Timastra PDF Scanner privacy

Your documents stay on your device

Captured or imported images, PDFs, recognized text, titles, folders, tags, annotations, signatures and edit history are stored in the app's encrypted private library using a device-protected key. OCR, filters, image repair and object suggestions run on your device. Timastra does not receive your document content unless you choose to send it to support. The app does not send document images, recognized text or backup passwords to advertising or subscription providers. Small feature and advertising counters are stored locally without document content.

Google Play services provides the optional automatic document scanner and may download components on first use. Google receives ordinary service and technical information under its policies. Standard camera capture uses your chosen camera app. Android's file and photo pickers provide access to files you select; the app does not request broad access to your library, contacts, microphone or location.

Google ML Kit powers on-device text recognition and barcode scanning. Its SDKs collect technical diagnostics and usage metrics, including device and app versions, installation or device identifiers where applicable, feature events, configuration and input/output sizes, latency and error codes. Google uses these metrics for diagnostics and usage analytics and transmits them over HTTPS. These metrics are separate from your document images and recognized text, which are processed locally. See Google's ML Kit data disclosure. The app does not provide a separate switch to disable these SDK metrics.

Share, print and Save a copy send the selected export to the app, printer or storage location you choose. Those recipients have their own policies. Exported copies are outside the encrypted library. Temporary plaintext exports can remain in the private cache until startup cleanup after 24 hours. Android automatic backup and device transfer of private app data are disabled.

Optional Google Drive backups

Drive-enabled versions let you connect a Google account only for optional backup, not subscription sign-in. Google provides your verified email address and account identifier for that connection. The app stores the Drive identity locally in encrypted storage and requests access tokens from Google Play services when needed. It never receives your Google password. Versions 0.6.3 through 0.7.1 disable the integration; the current internal 0.9-series enables it. Password-encrypted portable backup files remain available without connecting Drive. Disabling the integration does not automatically delete earlier configuration or cloud archives.

Drive access uses the drive.file permission for app-created or selected backups, not unrestricted access to all your files. Only when you request a backup, or enable automatic daily backup on unmetered networks, does the app upload a password-encrypted archive of your library to your Google Drive. Automatic daily backup requires verified Premium; manual backup and restore remain available without Premium. Google receives the encrypted file, filename, size, checksums, revision metadata and ordinary network information. Your backup password is not uploaded. Automatic backup keeps the password encrypted on your device. Keep a separate copy of it: Timastra cannot recover a lost password.

Backups are snapshots, not two-way synchronization. Listing and restoring a backup download the encrypted archive and decrypt it locally after you provide the password. Disconnecting cancels scheduled backup and clears the local Drive configuration; it does not delete existing Drive files or revoke Google's grant. You can delete those files in Drive and remove authorization through your Google Account.

Google Play and RevenueCat

Optional Premium purchases are processed by Google Play and verified through RevenueCat, our subscription service provider. Version 0.6.2 and later require no app sign-in for plans, purchases or restoration. RevenueCat generates and caches an installation identifier and receives store purchase and subscription history, product and base-plan identifiers, entitlement and expiry status, and ordinary device and network information. Earlier versions used an app-specific identifier derived from your connected Google account identifier. An upgrade leaves that identified SDK session; existing provider purchase records are retained. Restore purchases uses the Google Play account that owns the purchase and can transfer its access to the current RevenueCat installation identity. Reinstalling can generate a new installation identity. This supports purchase verification, restoration, fraud prevention and subscription analytics. Timastra can view these purchase records and access status. We do not send your email as a RevenueCat subscriber attribute, your documents, OCR text or backup passwords to RevenueCat. We do not receive full payment-card details.

Google Play and RevenueCat keep purchase records as needed to administer purchases, restoration, fraud prevention and their legal obligations. Uninstalling or disconnecting does not cancel a subscription. Manage renewal or request a store refund through Google Play. During testing, use only Google's licensed test payment instruments.

See Google's privacy policy and RevenueCat's privacy notice. Providers process information internationally, including in the United States, under their applicable safeguards. Connections to these services use HTTPS. The app does not pass purchase receipts, your email or document content to AdMob as advertising-targeting attributes.

Advertising and your choices

Ad-enabled versions use Google AdMob (Google Mobile Ads SDK) for a banner in the document library. Ads are hidden for verified Premium and existing lifetime owners, and while purchase status is pending or uncertain. Ads do not appear in capture, editing, export, backup or purchase screens. Advertising availability, no-fill and privacy-form errors do not block local document work.

When the advertising integration is active, Google's SDK may collect and share IP addresses (which can estimate general location), device and account identifiers such as Android advertising ID and app set ID, product interactions and diagnostic information. Google uses this information for advertising, analytics and fraud prevention, subject to applicable privacy choices and SDK behavior. Transfers use TLS encryption. These SDK data flows are separate from your encrypted document library. See Google's Mobile Ads data disclosure and Google's advertising privacy information.

The app checks Google's User Messaging Platform before requesting ads and presents required consent or privacy choices when available. Where required choices cannot be obtained, the app does not bypass that check. When applicable, use Advertising privacy in Settings to review your choices. You can also reset or delete your advertising ID in Android's privacy settings and manage relevant Google Account advertising controls. Your choices may change ad personalization or availability; they do not remove access to your local documents.

Retention and data deletion

Use the library's Delete action and then permanently delete items in Trash to remove local documents. The optional 30-day Trash setting removes eligible trashed items on maintenance. Clearing app storage or uninstalling removes private local data and can permanently lose your encrypted library; export or back up anything you want to keep first. Delete exported files, shared copies and Drive backups separately at their destinations.

Drive-enabled versions provide Disconnect on this device in Backup and restore to clear the local connected-account configuration and stop scheduled backups. Versions with Drive disabled do not use its saved authorization and may preserve prior configuration rather than silently deleting it. You can revoke the grant in Google Account settings and delete cloud archives directly in Drive. These actions do not delete your Google account. Google controls retention of advertising SDK information under its policies; resetting an advertising ID or uninstalling is not a promise that every provider record is deleted.

To request deletion of your Timastra PDF Scanner connected-app profile and associated data, including its RevenueCat customer record, email support@timastra.com with the subject Timastra PDF Scanner data deletion and say that you want the connected profile deleted. You can also request access, correction, export or deletion of selected purchase information or support correspondence without deleting the whole profile. Identify the Google/store account and, if available, a Google Play order ID; never send passwords, access tokens, payment-card details or private documents. You can request this without reinstalling or signing into the app. We may ask for additional non-secret information to locate the profile and verify ownership before deleting it and requesting deletion of associated service-provider data. We explain any records that must be retained for transactions, security or legal obligations. Deleting the profile does not delete your Google account or cancel a Google Play subscription; manage billing separately in Google Play. Deleting purchase records can affect restoration. Local-only documents must be deleted on your device because we do not hold a copy; delete encrypted Drive snapshots separately in Drive.

Support and privacy requests

Email support@timastra.com. Include Timastra PDF Scanner, your app and Android versions, device model and a description of the problem. Redact personal information in screenshots; never send passwords, private backups or authentication codes. We use your message, email address and chosen attachments to respond and keep correspondence as needed to resolve the request and meet applicable obligations. You may request deletion of correspondence.

Timastra PDF Scanner is a general document utility and is not designed for children. We update this notice when the app's data practices change. This page's hosting is covered by the Timastra website privacy notice. See Timastra LLC's company details.