Privacy policy

What we collect

Anonymous reports, never your documents

PrivateScan never collects your documents and never sells any data. Your documents, the text recognized in them, your searches and your folders leave your device only through the things you start yourself: sharing, exporting, the iCloud sync you turn on, the device backups you keep, copying text to the clipboard on a Mac, in a version before 1.19, or as a translation from Apple's translation sheet, where Apple's Universal Clipboard can offer it to your other nearby devices, or tapping a link, address, phone number or date the app found in a scan, which hands that one value to the app that opens it. We cannot see what you scan, because none of it ever reaches us. There is no sign up, no account, no advertising framework and no tracking: the app does not use your device's advertising identifier and does not follow you across other companies' apps or websites. What the app itself sends us is anonymous usage events and crash reports through PostHog, while the switch Share anonymous usage and crash reports is on, as it is by default. They carry no account, only a random identifier created for the installation, and never a page, an image, a name or any text from your documents; clause 7 lists everything they do record, such as the scan mode you pick and how many pages a document has. Apart from Apple's own services (the App Store, which handles purchases and the rating sheet, the iCloud sync you can turn on, and the languages Apple's translation downloads when you first translate on iPhone or iPad), the only connections the app opens without you starting them are its connections to PostHog described in clause 7 and the model download described in clause 6. Anything you choose to send us yourself, such as an email, reaches us as you send it.

Where your documents live

On your device

Scans, thumbnails and recognized text are stored in the app's private storage on your iPhone, iPad or Mac. On iPhone and iPad, files are protected with iOS data protection, which keeps them encrypted while the device is locked. On a Mac, the files sit in the app's own container, and protecting them at rest is FileVault's job: turn it on in System Settings. If you enable the optional app lock, opening PrivateScan also asks for Face ID, Touch ID, your device passcode or, on a Mac, your login password (the device needs a passcode or password set; reopening within a few seconds of unlocking does not ask again). Biometric checks are handled by the system; the app never sees your biometric data.

Optional iCloud sync

Off by default, and always yours

You can turn on iCloud sync in Settings to keep documents available across your devices. When enabled, documents are stored in your personal, private iCloud database operated by Apple and protected by your Apple Account. We run no servers and have no ability to read what you sync. The same switch also syncs a few preferences through Apple's iCloud settings storage: appearance, the default export format, the default scan filter, and list or grid view; that part starts and stops as soon as you flip the switch. Leave the toggle off and nothing is synced anywhere. Switching document sync on or off takes effect after you quit and reopen PrivateScan; until then the previous setting stays active. Documents already synced stay in your iCloud until you delete them.

Camera and photos

Used only to scan

On iPhone and iPad, the camera is used to capture documents when you scan. PrivateScan on a Mac does not scan with a camera; documents come in there by import, including Continuity Camera from a nearby iPhone or iPad. Photo library access is used only when you choose to import images, using the system picker that shares only the photos you select. If you save an export to your photo library, the system asks for permission to add photos first.

Text recognition

On your device, even offline

Text recognition uses Apple's Vision framework running locally on your device. Recognized text is stored alongside the document on your device so you can search your scans. It goes nowhere unless you share or export the document, sync it through your own iCloud, back up your device, or copy it to the clipboard; tapping a link, address, phone number or date the app found in it hands just that value to the app that opens it, such as Maps, Phone, Calendar or your browser. It is never part of a usage event or a crash report.

