Privacy Policy

Effective date: 3 November 2026

In short: ScanQ scans, converts, reads and edits your documents on your device. ScanQ has no servers of its own, no accounts, no ads and no tracking. The app connects to the internet only to manage ScanQ Pro subscriptions through Apple and our subscription service provider RevenueCat. Your scans, PDFs, photos, recognized text, signatures and settings stay on your device and are never sent to us or to RevenueCat. The only data that leaves your device is what you choose to share yourself, and your purchase information, which Apple and RevenueCat process when you buy or restore ScanQ Pro.

1. Who we are

ScanQ is published by Emre Keskin, an individual developer based in Türkiye ("we", "us"). For the very limited personal data described in this policy we are the data controller (in Türkiye, the "veri sorumlusu" under KVKK). Contact: plustekno1@gmail.com. You can use this address for every request in this policy, from any country. We have not appointed an EU or UK representative because we do not process personal data of people in those regions other than as described below; you can always contact us directly.

2. Data that stays on your device (we never receive it)

Your documents: scanned pages, imported and converted files (PDF, images, Office, text, HTML, XML and e-invoice files), the PDFs ScanQ creates, thumbnails, titles, folders, favourites and document details such as page count, size, dates, and amounts or merchant names read from receipts and invoices. They are stored in the app's private storage on your device.
Text recognition (OCR): ScanQ uses Apple's on-device Vision framework to recognize text so your PDFs become searchable and text can be copied. Recognition happens on your device.
On-device AI assistant: on devices that support Apple Intelligence, the assistant summarizes documents and answers questions with Apple's on-device Foundation Models. Your document text and questions are processed on your device and are not sent to us.
Markup and signatures: drawings, highlights, form entries and signatures you add are saved into your documents on your device.
Settings and free actions: your preferences (for example App Lock, Show in Spotlight and page size) are stored on your device. The number of free actions you have used is stored in your device's iOS Keychain, so it may remain after you delete and reinstall the app. It contains only a counter.
Widgets, Share extension and Shortcuts: the "Recent documents" widget receives the titles and small previews of your latest documents through an App Group container that only ScanQ and its extensions can read on the same device. Previews of sensitive documents (such as ID cards and bank or payslip documents) are not shown, and the widget shows nothing while App Lock is on. Files you send to ScanQ from other apps with the Share extension or the Shortcuts app are copied into ScanQ on the same device.
Spotlight: document titles and a short text excerpt are added to your device's on-device Spotlight index so you can find documents from Search. You can turn this off in Settings > Show in Spotlight. Nothing is indexed while App Lock is on, and indexed items are removed when you delete a document.
Backups you create: when you export a ScanQ backup, the ZIP file is created on your device and goes only where you choose to save or share it.

Because this data never reaches us, we cannot access, read, recover or delete it for you. You can delete documents in the app, use Settings > Delete all documents, or delete the app. If you back up your device to iCloud or a computer, ScanQ's data may be included in that backup under Apple's terms.

3. Permissions

Camera: used only to scan documents while you use the scanner. Images are processed on your device.
Photos: to import photos you pick them in Apple's photo picker, which gives ScanQ only the photos you select. If you save images to your photo library, ScanQ asks for "add only" permission and cannot read your library.
Face ID / Touch ID: used only for App Lock. Apple handles biometric authentication; ScanQ never receives your face or fingerprint data.

You can change these permissions at any time in iPhone Settings > ScanQ.

4. Data that leaves your device

What you share: when you share, export, save to Files, print, send by email or drag a document out, it goes to the app, service or person you choose, under their own terms. Be careful with sensitive documents such as ID cards.
Apple (App Store and payments): purchases, free trials, renewals, cancellations and refunds are processed by Apple under Apple's privacy policy. We never receive your name, email address, payment card or Apple Account details. ScanQ checks your subscription with Apple's StoreKit and RevenueCat (see below). Apple gives us aggregated, anonymous sales and usage statistics, and crash reports only if you have chosen to share analytics with app developers in iOS Settings.
RevenueCat (subscription management): ScanQ uses RevenueCat, Inc. (USA) to validate App Store purchases, unlock ScanQ Pro (including after you restore purchases or reinstall) and give us subscription statistics such as trial starts, renewals, cancellations and revenue. RevenueCat receives a random, anonymous app user ID created on your device, your App Store transactions (product, price, currency, dates, transaction IDs and storefront country), the app and iOS version, device model and language, and your IP address in its server logs. It does not receive your documents, your name, email address or Apple Account details, and it does not track you across other companies' apps or websites. RevenueCat processes this data on our behalf as our service provider (processor) under its privacy policy and data processing agreement.
Our website: if you open our website (for example this policy or the support page), our hosting provider Netlify, Inc. (USA) processes your IP address and basic request data in server logs to deliver the page and keep it secure. The website uses no cookies, analytics or tracking.
Support emails: if you email us, we receive your email address and whatever you choose to send, and use it only to answer you. Please do not attach sensitive documents.

