PaperScanner: scan, PDF Maker privacy policy

Who we are

PaperScanner: scan, PDF Maker is published on Google Play by Abdul Majeed, trading as XStudio, an independent developer based in Pakistan. For the purposes of the UK GDPR, the EU GDPR, and comparable laws, Abdul Majeed is the data controller for the personal data described in this policy.

Our registered contact details are:

• Legal name: Abdul Majeed
• Address: Basti Jamal, P/O Notak, Dhandlah, Bhakkar - 30041, Pakistan (PK)
• Email: abdulmajeed564056@gmail.com
• Phone: +923440870564

Scope of this policy

This policy applies to PaperScanner: scan, PDF Maker (com.xstudio.paper_scanner), distributed on Google Play. A document scanner. You capture pages with your camera or pick images from your device, crop and enhance them, and save the result as a PDF. Your scans are processed entirely on your device and are never uploaded to us or to anyone else.

It supplements our account-wide privacy policy. Where the two differ for this app, this page governs.

This website

This website does not run advertising or analytics SDKs and does not use an account system. The project-enquiry form does not submit information to our server: it opens your email application, and your message is sent only if you choose to send it.

Our hosting provider may process ordinary request information, such as your IP address, browser type, requested page, time of access, and security logs, to deliver and protect the site. We use that information only for hosting, security, troubleshooting, and abuse prevention, and retain it according to the applicable hosting settings and policies.

Data we collect

Your photos never leave your device. PaperScanner: scan, PDF Maker reads only the image you choose, edits it on the device, and writes the result back to your gallery. Nothing is uploaded to us or to any third party, and we have no server that could receive it. Photos and media are therefore not listed below.

We treat data as collected when it is sent off your device, including when an integrated SDK sends it to its provider. Data processed only on your device is not collected by us. The categories below are the disclosures that must also be reflected in the app's Google Play Data safety form.

We do not sell personal and sensitive user data for money. Advertising and analytics processing, including any activity that applicable law calls targeted advertising, sale, or sharing, is described below together with the available controls.

How we use data

We use the data described above only for these purposes:

• Providing the app - making features work as described on the store listing.
• Stability - diagnosing crashes and errors so we can fix them.
• Improvement - understanding in aggregate which features are used, so we know what to build and what to remove.
• Advertising - serving ads that keep the app free, and measuring whether those ads worked.
• Support and legal - answering your messages and meeting our legal obligations.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Legal bases

If you are in the UK, the EEA, or another region with comparable law, we rely on these legal bases:

• Contract - to deliver the app and any purchases you make.
• Legitimate interests - to keep the app secure and stable, to prevent fraud and abuse, and to understand aggregate usage. We balance these against your rights.
• Consent - where required for device storage or access, personalised advertising, targeted advertising, or non-essential analytics. Refusing or withdrawing consent does not affect processing already carried out lawfully.
• Legal obligation - where we must retain records, for example tax records relating to purchases.

Device permissions

Android asks for permission before an app can use many sensitive capabilities. We limit permission access to the feature for which it is requested. Where a use of personal or sensitive data may not be reasonably expected, the app must also show a clear in-app disclosure immediately before asking for consent or the Android runtime permission.

You can review and revoke any permission at any time in Settings → Apps → PaperScanner: scan, PDF Maker → Permissions. Android may also auto-revoke permissions for apps you have not opened in a while. If you decline or revoke a permission, the related feature may be unavailable, but unrelated features should continue to work. A privacy policy is not a substitute for any required in-app disclosure or consent.

Advertising

PaperScanner: scan, PDF Maker is supported by advertising. Ads are delivered by Google AdMob and, where mediation is enabled, by the additional networks listed under Partners below.

Data used by advertising

The Google Mobile Ads SDK automatically processes data such as your IP address, which can be used to estimate general location; app launches, taps, ad views, and other interactions; SDK and app performance diagnostics; and device or account identifiers. Depending on the device, settings, consent, and SDK configuration, identifiers may include the resettable or deletable Android Advertising ID and the App Set ID. Google uses this data to deliver and measure ads, limit repeated ads, provide analytics, and prevent fraud and abuse.

Consent and ad types

For users in the EEA, the UK, Switzerland, and other places where consent is required, we use a Google-certified consent management message through the User Messaging Platform (UMP). It explains the purposes and vendors and records your choices before processing that requires consent. Depending on your choices and eligibility, Google may serve personalised, non-personalised, or limited ads. Non-personalised ads can still use contextual information, frequency capping, aggregated reporting, and fraud-prevention data.

Your controls

• Reset or delete your Advertising ID in Settings → Privacy → Ads on your device.
• Turn off ad personalisation entirely in the same screen, or at adssettings.google.com.
• Reopen the app's advertising privacy options, where required, to review or change consent choices.

Google's handling of this data is governed by the Google Privacy & Terms. We do not intentionally configure the advertising SDK to receive your name, email address, synced content, or other directly identifying profile information.

Analytics and crash reporting

Analytics

We use Google Analytics for Firebase to understand app use and improve features. Depending on the SDK version and configuration, it processes app-instance or installation identifiers, device and app information, approximate location derived from IP address, and events such as app launches, screen views, session activity, and feature interactions. We do not intentionally attach your name, email address, or synced content to analytics events.

