Privacy Policy

1. Summary

For the purposes of the EU and UK General Data Protection Regulation, BZOTech is the controller of the limited personal information described in this policy. If you have questions, contact us at [email protected].

2. Information processed only on your device

The following information stays on your device. We do not receive it:

ID cards and driver licenses are always processed on your device only, including when Smart cloud analysis is turned on.

3. Device permissions

We ask for each permission only when you use the feature that needs it. You can change permissions at any time in your device settings.

• Camera: to scan documents. The App does not record audio.
• Photos and videos: to find duplicate, blurry and large files, and to save documents you export. Analysis happens on your device. If you grant limited access, only the photos you select are scanned.
• Face ID / Touch ID / biometrics: to unlock the Vault.
• Notifications: for scan reminders and app notices.
• Media management (Android, optional): if you enable it, the App can move photos to the Recycle Bin without asking you to confirm each one.
• Folder access (Android): you choose the folders the App may scan for junk files.

4. Optional Smart cloud analysis (AI)

DocuNeat uses a hybrid AI approach:

• On-device AI (always on): OCR, keyword-based categorization and photo-quality analysis run on your device.
• Smart cloud analysis (optional, off by default): for complex documents such as bills, receipts and contracts, the App can use Google Gemini through Google Firebase AI Logic to extract fields, suggest tags and categories, and write a short summary.

What is sent, and only after you turn the feature on in Settings → AI:

• a compressed copy of the document pages and the recognized text, when a supported document is analyzed;
• the recognized text, when you use Smart Re-scan;
• your search phrase, when you run a multi-word natural-language search in the Vault.

What is never sent: your photo library, ID cards, driver licenses, your encrypted original files, your PIN or your encryption key.

How it is protected: data is sent over an encrypted connection (TLS). Firebase App Check verifies that requests come from the genuine App. Google processes this content on our behalf to return the result. Under the paid-service terms we use, Google does not use it to train its models. We do not store this content on our own servers. Google's handling is described in the Gemini API Terms and the Google Privacy Policy.

You can turn Smart cloud analysis off at any time in Settings → AI. After that, documents are processed on your device only. AI results may be inaccurate. Always review extracted information before relying on it.

5. Third-party services

We use a small number of service providers. Each one receives only the data it needs and handles it under its own privacy policy.

5.1 Appodeal (advertising; free version only)

The free version shows ads through Appodeal, Inc. and its advertising partners. To show, measure and limit ads, and to prevent ad fraud, they may collect:

• your device's advertising identifier (IDFA on iOS, only with your permission; Google Advertising ID on Android);
• device information (model, operating system, language, screen size) and network information, such as your IP address and the approximate location derived from it;
• how you interact with ads (impressions, clicks, rewarded-ad completions).

Advertising partners never receive your photos, videos or documents.

Your choices: on iOS, you can allow or refuse tracking in the App Tracking Transparency prompt, or later in Settings → Privacy & Security → Tracking. On Android, you can reset or delete your advertising ID in Settings → Google → Ads (or Settings → Privacy → Ads). Where the law requires it (for example in the EEA, the UK and some US states), we ask for your consent before personalized ads are shown. You can change your choice in Settings → Ad privacy choices. Premium removes all ads.

Appodeal Privacy Policy: appodeal.com/privacy-policy

5.2 RevenueCat (purchases and subscriptions)

Premium is sold through the Apple App Store or Google Play. We use RevenueCat, Inc. to confirm and restore purchases. RevenueCat receives your store purchase receipt and transaction history, an anonymous app user ID, and basic device information (platform, App version, country/currency). We never receive your payment card details, which are handled by Apple or Google.

RevenueCat Privacy Policy: revenuecat.com/privacy

5.3 Google Firebase (notifications, app security, cloud AI)

• Firebase Cloud Messaging gives your device a push token so we can send you notices. Scan reminders are scheduled on your device.
• Firebase App Check uses Play Integrity (Android) or App Attest / DeviceCheck (iOS) to confirm requests come from the genuine App.
• Firebase AI Logic / Gemini, as described in Section 4.

