data may be processed through the public Split Bill page and supporting Supabase/Vercel infrastructure so participants can choose receipt items. The public Split Bill page works with structured item/text data and does not upload, display, or download the original receipt image or PDF itself.
Optional AI assistance for naming or metadata suggestions is another exception to the purely local processing model. It is not started automatically after scan, import, or OCR. If you actively use such an AI function and have consented beforehand, document context relevant to that specific function may be transmitted through supporting app infrastructure to an external AI provider. AI results remain suggestions until you confirm them in the app.
If your documents contain special categories of personal data or particularly sensitive content, such as health records, identity documents, financial records, or data about other people, use external AI, cloud sync, Split Bill, support messages, and exports only where this is necessary for your purpose and you have the required permission or legal basis.
The currently shipped public V1 stores archive documents in a standard local archive within the app's private storage area on your device. Certain imports may temporarily pass through a shared local staging zone used by extensions and handoff flows before being copied into the archive or cleaned up. The public V1 does not expose or require a separate Vault feature.
We process personal data for the following purposes and on the following legal bases under Article 6 GDPR.
Article 6(1)(b) GDPR, performance of a contract or steps taken at your request before entering into a contract.
Article 6(1)(f) GDPR, legitimate interests.
security of our app and systems, prevention of misuse, preservation of service integrity, technical stability, and enforcement or defense of legal claims.
Article 6(1)(c) GDPR, compliance with a legal obligation.
Article 6(1)(b) GDPR where your request relates to the use of the app or a contractual relationship, and otherwise Article 6(1)(f) GDPR, legitimate interests.
providing legally required information, maintaining secure and reliable public pages, responding to contact requests, and protecting our rights.
Article 6(1)(f) GDPR, legitimate interests.
operating a reliable app, prioritizing fixes, and improving core product quality without processing document content analytics.
Article 6(1)(b) GDPR, performance of a contract or steps taken at your request before entering into a contract, and Article 6(1)(f) GDPR, legitimate interests, for security, abuse prevention, and link integrity.
providing a reliable shared receipt item-selection flow, preserving link integrity, preventing misuse, and keeping participants' own selections separate from other participants' selections.
Article 6(1)(a) GDPR, consent, for transmitting document context to an external AI provider. Article 6(1)(b) GDPR may additionally apply to the local provision of the suggestion function you requested.
You may withdraw AI consent at any time for the future. Completed requests cannot be undone retroactively; new external AI requests are not started without the required consent.
Scan & Store uses the following permissions and device-level functions.
The camera is used to scan documents.
The current V1 uses Apple system pickers to let you choose files or images and does not request general photo-library access where those system pickers are sufficient.
The app may optionally use Face ID, Touch ID, or device passcode authentication for app-lock, depending on your device and configuration. The current V1 does not require app-lock by default. When device authentication is used, the app receives only the result of the authentication check and does not access Face ID data associated with the enrolled face.
OCR and related suggestion logic are processed on-device using Apple frameworks.
External AI assistance is not part of normal local OCR. It is used only after an active request and the required consent, and it may transmit document context to an AI provider named in the app.
When scanning, the app may use device motion data to improve orientation or capture stability. Motion data is processed locally, is not used for fitness or health tracking, and is not sent to our servers.
The current V1 does not request push-notification or remote-notification permission.
We may disclose or make data accessible to the following categories of recipients, depending on how you use the app.
Where service providers act on our behalf, we require appropriate contractual or equivalent safeguards for the protection of personal data, including data processing agreements, standard contractual clauses, or equivalent safeguards where required for the relevant role, data category, and transfer. Before publication, the provider role, purpose, data categories, region, transfer basis, retention logic, and contractual evidence for the final build must be checked and documented internally for each provider.
If you connect Google Drive, Dropbox, or pCloud, your files are transferred directly between your device and the selected provider. Supabase is used for limited authentication and connection functions in connection with pCloud and for structured Split Bill link data. Supabase is not used as a general document-storage backend or file proxy for your archive documents.
If you use an external AI function, document context required for that function may be transmitted to the AI provider named in the app. We do not advertise general provider-retention or comparable provider commitments unless they are expressly confirmed in the specific provider and consent text.
The Share Extension can copy files and images into a shared local import zone used by the app as a temporary staging area and subject to app cleanup.
When you import content from an http or https link via the Share Extension, the extension may contact the third-party server hosting that resource directly in order to retrieve the file.
The Document Picker Extension and File Provider Extension operate with the same shared import and app-group-based local zone. The current V1 File Provider is import-oriented and is not described as a general browser for the private archive stored inside the app. Imported content is generally copied into the app's private storage rather than exposing the archive through open-in-place access.
Subscriptions are billed by Apple through the App Store. We do not receive your full payment card details.
Apple handles billing, payment processing, App Store subscription management, and related restore mechanisms.
Subscription and entitlement data are used to determine whether premium features are unlocked and to support restore flows. Without an active subscription, the current V1 may still provide basic viewing and export of existing locally stored documents, while scanning, importing, editing, organization, and cloud sync functions may be restricted.
Split Bill lets a creator share a private, unlisted link for receipt item selection.
