Introduction
This Privacy Policy describes how PDFAI Scan ("we," "our," or "us") collects, uses, and protects your information when you use our mobile application and website. We are committed to protecting your privacy and ensuring the security of your personal information.
How We Use Your Information
We use the collected information for the following purposes:
- Core Functionality: To provide document scanning, OCR, and export features
- Cloud Synchronization: To sync your documents across your devices using iCloud
- App Improvement: To analyze usage patterns and improve app performance
- Customer Support: To respond to your inquiries and provide technical assistance
- Security: To detect and prevent fraud, abuse, and security issues
- Legal Compliance: To comply with applicable laws and regulations
Data Processing and Storage
Local Processing
Document scanning, edge detection, and OCR processing occur locally on your device. Except when you explicitly use an AI feature or enable iCloud sync, document content is not transmitted off your device. Optional AI processing and iCloud storage are described below.
Cloud Storage
If you enable iCloud sync, your documents are stored in your personal iCloud account using Apple's CloudKit service. We do not have access to your iCloud data.
AI Content Processing (Optional)
When you explicitly enable AI features and consent to AI content processing, document content may be sent to our trusted AI partners (Google Gemini, OpenAI, xAI, Zapply) for:
- Document summarization and key insights extraction
- Interactive chat with your PDF documents
- AI-powered smart document naming
- Quiz generation and interactive learning
- Flashcard creation for study purposes
- Fun Mode humor-enhanced content (optional)
Important: AI processing is opt-in only. Content is encrypted in transit and handled under each provider's applicable API privacy and retention terms. We do not use your documents to train our own models. You can disable AI processing at any time.
Analytics Data
Firebase Analytics collects app interactions, device and app information, and a pseudonymous app identifier for product improvement and reliability. You can disable usage analytics at any time using Limit Analytics in the app settings.
Third-Party Services
We integrate with the following third-party services:
Firebase (Google)
- Analytics for usage tracking and app improvement
- Pseudonymous authentication for app functionality without requiring a name or email address
- Crashlytics for crash reporting and stability monitoring
- Remote Config for feature management
RevenueCat
- Subscription management and purchase validation
- A pseudonymous app identifier and purchase status for subscription access across devices
Superwall
- Paywall presentation and subscription conversion optimization
- A/B testing for premium feature discovery
Meta (Facebook SDK)
- Marketing attribution and app event measurement only after you authorize tracking through Apple's App Tracking Transparency prompt
- Collection remains disabled when tracking permission is denied or Limit Analytics is enabled
Apple Services
- iCloud for document synchronization across your devices
- App Store for subscription billing and management
AI Content Processing Partners
When you choose to use AI-powered features (with your explicit consent), we may send your document content to trusted AI service providers for processing. This section describes our AI partners and how they handle your data.
Important: AI features require your explicit consent. You can enable or disable AI content processing anytime in app settings. When disabled, these features will not be available.
Google Gemini (Google AI)
- Purpose: Document summarization, Chat with PDF, AI-powered smart document naming
- Model: A Google Gemini model selected for the feature
- Data Sent: Document text content (when you use AI Summary or Chat features)
- Data Retention: Handled under Google's applicable API data-use and retention terms
- Privacy Policy: Google Privacy Policy
- Data Processing: Encrypted in transit via Firebase Cloud Functions
OpenAI (GPT-4)
- Purpose: Alternative AI summarization backend (configurable via Remote Config)
- Models: GPT-4o, GPT-4o-mini
- Data Sent: Document text content (when Gemini is unavailable or when configured)
- Data Retention: Handled under OpenAI's applicable API data-use and retention terms
- Privacy Policy: OpenAI Privacy Policy
- Data Processing: Encrypted in transit, processed via API
xAI (Grok)
- Purpose: Fun Mode content generation (humor-enhanced summaries, flashcards, quizzes)
- Model: An xAI Grok model selected for the feature
- Data Sent: Document text content (only when Fun Mode is enabled)
- Data Retention: Handled under xAI's applicable API data-use and retention terms
- Privacy Policy: xAI Privacy Policy
- Note: Fun Mode is disabled by default and requires explicit user activation
Zapply (Quiz Platform)
- Purpose: AI-powered quiz generation and interactive quiz playing
- Data Sent: Document content and quiz metadata (when you generate or play quizzes)
- Data Retention: Published quiz copies are stored for leaderboard, progress tracking, and public sharing. Deleting the local quiz in the app does not delete or unpublish its Zapply copy, so its public link may remain accessible.