Google Privacy Policy: policies.google.com/privacy

5.4 Apple and Google

Your use of the App Store or Google Play, including payments and subscriptions, is covered by Apple's and Google's privacy policies.

6. Legal bases (EEA / UK users)

Where the GDPR or UK GDPR applies, we rely on:

• Performance of a contract: to provide the App and any subscription you buy;
• Consent: for Smart cloud analysis, personalized advertising and tracking (iOS), and notifications. You can withdraw consent at any time;
• Legitimate interests: to keep the App secure (App Check), prevent fraud, and show non-personalized ads in the free version.

7. Data retention

• On your device: data stays until you delete it in the App or uninstall the App. Items moved to the Recycle Bin are permanently deleted after 30 days.
• Smart cloud analysis: content is processed to return a result. We do not keep it on our own servers. Google may keep it for a limited time under its terms, for example for abuse monitoring.
• Third parties: Appodeal, RevenueCat and Google keep data according to their own retention policies.

8. Your rights and choices

Depending on where you live (for example under the GDPR, the UK GDPR, or the CCPA/CPRA and other US state privacy laws), you may have the right to:

• know and access the personal information held about you;
• correct or delete it;
• object to or restrict certain processing, and withdraw consent;
• data portability;
• opt out of the "sale" or "sharing" of personal information for targeted advertising;
• not be discriminated against for using these rights.

How to use your rights and delete your data

1. Delete your local data: delete documents in the App, empty the Recycle Bin, or uninstall the App. Uninstalling permanently removes the Vault and its encryption keys.
2. Stop cloud processing: turn off Smart cloud analysis in Settings → AI.
3. Limit advertising: use Settings → Ad privacy choices, your device's tracking/advertising-ID settings, or upgrade to Premium.
4. Data held by third parties: email [email protected] with the subject "Privacy request". Because the App has no accounts, we may ask for your App Store or Google Play order number (found in your purchase receipt email) so we can find the related records. We will reply within 30 days (45 days where the CCPA applies) and pass deletion requests on to our service providers where applicable.

You may also lodge a complaint with your local data-protection authority.

9. California privacy notice

This section supplements the policy for California residents under the CCPA as amended by the CPRA. In the past 12 months, the categories of personal information processed through the App's service providers were:

• Identifiers such as advertising IDs, an anonymous app user ID, push tokens and IP address (sources: your device; purposes: ads, purchase verification, notifications, security);
• Commercial information such as store purchase receipts and transaction history (source: Apple or Google via RevenueCat; purpose: providing and restoring Premium);
• Internet or other electronic network activity such as ad impressions and clicks (source: your device; purpose: showing, measuring and limiting ads);
• Approximate geolocation derived from IP address (purpose: ad delivery and fraud prevention).

We do not collect sensitive personal information for the purpose of inferring characteristics about you. Biometric data never leaves your device's operating system.

We do not sell personal information for money. Showing ads through Appodeal in the free version may count as "sharing" for cross-context behavioral advertising under California law. You can opt out using the choices in Section 8. We honor Global Privacy Control signals where required.

10. Security

We use AES-256 encryption for Vault files, an encrypted SQLCipher database for document details, the iOS Keychain / Android Keystore for keys and your PIN, biometric locking, TLS for all network traffic, and App Check for cloud requests. No method is 100% secure. Please keep your device and your PIN safe. If you forget your PIN, we cannot recover your Vault. See our Support page.

11. International transfers

Our service providers (Google, Appodeal, RevenueCat) may process data in the United States and other countries. Where required, these transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Children

DocuNeat is not directed at children under 13 (or the minimum age in your country, such as 16 in parts of the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. If the changes are significant, we will also tell you in the App.

14. Contact

BZOTech, developer of DocuNeat
Email: [email protected]
Website: https://docuneat.bzotech.com