Timastra QR & Barcode Scanner privacy

Your codes and images

Camera frames and images you choose with the system photo picker are decoded on your device. Code generation also runs locally. Timastra does not receive your camera frames, imported images, decoded code contents, history or contact profile through the app. Camera permission is used only for scanning; you can import an image without granting it. The app does not request access to your address book, microphone or device location. A location code uses the coordinates you enter.

History, favorites, titles, batch sessions (including code values, quantities and labels) and the optional My QR contact profile are kept in app-private storage. Preferences control automatic scan history, clipboard copying, sound and vibration. Created codes, explicitly saved favorites and batch sessions can remain even when automatic scan history is off. Android app backup is disabled. This app is not an encrypted vault; codes can contain passwords or personal information, so protect your device and review content before sharing.

Google Play and RevenueCat subscriptions

In versions offering Timastra Pro, the RevenueCat billing SDK connects when the app starts, using an anonymous billing identifier for this installation. Google Play and RevenueCat process purchase history, product and transaction identifiers, purchase verification information, subscription status and expiry to verify access, renew subscriptions, restore purchases and provide purchase analytics to Timastra. RevenueCat receives technical app and platform information needed to provide billing, including app/SDK versions and network request information. Billing processing is not a switchable app setting; you can use the free scanning tools without buying a subscription.

Google Play handles payment details. Timastra and the app do not receive your card number. We do not send camera images, decoded codes, history, batch contents or your My QR contact profile to RevenueCat or Google Play billing. RevenueCat advertising-identifier collection and optional SDK diagnostics are disabled; no advertising integrations are configured. Billing data is encrypted in transit and processed by RevenueCat as our service provider. See RevenueCat's privacy policy and Google's privacy policy.

Subscriptions renew automatically unless canceled in Google Play. The purchase screen shows the current localized price and billing period before you choose a plan. Use Manage subscription in the app or Google Play subscriptions to manage or cancel. Uninstalling the app or requesting deletion does not cancel a subscription. Saved local batch sessions remain on the device after Pro expires; paid limits and exports require verified active access.

Google ML Kit diagnostics

The bundled Google ML Kit barcode scanner processes images locally. Its Android SDK collects technical diagnostics and usage metrics: device model, manufacturer, operating-system version and available ML hardware; app package and version; per-installation identifiers; performance measurements; API configuration, such as image format and resolution; input/output sizes; feature versions and events; and error codes. These measurements are separate from the images and decoded code contents.

Google uses these metrics for diagnostics and usage analytics. Google states that the collected metrics are encrypted in transit using HTTPS and are not transferred to third parties. The app provides no separate switch to disable SDK metrics. See Google's ML Kit Android data disclosure and Google's privacy policy for its handling and retention practices. Timastra does not operate an app analytics backend or receive these SDK metrics. Advertising in ad-supported updates is described separately below.

Google AdMob ads and privacy choices

Free use in ad-supported updates may show a Google AdMob banner at the bottom of a scanned-code result. Active Timastra Pro removes ads. The app requests non-personalized ads with age-appropriate protections; non-personalized does not mean no data collection. The app does not send code contents, images, logos, searches, CSV files, batch contents or your contact profile in ad requests.

Before advertising setup, an optional age-range choice offers Under 16, 16–17 or 18 or older. Only the range is saved on this device, not your birthday. Google receives corresponding protection flags. Under 16 receives child and under-consent treatment; ages 16–17 receive teen treatment. Not now keeps scanning available without requesting ads for that session. You can change the range in Settings > Ads & privacy.

The Google User Messaging Platform (UMP) checks the required privacy status before ad requests. Where required, it displays consent or opt-out choices. You can reopen available choices in Settings > Ads & privacy, including after activating Pro. Without an age choice, resolved billing status or the required privacy status, the app does not request ads. Scanning and saved codes remain usable when advertising is unavailable.

The Google Mobile Ads SDK and its consent SDK may process your IP address (which may reveal approximate location), app and device information, diagnostics, device or other identifiers and advertising interactions for advertising, measurement and fraud prevention. Google states that its SDK data is encrypted in transit using TLS. These updates remove the Android advertising ID and AdServices advertising ID, topics and attribution permissions; this does not prevent all device or other identifier collection. See Google's Mobile Ads data disclosure and Google's privacy policy for provider handling and retention.

Actions you choose

Copy puts content on your device clipboard, where Android and other apps may make it available. Sharing code text, code images or exports sends the selected content to the app or destination you choose. Opening a link, email, message, phone number or map hands it to another app. Product web search sends the selected value to Google Search in your browser. These actions require your choice; code contents do not open or search automatically.

CSV and JSON history and batch exports are local files intended for your chosen sharing destination, not cloud backup or restore. The app removes its temporary export files after 24 hours when export maintenance runs; files you save or share elsewhere remain under your control at those destinations. Other apps and services apply their own policies. Do not scan or share confidential content without authorization.

Retention and deletion

Local records stay until you delete them. Delete an individual record from its result screen. Clear history in Settings deletes scanned and created history while keeping saved favorites; delete favorites separately. Delete batch sessions from the batch menu; clearing history does not delete batches. Edit or remove your My QR profile on the device. Clearing Android app storage or uninstalling removes the app's private data. Timastra cannot remotely recover or delete local-only records. Delete exported files, screenshots, clipboard copies and shared copies separately at their destinations.

There is no Timastra app account to delete. For billing-data access or deletion, contact support and identify the app and relevant Google Play order number so we can locate the billing record. Do not send payment-card details. We can request deletion of the matching RevenueCat customer record; store transaction records and information needed for legal, tax, fraud-prevention or purchase-restoration obligations may remain under the applicable provider's retention practices. Google controls retention of its SDK metrics and advertising records under its policies; deleting local app data does not assert deletion from Google's systems. You can also request deletion of support correspondence; we may retain correspondence needed to resolve the request or meet applicable obligations.

Support and privacy requests

Email support@timastra.com. Identify the app and describe the issue. Include app/Android versions and device model if useful; redact screenshots and never send passwords, authentication codes or private QR contents. We receive the email address, message and attachments you choose to send, and use them to respond and keep necessary support records. You may request access, correction or deletion of correspondence.

Timastra LLC is the provider. See company details. Hosting of this page and support correspondence are covered by the Timastra website privacy notice. Providers may process information internationally under their applicable safeguards. We update this notice when app practices change.