Anyone who has the link may be able to open the Split Bill page unless the link has expired, been closed, been deleted, or otherwise been deactivated.
Split Bill processes structured receipt information such as receipt title, merchant name, currency, total amount, recognized item names, item amounts, item quantities, participant names, selected items, selection status, and timestamps.
The public Split Bill web page does not upload, display, or download the original receipt image or PDF itself. It uses structured receipt item/text data needed to show and select items.
The Split Bill creator may provide an optional PayPal.me link. PayPal.me opens externally. Scan & Store does not process payments, hold money, settle debts, decide payment obligations, or receive payment card details through Split Bill.
Active Split Bills remain available until the creator closes or deletes them, or until the configured expiry or deactivation takes effect. After closure, deletion, expiry, or deactivation, shared links are intended to become invalid or inactive.
Participants' browser-local Split Bill data, such as a participant name, browser-local participant identifier, and draft selection, may remain in the browser's local storage until the participant clears browser storage or the app/page overwrites or removes that local data.
Redactions, annotations, signatures, markups, notes, and similar edits are generally stored as local editing metadata or layers.
A modified version is typically created when you export a new derived file. This means the archived original and a cloud copy of the original file may remain unchanged even if local editing layers exist inside the app.
When you export or share a file, the resulting file leaves the app's protected local storage area and becomes subject to the destination, recipient, file name, and any service or platform you choose.
Password protection offered for PDF exports is PDF-based protection for that exported file and is not equivalent to end-to-end encryption or a ciphertext-only storage model.
An edited export may contain embedded redactions or other applied edits, while an export of the original file may remain the original file without those embedded changes.
Some recipients may process personal data outside the European Economic Area.
The actual transfer situation depends on the service used and the processing chain triggered by your use of the app. You may contact us for more information about the safeguards used for a specific international transfer.
We retain or delete data according to the following logic.
Stored in the app's private local storage area until you delete the relevant document, reset the app, or otherwise remove local data.
Stored until you permanently clear the trash, the app cleans up the trash according to its lifecycle logic, or local reset/removal occurs.
Stored as temporary staging data until import, deletion, cleanup, or reset, including lifecycle-based cleanup.
Stored until you disconnect the provider, revoke access, or reset the app, subject to technical and legal requirements.
Stored as long as required for subscription status handling, restore support, legal compliance, dispute handling, and related documentation.
Stored until deleted at the respective provider or removed by you or by app actions triggered by you, subject to the provider’s own systems and retention logic. This may include readable PDF files, filenames, folder structure, and related restore or sync metadata stored with the connected provider.
Stored as long as necessary for the relevant request, legal retention obligations, or defense of legal claims.
Stored according to TelemetryDeck retention settings and as long as needed for aggregate reliability and usage analysis.
Active Split Bill sessions, item data, participant names, participant selections, optional PayPal.me link references, and link status are retained until the creator closes or deletes the Split Bill, until the configured expiry or deactivation takes effect, or as long as needed for security, abuse prevention, legal compliance, dispute handling, and operational integrity.
Status, version, timestamps, scope, and technical result state of an AI consent or AI request may be retained as long as required for evidence, withdrawal handling, security, abuse prevention, premium access validation, or legal compliance.
We do not store complete AI request texts, transmitted document contents, PDFs, OCR text, or complete AI provider responses as diagnostics or product analytics logs. AI suggestions that you accept or continue to use as a draft may become part of local document metadata or local editing state. Retention by the external AI provider is governed by that provider's terms, applicable data-processing arrangements, and the consent text shown in the app.
Depending on your device settings and Apple backup behavior, local app data may also be included in device backups, including iCloud backups, unless excluded from backup. Deleting content in the app does not automatically delete copies that may already exist in device backups or with third-party cloud providers.
You may lodge a complaint, for example, with a supervisory authority in your place of habitual residence, place of work, or the place of the alleged infringement.
Because many content-related data items are stored locally on your device, you can directly control or delete many such data items in the app itself, through app reset functions, by clearing local storage, by clearing the trash, or by disconnecting cloud providers.
For data processed by Apple, RevenueCat, a connected cloud provider, or an AI provider you actively used, an additional request to the relevant provider may be necessary depending on the data and the role of the provider.
Some data and permissions are required to use specific functions.
You are not generally required to provide all categories of data, but certain functions will not work without the data strictly necessary for those functions.
Scan & Store does not use exclusively automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
OCR, recognition, date detection, sender suggestions, AI-assisted suggestions, type suggestions, duplicate detection, and similar features are convenience features only and do not constitute such decisions.
Scan & Store is not directed to children. We do not knowingly process personal data from children in a manner prohibited by applicable law.
We may update this Privacy Policy if our processing activities, technical setup, legal obligations, or services change.
If we introduce materially changed processing, we will update this notice before or when the changed processing becomes relevant.
Where required, related disclosures in App Store Connect or other platform disclosures will also be updated.
For abuse reports involving public Split Bill links or shared Split Bill content, contact support@scan-and-store.com and include "Split Bill abuse report" in the subject where possible.
Please do not send highly sensitive original documents to support unless strictly necessary. Support is generally provided without routine review of document contents.