- Privacy Policy: Zapply Privacy Policy
- Features: Quiz generation, leaderboard, progress tracking, social sharing
Your Control Over AI Processing
You have complete control over AI content processing:
- Explicit Consent: AI features prompt for consent before first use
- Granular Control: Enable/disable AI processing in Settings → AI Content Processing
- Per-Feature Control: Choose which AI features to use (Summary, Chat, Smart Naming, Fun Mode, Quizzes)
- Encryption: Data sent to AI providers is encrypted in transit using HTTPS/TLS
- Storage: Source content and generated results may be retained where a feature requires it, such as a published quiz, as disclosed above
- Transparency: Clear disclosure of which AI provider processes each feature
Data Security with AI Partners
We use providers that publish security and privacy practices for their services. Protections and certifications vary by provider and service:
- Transport encryption is used when content is sent for processing
- Access to service credentials is restricted to backend services
- Provider-specific retention and data-use terms are available through the privacy-policy links above
Data Sharing and Disclosure
We do not sell, trade, or transfer your personal information to third parties except in the following circumstances:
- Service Providers: With trusted third-party services that assist in app operation (as listed above)
- Legal Requirements: When required by law or to protect our rights and safety
- Business Transfer: In the event of a merger, acquisition, or sale of assets
- Consent: With your explicit consent for specific purposes
Data Security
We implement industry-standard security measures to protect your information:
- Encryption: Data transmission is encrypted using TLS/SSL protocols
- Local Processing: Documents are processed locally to minimize data exposure
- Secure Authentication: Firebase Authentication with secure token management
- Regular Updates: Continuous security monitoring and updates
- Access Controls: Strict internal access controls to protect user data
Your Rights and Choices
You have the following rights regarding your personal information:
Data Access and Control
- Pseudonymous Data: The app does not require your name or email address, but service providers may store an app-specific identifier and related usage or purchase records
- Local Documents: All your documents remain under your control on your device and iCloud
- Data Portability: Export your documents and data directly from the app
- Deletion: Delete documents in the app or delete the app to remove local data. To request deletion of pseudonymous backend records, contact [email protected]; we will provide the steps needed to verify and locate the request.
Privacy Controls
- Analytics Opt-Out: Disable analytics tracking in app settings
- Location Services: Control location access through iOS settings
- iCloud Sync: Enable or disable cloud synchronization
- Marketing Communications: Opt out of promotional communications
Children's Privacy
Our app is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
International Data Transfers
Your information may be transferred to and processed in countries outside of your residence, including the United States. We ensure appropriate safeguards are in place to protect your information during international transfers, in compliance with applicable data protection laws.
Data Retention
We retain your information for as long as necessary to provide our services and comply with legal obligations:
- Pseudonymous Authentication: App-specific identifiers are retained while needed to provide services, prevent abuse, maintain purchase access, and meet legal obligations
- Documents: Stored locally on your device and in your iCloud (if enabled)
- Analytics and Crash Data: Retained according to configured service-provider retention periods and deleted or aggregated when no longer needed for product improvement, reliability, security, or legal obligations
- Support Communications: Retained while needed to resolve requests, maintain service records, and meet legal obligations
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on our website
- Sending an in-app notification
- Emailing registered users (when applicable)
Your continued use of the app after any changes indicates your acceptance of the updated Privacy Policy.
Regional Privacy Rights
European Union (GDPR)
If you are located in the EU, you have additional rights under the General Data Protection Regulation (GDPR), including:
- Right to object to processing based on legitimate interests
- Right to data portability
- Right to file a complaint with your local data protection authority
California (CCPA)
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of the sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your privacy rights