The optional naming model

Downloaded, then it runs on your device

Smart naming, a premium feature, uses a small language model that runs entirely on your device. The model is not built into the app. On iPhone and iPad, once premium is unlocked, the app fetches it on its own when the device can run it and has at least 4 GB free. On a Mac, from version 1.16, the app offers it only on an Apple silicon Mac with at least 16 GB of memory and never downloads it automatically: you start the download from Settings. Earlier versions do not offer it on a Mac. The files come from Hugging Face, the public site that hosts the model. The download itself refuses cellular data, Low Data Mode and other connections the system marks as expensive; the small first request that looks up the model can use any connection, including cellular data. Since version 1.14, a model that is completely on your device, and whose download the app has recorded, loads with no network request at all. A model downloaded by an earlier version, or one the app could not record, needs one request for its list of files before the app can confirm it is complete; once that record is saved, it loads with no request. When naming runs, any request for the list of files, or for files that are missing, goes only over a connection that is not cellular, expensive or in Low Data Mode; if the model cannot load from the files it has and no such connection is available, smart naming uses Apple's text recognition instead, and the app tries the model again when you choose Retry in Settings or the next time it starts. Earlier versions that offered the naming model could ask Hugging Face for the list of files at the first naming after each launch, even when the whole model was on the device, and fetched missing files then over whatever connection you had. Delete the model in Settings and the app will not fetch it again unless you ask. The model sits in the app's cache, which the system may clear when storage runs low; after that, a launch that meets the same conditions fetches it again. The model download carries none of your documents and nothing about your scans, but like any download it shows Hugging Face your IP address and ordinary connection details, which its own privacy policy covers.

Usage and crash reports

Anonymous, and yours to turn off

PrivateScan on iPhone, iPad and Mac sends anonymous usage events and crash reports to PostHog, Inc., a product analytics service, which holds them for us in its United States cloud, where we can read them. We use them to see whether people get through setup, how scans, imports and exports turn out, how many people see the Premium screen and go on to buy it, and which crashes to fix. When a new kind of crash arrives, PostHog also opens an issue that summarizes it in our private PrivateScan repository on GitHub, so we can track the fix. Your documents still never leave your device through them: no report carries a page, an image, a word of its text or its name. Reports do record some facts about your activity, listed below, such as the scan mode you pick (single page, multiple pages, book or whiteboard), how many pages a scan or export has, and the export format.

Usage events. A usage event records that one of these things happened in the app:

• the app was installed, updated, opened (recording whether it was launched fresh or returned from the background), or sent to the background;
• a screen was shown, by a fixed name from the app's own list (documents, folders, settings, document details, scanner, export, Premium, extracted text, onboarding, the review after a scan, and about), never by its title, so never by the name of a document or folder;
• onboarding was finished, recording whether camera access was allowed, declined or skipped, or that it ran on a Mac, where the app does not ask;
• a camera scan started, recording its mode: single page, multiple pages, book or whiteboard (the ID card and passport modes are recorded as single page, so no report says an identity document was scanned);
• a camera scan ended, recording its mode, whether it was saved, cancelled or failed, how many pages it had, and which of the app's two capture methods was used;
• an import ended, recording where it came from (Photos, Files, a file another app opened in PrivateScan, pasting or dropping, Continuity Camera on a Mac, or pages added to an existing document), how many pages it had, and whether it worked;
• the free limit on pages per document was reached, recording how many pages did not end up in that document in all: pages left out or saved in further documents, and any page of the same import that failed to load or save;
• a page was redacted, recording how many boxes were blacked out, how many areas were pixelated, and how many of the app's own suggestions you accepted, never where on the page, what was hidden, or what kind of thing it was;
• a page was filled in, recording how many text lines, dates, marks and initials were placed and, from version 1.20, which adds stamps and a switch that places the same items on every page, how many stamps were placed and on how many pages, never what was typed, the dates themselves, which stamp, where on the page or which pages;
• a page was replaced with a new capture, a picked image or the first page of a picked PDF, recording whether it came from the camera, Photos, Files or Continuity Camera, never which page or what it shows;
• a filter or a turn was applied to pages chosen in Manage Pages, recording which of the two, how many pages changed and how many could not be changed, for example because they carry ink, such as a signature, or were edited or deleted in the meantime, never which filter, which pages or what they show;
• brightness or contrast was changed, recording whether it was done on a page in the editor or on pages chosen in Manage Pages, and how many pages changed, never which of the two was changed, the values, which pages or what they show;
• you answered the review shown after a scan, recording whether you kept the scan, retook it or opened it;
• an export ended, recording whether it completed, failed or was cancelled, its format (PDF, JPG, PNG, TXT, RTF, Word or Excel), whether it went to the share sheet or to Files, whether the whole document or chosen pages were exported, how many pages it had, for a PDF the file size option chosen and whether page numbers were on, whether a password was set (only yes or no, never the password), and whether it carried no watermark, the free version's watermark or your own (never its text);
• the share sheet closed, recording only whether the share was completed, never where it went;
• an export was refused because the free monthly export limit was reached;
• you searched your documents, recorded once per search, saying only whether anything was found, never what you searched for;
• from version 1.20, one or more documents chosen with Select were moved into a folder, out of a folder or to Recently Deleted, recording whether they were moved or deleted and how many documents changed, never which documents, which folder or what they hold;
• the extracted text of a document was opened;
• smart naming finished, recording whether the naming model or Apple's text recognition did the naming, and how it ended: a name was chosen, a fallback name was used, or the model failed;
• the naming model's download started, finished or failed, or the model was removed, recording whether the app started the download on its own;
• the Premium screen was shown, recording what opened it: the upgrade row in Settings, the smart naming row, extracted text, the page limit, the export limit, a locked export format, the upgrade link on the export screen, your own watermark, password protection, or Find Sensitive Text when redacting;
• a purchase was started or completed, recording what opened the Premium screen it came from, even for a purchase that was interrupted and completes later, or, for a purchase that waited for approval or payment, such as one waiting for Ask to Buy approval, only that it completed outside that screen;
• a purchase ended without unlocking Premium, recording why: cancelled, waiting for approval or payment, already owned, not available, or an error;
• a restore of an earlier purchase finished, recording how: restored, nothing to restore, failed, or cancelled;
• the app asked the system to show its rating sheet, recording what earned the ask: a completed scan;
• the App Store's review page was opened from the app, recording whether from Settings, About or the line offered after an export, never anything about a document, and not whether a rating followed;
• one of four settings was changed (the app lock, appearance, iCloud sync, or the default export format), recording which one and its new value: on or off for a switch, or the option chosen, such as PDF;
• the reporting switch was turned off.

