Where your documents are, and what leaves the phone

Scanning, text recognition and the PDF utilities — merging, compressing, converting, signing — run on your phone’s own processor and in its own memory. Your document is not uploaded to our servers to be processed. You can confirm it: turn on airplane mode and the whole workflow still works.

What does leave the device, when you ask for it: an encrypted backup if you turn on Pro sync, which is uploaded as ciphertext we cannot read; a file you send through the Android share sheet, which goes wherever you point it; and the contents of the contact form if you write to us. Nothing else carries a document.

Pages, thumbnails and finished PDFs are written to the app’s private directory, which Android isolates from every other app on the phone at the operating-system level.

• No other app can read that directory, and ScanOrbit cannot read theirs.
• The document index — titles, page counts, sizes, dates — is stored on the device in MMKV, inside that private directory. It is not in a cloud database.
• Android backup is switched off for this app, so an `adb backup` cannot copy the sandbox off the device.

Edge detection and text recognition use Google ML Kit, which ships its models inside the app and runs inference on the phone. There is no vision API call and no image upload.

• Camera frames are read in memory for edge detection and are not written to disk as originals.
• OCR produces searchable text on the device; the page image never reaches a server to be read.
• PDF assembly happens locally, with the fonts and assets bundled in the app.

The permission list is short because the feature list does not need a long one, and several permissions are blocked outright in the manifest rather than merely left unrequested.

• CAMERA, to capture a document while the scanner is open.
• Photo access, only when you pick an existing image to import.
• Precise and approximate location, and background audio, are blocked in the manifest — not requested, and not requestable.

The honest list, including the parts that are easier to leave out. None of these carries the contents of a document.

• Crash reports and product analytics through Firebase. Analytics is opt-in and off until you switch it on in Settings; events carry counts and categories, never a title, file name or search term.
• Google Play and RevenueCat, to check whether a Pro subscription is active, and Google Sign-In if you use it.
• If you write to us or join the early access list, your message and your IP address, which we resolve to an approximate city to understand where interest comes from. The same happens once on a device’s first launch. The privacy policy names the provider.

The vault, in detail

How the Document Master Key is generated, wrapped under your PIN and a recovery key, and why the server holds only the wrapped copies — written up properly, with the parts that would let you check it.

If you find a security problem, please tell us before you tell anyone else. We will confirm receipt, keep you updated while we investigate, and credit you when a fix ships if you would like us to.