Apart from RevenueCat's SDK for subscriptions, we do not use any third-party SDKs, advertising identifiers (IDFA) or tracking technologies, and we do not ask for App Tracking Transparency permission. When ScanQ converts web pages, Office or HTML files into PDF, it renders them on your device with network access blocked, so remote content in those files is not loaded.

5. Why we process data and our legal bases

Selling and managing ScanQ Pro through Apple: performance of a contract (GDPR/UK GDPR Art. 6(1)(b); KVKK Art. 5(2)(c); LGPD Art. 7(V)).
Validating purchases and unlocking ScanQ Pro through RevenueCat: performance of a contract (same bases as above).
Subscription statistics through RevenueCat (anonymous app user ID and purchase data, to understand trials, renewals and cancellations): our legitimate interest in running and improving ScanQ (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f); LGPD Art. 7(IX)).
Accounting and tax obligations on aggregated sales: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
Website hosting logs: our legitimate interest in delivering and securing the website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f); LGPD Art. 7(IX)).
Answering your messages: your request and our legitimate interest.

We do not sell or share personal data, do not use it for advertising or profiling, and make no automated decisions about you.

6. International transfers

Apple, RevenueCat and Netlify may process data outside your country, including in the United States, using safeguards such as the European Commission's Standard Contractual Clauses and, for transfers from Türkiye, the safeguards required by KVKK Art. 9.

7. Retention

We keep support emails for as long as needed to answer you and for up to 2 years. Website server logs are kept by Netlify for a limited period under its own policy. Apple keeps transaction data under its own policy. RevenueCat keeps subscription records for as long as our account with it is active, unless we ask it to delete them earlier. We keep nothing else, because we do not receive anything else.

8. Your rights

Depending on where you live, you have some or all of these rights: to know and access the personal data we hold about you, to correct it, to delete it, to receive it in a portable format, to restrict or object to processing, to withdraw consent, and not to be subject to solely automated decisions. You will not be treated differently for exercising your rights.

EU/EEA, UK and Switzerland (GDPR, UK GDPR, FADP): all rights above, plus the right to complain to your data protection authority.
Türkiye (KVKK Art. 11): to learn whether your data is processed and request information, to learn the purpose and whether it is used accordingly, to know third parties in Türkiye or abroad to whom it is transferred, to request correction or deletion and notification of these to third parties, to object to a result against you arising from exclusively automated analysis, and to claim compensation for damage from unlawful processing. You may also complain to the Personal Data Protection Board (KVKK Kurulu).
United States (California CCPA/CPRA and other state privacy laws): rights to know, access, delete, correct and port your data, and to opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; we also honor Global Privacy Control signals. In the last 12 months we collected personal information only if you emailed us (identifiers such as your email address, and the content of your message) or opened our website (internet activity: request IP address in hosting logs), and, if you bought or restored ScanQ Pro, through RevenueCat (identifiers: a random app user ID and IP address; commercial information: your App Store subscription transactions), for the purposes in section 5, and disclosed it only to service providers.
Brazil (LGPD): confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent; you may complain to the ANPD.
Other countries (for example Canada, Australia, New Zealand, Japan, South Korea, India, Singapore, South Africa, Saudi Arabia, the UAE and Israel): you have the access, correction, deletion and complaint rights of your local law, which you can exercise as described here.

How to exercise your rights: email plustekno1@gmail.com. We answer within 30 days (GDPR: within one month, extendable by two months for complex requests; US: within 45 days). Data that exists only on your device can be deleted by you at any time. Purchase records are held by Apple; you can request them at privacy.apple.com. To access or delete your subscription record at RevenueCat, email us your App Store order ID (shown on Apple's purchase receipt email) so we can find the anonymous record that belongs to you.

9. Children

ScanQ is a general-audience app and is not directed to children under 13 (or under 16 in the EEA, or the higher age set by your country). We do not knowingly collect personal data from children. Purchases by minors are handled by Apple's Family Sharing and Ask to Buy controls.

10. Security

Your documents are protected by iOS app sandboxing and data protection, and you can add App Lock with Face ID, Touch ID or your device passcode. Password-protected PDFs you create are encrypted by iOS PDF encryption; keep your passwords safe, because we cannot recover them. Connections to Apple, RevenueCat and our website are encrypted (HTTPS/TLS). No method is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authorities as required by law.

11. Changes

We may update this policy when the app or the law changes. We will post the new version here with a new effective date and, for material changes, tell you in the app or in the App Store release notes.

12. Contact

Emre Keskin, ScanQ · plustekno1@gmail.com