PrivateScan on a Mac does not scan with a camera, so a Mac never sends the scanner screen or the two camera scan events. Signing a page sends no event, whether the signature goes on one page or, from version 1.20, on every page.

What reports never carry. Neither usage events nor crash reports carry your documents or any page of them, their images or thumbnails, their names, the text recognized in them, the kind of document the app detects for a scan (such as a receipt, an invoice or a contract), how a page was cropped, the names of your folders, anything you searched for, what smart naming found in a page (such as a vendor, a date, an amount or a name), the naming model's prompts or answers, the links, addresses, phone numbers and dates the app detects in text, your PDF passwords, your watermark text, your signatures or markup, which stamp you placed or the date on it, the brightness or contrast values you set, the names or locations of exported files, which app you shared with, translations, anything you copy, the contents of Apple's diagnostic reports described in clause 8, anything stored in your iCloud, which document, page, folder or photo was involved, which pages of a document were exported, filled in, stamped or changed, which folder documents were moved to, the dates stored with your documents, the text of any error message, or anything you type into the app. The only exception is the part of the app's code a crash report shows, described under Crash reports below. Each report carries the time it happened, so the time of a scan, an import or an export is recorded, but no report says which document it was.

Details on every report. Usage events and crash reports include these details where available: the time it happened, a random identifier for the event itself, the random identifier for the installation, a session identifier, the app's name, bundle identifier, version and build, whether Premium is unlocked, the name and version of PostHog's library, the device's manufacturer and model, the device category (phone, tablet, or desktop on a Mac), the operating system and its version, the screen size, the time zone, whether the device is on WiFi or cellular data, your language setting (the language only, not the region), whether the app was installed from TestFlight or from outside the App Store, and whether it runs on a simulator or on a Mac. The device model is sent as a model name or hardware code, never as the personal name you give your device; on a Mac it is the Mac's hardware code and a general name such as MacBook Pro. Reports also carry markers PostHog's library uses to process them, such as whether the installation has been identified to PostHog, which in this app it never is. Reports never carry your phone number, your Apple Account, or your device's advertising identifier. When PostHog's library first runs in a newer build than the one it last ran in, the update event also carries that earlier version and build; the first time the library runs at all, including after an update from a version without it, it records an install instead.