Crash reporting

We use Firebase Crashlytics to diagnose crashes, non-fatal errors, and application-not-responding events. Reports can include stack traces, relevant app state, device and app metadata, a Crashlytics installation identifier, session data, and breadcrumb events from Analytics. We do not intentionally place note text, financial entries, or other synced content in custom crash keys or logs.

Where the app provides a diagnostics or analytics control, changing it affects future collection and does not delete reports already received. You can also stop future app collection by uninstalling the app and can request deletion as described below.

Paid apps and in-app purchases

PaperScanner: scan, PDF Maker is free and contains no in-app purchases or subscriptions. We process no payments and receive no billing information.

Partners and processors

The providers below receive data for the stated purposes. Some process data for us under service terms, while others, including Google when operating Google Play or advertising services, may determine some purposes independently under their own privacy policies.

If we add or remove a partner, we update this table and the Data safety form before the change reaches the store.

Sharing and disclosure

We do not sell personal and sensitive user data for money. AdMob's processing for personalised or interest-based advertising may be treated as a “sale,” “sharing,” or targeted advertising under some privacy laws. You can exercise the advertising choices described above. Apart from the providers and advertising processing disclosed in this policy, we disclose data only:

• to the providers listed under Partners, to run, secure, and improve the service;
• when the law requires it - for example a valid court order - and then only what is actually demanded;
• to protect our rights, safety, or property, or those of our users, where we have a good faith belief it is necessary;
• as part of a merger, financing, reorganisation, or sale of an app or business, subject to appropriate confidentiality and notice where the law requires it.

International transfers

We operate from Pakistan. Google, Firebase, our hosting provider, and other providers may process data in the United States and other countries where they or their subprocessors operate. Those countries may have different privacy laws. Where applicable law requires a transfer safeguard, we rely on the mechanism made available for the relevant service, such as an adequacy decision, approved contractual clauses, or another lawful transfer mechanism.

Data retention

We keep personal data only for as long as needed for the purposes described here. We consider the app feature, the sensitivity of the data, legal and security requirements, user choices, and the retention controls available from each provider.

• Crash reports - retained according to the active Firebase Crashlytics project settings and deleted when no longer reasonably needed to diagnose and prevent stability problems.
• Analytics events - retained according to the active Google Analytics for Firebase retention setting, then automatically deleted. Aggregated statistics that no longer identify a user or device may be kept longer.
• Advertising data - retained by Google or another disclosed ad provider under its policy and the consent and retention settings that apply to the request.
• Support emails - retained for up to 24 months after the conversation ends, unless a longer period is needed for an active dispute, security issue, or legal obligation.

We may preserve the minimum information necessary to comply with law, prevent fraud or abuse, resolve disputes, or enforce agreements. Google may keep separate Play transaction and account records under its own policy.

Account and data deletion

PaperScanner: scan, PDF Maker does not create an app account or keep synced user content. Delete local app data through Android settings or by uninstalling the app. You may still email us to request deletion of support communications or other data we control, subject to legal retention requirements.

Security

Personal and sensitive data is transmitted using modern encryption such as HTTPS/TLS. We use access controls, provider security features, account protections, data minimisation, and SDK and dependency updates appropriate to the nature of the data. We also require providers handling app data to apply their documented security measures.

No system is perfectly secure. If a breach affects your personal data and creates a risk to your rights, we will investigate and notify affected users and authorities when and within the period required by applicable law.

Children's privacy

PaperScanner: scan, PDF Maker is not directed at children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to abdulmajeed564056@gmail.com and we will delete it.

Your rights and choices

Depending on where you live, you can ask us to:

• Access a copy of the personal data we hold about you;
• Correct data that is wrong or incomplete;
• Delete your data - the “right to be forgotten”;
• Restrict or object to processing based on legitimate interests;
• Port your data to another provider in a machine-readable format;
• Withdraw consent at any time, without affecting processing already carried out.

Residents of California and other US states may, where the law applies, also have rights to know specific data practices, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive data, and appeal a denied request. We do not sell personal data for money. Because some laws may classify personalised advertising disclosures as sale, sharing, or targeted advertising, use the advertising privacy choices described above to opt out. We do not discriminate against you for exercising a privacy right.

To exercise any of these, email abdulmajeed564056@gmail.com. We respond within the period required by applicable law, normally within 30 days. We may verify your identity before acting. If you are unhappy with our response, you may appeal by replying to it or complain to your local data protection authority.

Google Play Data safety

Google Play requires a Data safety form for each published app, including data sent by integrated SDKs. The form for each package must be kept consistent with the app's shipped behavior and this policy. Google Play's technical definitions of “collected” and “shared” may differ from similar terms in privacy law, so the store label may categorise a provider relationship differently without omitting the disclosure here.

We review the declared permissions, SDK versions, provider disclosures, security practices, purposes, optionality, and retention settings before release. If you find a discrepancy between the app, its store label, and this policy, contact us so we can investigate and correct it.

Changes to this policy

We update this policy when our apps, providers, or legal obligations change. The “last updated” date identifies the current version. If a change materially affects how we use personal data, we provide notice in the app or through another appropriate channel before it takes effect where required. We request consent again when required and do not use an updated policy to retroactively override an earlier consent choice or a non-waivable legal right.

Contact us

Questions, requests, or complaints about privacy go to the contact for the developer account:

• Abdul Majeed
• abdulmajeed564056@gmail.com
• +923440870564
• Basti Jamal, P/O Notak, Dhandlah, Bhakkar - 30041, Pakistan (PK)