Privacy policy

Who we are

Scanomatic is published by Propoa Pte. Ltd. (UEN 202635624D), a company incorporated in Singapore. This policy is written to the Personal Data Protection Act 2012 (PDPA) and explains what the app does with personal data.

If you have a question, a request, or a complaint about personal data, write to privacy@propoagroup.co. That address reaches the person responsible for data protection here, and we aim to respond within 30 days.

What the app handles, on your phone

Everything below is created by you using the app and stays on your phone unless you send it somewhere yourself.

The library, including images, text and identity fields, is kept in an encrypted database on the phone. Its key lives in the phone's secure storage and is bound to that device. Documents you mark Private sit behind a second unlock. Screens that show identity data block screenshots and are hidden in the app switcher.

• Document images. Photographs of paper, cards, passports, book pages, whiteboards and screens that you capture or import.
• Recognised text. The words the app reads from those images so that documents can be searched, exported as searchable PDF or Word, read aloud, or translated.
• Identity fields. When you scan a passport, identity card or driver licence, the app reads the machine-readable zone or barcode and shows the fields it found, together with the result of the built-in check digits. These fields are stored with that document on the phone.
• Receipt fields. Merchant, date, totals and tax read from receipts you scan.
• Barcode and QR contents. What a code says, so the app can offer to open a link, save a contact, or join a Wi-Fi network. Nothing happens with that content until you tap the action.
• Organisation. Titles, folders, tags, favourites, and the folder choices the app learns from you to suggest where a new scan belongs.
• Settings. Your app lock, biometric preference, auto-lock timeout, chosen languages, cloud connection, and whether crash reports are on.
• The app lock. If you set a PIN, the app stores a salted hash of it in the phone's secure storage, never the PIN itself. Face or fingerprint unlock is performed by the operating system; the app only learns whether it succeeded and never sees biometric data.

What leaves your phone, and where it goes

Your own cloud storage, if you connect it. You can connect Google Drive (and, as they are added, other storage providers) and choose to upload documents, manually or automatically. Uploads go directly from your phone to your account. For Google Drive the app requests only the drive.file scope, which lets it see and manage files it created and nothing else in your Drive. The app stores the email address of the connected account on the phone so it can show you which account is connected. Private documents are never uploaded automatically. Your use of a storage provider is governed by that provider's terms and privacy policy.

The App Store or Google Play, when you buy or restore Pro. Payment is taken by Apple or Google under their terms; we never see your card or billing details. The app attaches a random identifier, generated once per install, to each purchase so that a transaction can be tied back to the install that made it if you ever ask us to; it identifies the install, not you. The app keeps a record of your purchase in the phone's secure storage so Pro works offline, and checks it against the store when it opens.

Google and Apple, to download models and language packs. Text recognition, barcode decoding and translation use on-device models. On some phones a model or a translation language pack is downloaded from Google Play services or Apple the first time a feature needs it. That download request identifies the model wanted, not the document you are working on.

Sentry, only if you turn on crash reports. Settings has a switch, off unless you turn it on. While it is on, and only then, the app sends a report to Sentry (Functional Software, Inc.) when it crashes. A report contains the app version, the phone model and operating system version, the type of error, and where in the app's code it happened. Before it leaves the phone the app removes everything else: there is no document, image, recognised text, identity or receipt field, file name, breadcrumb of what you were doing, device name, language, time zone, account or user identifier in it, and error messages are stripped because they can quote text the app was reading. No advertising identifier is used. Sentry is instructed not to keep the network address the report arrived from. Reports are kept for 30 days and then deleted. Switching crash reports off stops the reporting service entirely, not just the sending. No usage, session or performance data is collected with or without the switch.

Apps you hand things to. When you share, print, email or export a document, or tap a link, phone number, contact or Wi-Fi network found in a code, the content goes to the app or service you chose, and their policies apply from that point.

No server of ours. Scanomatic has no backend. No document, image, recognised text, identity field or receipt is ever sent to us.

Permissions the app asks for

Each permission is requested when you first use the feature that needs it, and the app keeps working without it, apart from the camera, which is what a scanner is for.

• Camera, to scan.
• Photos and files, only when you choose to import from them.
• Face or fingerprint unlock, only if you turn it on for the app lock.
• Local network or Wi-Fi settings, only when you tap a Wi-Fi code and the phone supports joining from an app.

What we do not do

• No analytics or usage tracking of any kind.
• No crash reporting unless you switch it on, and never a crash report that contains document content. See above for exactly what one holds.
• No advertising, advertising identifiers, or ad networks.
• No sale, rental or sharing of personal data with anyone.
• No processing of document content by any cloud or AI service.

Keeping and deleting data

Your documents stay on your phone until you delete them in the app. Deleting the app removes the library, its encryption key, your settings and your purchase record from the phone. Copies you uploaded to your cloud account, or shared elsewhere, are under your control in those places and are not affected.

Because the library's encryption key is bound to the device, a backup of the phone restored onto a different phone cannot open the library. If you want documents to survive a change of phone, upload them to your cloud account or export them.

Children

The app is not directed at children under 13 and we do not knowingly collect personal data from them. Since nothing is collected by us at all, there is nothing for us to delete; a parent who wants a child's documents removed can delete them in the app.

Your rights

Under the PDPA you may ask for access to, and correction of, personal data an organisation holds about you. We hold none: everything the app handles is on your phone, where you can view, correct, export and delete it directly. You may also withdraw consent for a cloud connection at any time by disconnecting the account in Settings, and revoke the app's access from your provider's account settings. You may withdraw consent for crash reports at any time by switching them off in Settings; a report already sent holds nothing that identifies you, and is deleted after 30 days in any case.

Complaints: write to us first. You also have the right to complain to the Personal Data Protection Commission of Singapore.

Changes to this policy

When this policy changes substantively, the effective date and version above change with it, and the store listing links to the current text. Continuing to use the app after a change means the current policy applies.

Version history

• Version 1, 9 September 2026. First version, ahead of the first store submission. It supersedes a draft of 6 September that briefly stood on this page before the app was released to anyone; that draft said there was no crash reporting, which the optional switch described above replaced before a single copy of the app was downloaded.