Crash reports. While reporting is on, the app can report crashes on iPhone, iPad and Mac: a crash is saved on the device and sent the next time the app starts with reporting on. A report of the same kind may also be sent for an error the app catches and chooses to record. It carries the kind of error (for a crash, the name and code of the system signal or exception that ended the app), how it was caught and how severe it was, the number of the thread it happened on, and the stack trace: the list of functions running at the time, in the app and in the system libraries it uses, with their memory addresses, the name of the library each belongs to and, where the device can read it, the function's name, and whether each step is in the app's own code. It shows where in the code the crash happened. So that the trace can be turned back into readable function names, it also carries a description of each piece of program code involved: its build identifier, its size, where it was loaded in memory and, where available, the processor architecture it was built for. The app removes every file path from a crash report before it leaves the device, so a report shows which library and function crashed, never where the app or any file sits on your device. The app removes the error's message from every crash report before it leaves the device, because a message written by the system can quote a value the app was handling, such as the name of a file. The report also carries the details above.

The installation identifier. The random identifier is created by PostHog's library inside the app the first time it runs with reporting on. It is not taken from your device or your Apple Account. It lives in the app's own storage on the device, and PostHog's library marks its files as excluded from device backups. It is not synced through iCloud, so each of your devices has its own. On iPhone and iPad, deleting the app removes it; on a Mac it is removed with the app's data folder, which macOS may keep after the app itself is deleted. After a reinstall that starts with no app data, or a restore from a backup, a new one is created only when reporting next starts. The app never tells PostHog who you are, so PostHog keeps no profile of you, only events under that identifier.

IP address. Every connection to PostHog, like any internet connection, gives PostHog your device's IP address. Our PostHog project is set to discard client IP addresses, so the address is not stored with the reports, and no location is worked out from it or stored. PostHog's library also contacts PostHog to fetch its settings for the app; that request names only our PostHog project, not your installation, and reaches PostHog from your IP address in the same way. When surveys are enabled in a version of the app, the library also asks PostHog whether a survey applies to this installation, whether or not one is then shown; that request carries the installation identifier, the app's version and build, its bundle identifier, the operating system and its version, the device category, the time zone, and the name and version of PostHog's library.

How long they are kept. PostHog keeps these events available to us for seven years, the retention period of PostHog's paid plans, as its events retention page sets out. PostHog describes that period as the window within which events can be queried, not as a date on which they are erased, so we do not promise that reports are deleted when it ends. We may delete data sooner by deleting it from our PostHog project. PostHog handles them under its privacy policy.

Turning them off. You can turn usage events and crash reports off in the app under Settings > Privacy, with the switch Share anonymous usage and crash reports, on iPhone, iPad and Mac. The switch is on when you install the app, and when you first update to a version that has it, unless an earlier choice to turn it off is still on the device, for example after a reinstall, described below. The choice belongs to each device: it is not synced through iCloud with your other settings. Whenever the app cannot read your choice reliably, it treats reporting as off for that start. Turning it off also saves a small record in your device's Keychain that holds only the fact that reporting is off, with no identifier. That record is never synced. Because the Keychain outlives the app, once that record is saved, deleting and reinstalling the app on the same device keeps reporting off until you turn the switch back on. Turning it off while reporting is running stops new usage events at once and, for up to five seconds, tries to send one last event recording that the switch was turned off, together with any reports still waiting on the device; a request already under way can still arrive a few seconds after that. The app then closes PostHog's library and deletes any report that was not sent. While it stays off, the app does not start PostHog's library at all, and a crash that happens while it is off is never reported, even after you turn it back on. Turning it back on removes the Keychain record and resumes usage events straight away; if the app cannot remove the record or save your choice, reporting stays off until it can. Crash reports, and the events recording that the app was opened or sent to the background, may resume only from the next time the app starts. Reports already sent carry no account, only the random installation identifier, which the app never shows you, so we cannot look reports up by account or find the ones that came from your device. Deleting a document, turning the switch off or deleting the app does not remove reports already sent; they stay under the retention terms above. Email support if you have questions about them.

