Privacy Policy

You can use Scanily’s core local features without an account. If you create an account, we process your email address, name, email-verification status, optional profile picture, authentication identifiers, session information, IP address, user-agent, and Premium status to provide and secure the service.

By default, scans, OCR text, and saved signatures remain only on your device. A document leaves your device only when you enable Cloud Sync, explicitly send it by email, or share or export it using a destination you choose.

Premium users may enable Cloud Sync. When enabled, your document files are encrypted on your device using AES-256-GCM before being uploaded, and they are stored on our servers only in that encrypted form.

Scanily is not end-to-end encrypted. We hold your encryption key on your behalf, which means we are technically able to decrypt your documents. We do this so that you can restore your library on a new device — an encryption key only you held would make your documents unrecoverable the moment you lost it. We do not access the contents of your documents except where necessary to operate the service or where required by law.

Document metadata — including title, tags, page count, document type, and parent-document relationship — is encrypted inside the document manifest before upload. Technical synchronization data such as object identifiers, encrypted-file paths, sizes, checksums, change sequence, deletion state, device identifier, and sync cursor remains unencrypted so the service can synchronize files, enforce quotas, resolve conflicts, and process deletion. Text extracted by OCR is never uploaded by Cloud Sync and stays on your device.

Sync is opt-in and can be disabled at any time from Settings. Disabling sync does not delete your cloud copies; you can remove them by deleting your account.

We use data to authenticate you, secure the service, manage Premium access, synchronize documents when you enable Cloud Sync, deliver documents you explicitly send by email, process account deletion, prevent abuse, provide support, and diagnose failures. We do not sell your data or use it for advertising.

When you explicitly use Send to Email, the recipient address, document name, attachment filename, and document attachment pass through Scanily’s API to Brevo for delivery. Scanily does not keep a persistent recipient or document-delivery log in its database. It stores only a rolling send count and reset time to enforce usage limits. Brevo may retain delivery information under its own retention policy.

Scanily uses Sentry for error monitoring. A diagnostic report may include an error message, stack trace, app version, operating-system and device information, timestamp, request or user identifier, and limited operation context. We do not intentionally attach scanned files, OCR text, signatures, or encryption keys to diagnostic reports.

We rely on providers only to operate Scanily: Vercel (website and API hosting), Neon (database hosting), Cloudflare R2 (encrypted document storage), Upstash (session caching and rate limiting), Brevo (transactional email and requested attachments), Chargily (payments), Sentry (error monitoring), Google and Apple (optional social sign-in), and Google ML Kit (on-device OCR).

Signing in sets a single session cookie so that we can keep you signed in. We do not use advertising or analytics cookies.

Where Premium purchasing is separately available on the web, payment processing is handled by Chargily. We do not receive or store complete payment-card details. We store the Chargily checkout identifier, purchased plan, amount, currency, payment time, and Premium period end date to activate access, prevent duplicate processing, reconcile payments, and provide support.

Your account data and cloud objects are retained while your account is active. Turning Cloud Sync off stops future synchronization but does not delete existing cloud copies. You can delete your account from Settings in the app or from the account deletion page on this site. Deletion removes your account, active sessions, Premium entitlement, Scanily payment records, wrapped encryption key, sync metadata, and cloud-stored document objects. Chargily, Brevo, Sentry, and infrastructure providers may retain information under their own configured periods or legal obligations.

For privacy enquiries, contact us at support@scanily.net.