Starts in the background. On iPhone and iPad, when the naming model's download finishes while PrivateScan is not open, the system can start the app in the background to complete it. If the device is locked at that moment, the app does not start PostHog's library and saves nothing about your choice. If the device is unlocked and reporting is on, PostHog's library starts as it does at any other start, so reports already waiting on the device may be sent, events recorded during that start, such as the download finishing, may be sent, and, if it is the first start since the app was installed or updated, the event recording the install or update may be recorded then.

Feedback survey. A later version of the app may show a short, optional survey inside the app, asking for your feedback on PrivateScan. It asks about the app, never about your documents, and every question offers only fixed choices, with no place to type your own words, so an answer cannot carry anything from a document. Answering is up to you, and you can dismiss it. The choices you pick are sent to PostHog with the same random installation identifier as the usage events. Showing the survey and dismissing it are recorded as events too, with the survey's identifier, name, round and, where available, the date that round started, and answers are sent with the survey's questions and whether it was completed; if you dismiss it after answering part of it, the choices you had made are sent with the dismissal. The survey is shown only while usage and crash reports are switched on. The check for whether a survey applies, described under IP address above, may itself be recorded as an event naming the survey rule and its result, and that result may be attached to later reports from the same installation, even when no survey appears. Answers carry no account and are fixed choices that many people share, so we cannot tell which answers came from you, and cannot find or remove them one by one. They stay under the retention terms above.

Earlier versions. Versions of PrivateScan that do not have the Share anonymous usage and crash reports switch, which include version 1.13 and every earlier version, do not include PostHog's library and send nothing to PostHog: no usage events, no crash reports and no survey answers. Everything else in this policy describes version 1.13 as well, and clause 6 notes how earlier versions handled the naming model. Versions older than 1.13 may lack some features described here.

Apple's diagnostic reports

Stored on your device

If the app crashes, Apple's MetricKit framework can also give it a diagnostic report. PrivateScan saves that report on your device, under the same protection as your scans, keeps at most the twenty most recent, and never uploads it on its own; it is separate from the crash reports in clause 7. Device backups can include these reports like any app data. Separately, if you have chosen in your device's settings to share analytics with app developers, Apple may pass crash reports to us under Apple's privacy policy; that choice is yours, made in the system's settings, not in the app.

Purchases

Handled by Apple

Premium features are unlocked with a single purchase processed by the App Store. Apple handles the payment; we never receive your name, payment details or any personal information from the transaction. While usage and crash reports are on, the app counts purchase outcomes anonymously: that the Premium screen was shown, and that a purchase was started, completed, failed or restored, as described in clause 7, never with your Apple Account or payment details.

Sharing and exporting

Only when you choose

Exporting a PDF, sharing a scan, or saving to Files or iCloud Drive happens only when you start it. Where a shared document goes is up to you, and whatever service receives it is governed by that service's own policies. The usage events in clause 7 record that an export or a share ended and how, and whether an export went to the share sheet or to Files, never the document, the file's name or location, or the app that received it. Device backups (iCloud Backup, or a backup to your computer) include PrivateScan's documents the same way they include every app's data, whatever the app's own sync setting; that is your device's setting, not the app's.

Children

No personal information from children

PrivateScan is not directed at children under 13, and we do not knowingly collect personal information from a child under 13. The app needs no account and asks no one for a name, age or email address, and its usage events and crash reports carry no account, only the random installation identifier described in clause 7.

Changes to this policy

Posted here, dated clearly

If this policy changes, the new version will be posted at this address with an updated effective date.

Contact

Talk to a person

Questions about privacy or anything else: support@freedom-terminal.com.