Privacy policy

1. Who we are

This Privacy Policy applies to the Scanter website (scanterapp.com) and the Scanter mobile app for iOS and Android (together, the “Service”).

We act as the data controller under Turkey’s Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the European Union and the United Kingdom, under the General Data Protection Regulation (“GDPR”). Our contact details are in the Contact section.

2. Data we collect

What we collect depends on what you use. Scanning and most PDF editing happen on your device. The categories below are the ones that leave your device or that we receive.

Account: email address, first and last name (optional) and a password. On our servers the password is stored only as a salted hash (bcrypt). If you sign in with Google or Apple, we receive your email address and name from them (Apple may give us a private relay address). For Apple we also keep your Apple user ID and the sign-in token and authorization code Apple issued, which we use to verify your sign-in and to revoke it when you delete your account.

Files: only when you use a server-side conversion or choose to save a file to your cloud storage. See “Your files”.

Ask AI: the text of the question you type. See “Ask AI”.

Usage events: when you complete an operation (merge, split, compress, edit, sign, watermark, rotate, convert, scan) the app tells our server the type of operation and the time, linked to your account. We use this to apply daily limits and ad rewards. It does not include the content of your documents.

Purchases: your plan, subscription status and expiry date, based on information from Apple or Google and RevenueCat. We never receive your card or payment details.

Notifications: if you allow notifications, your push token (Apple Push Notification service or Firebase Cloud Messaging) and the notifications we send you.

Advertising and device data (free version): collected directly by Google’s AdMob SDK inside the app — advertising ID, IP address (approximate location), device and app information, ad interactions and diagnostics. See “Advertising and your choices”.

Server logs: IP address, date and time, requested address, response status and user agent, recorded by our servers for security and troubleshooting.

Support and emails: what you write to us, your contact details, and the emails we send you.

Camera and photos: the app uses the camera to scan and your photo library or files to import images and PDFs and to save results. Scans are processed on your device (Apple VisionKit on iOS, Google ML Kit Document Scanner on Android) and are not sent to us unless you use a feature described in “Your files”.

What we do not collect: your precise location, contacts, calendar, microphone, health data or biometric data. We do not analyze the content of your documents.

3. How we use data

We process your personal data only for the purposes and legal bases below:

To provide the Service (KVKK Art. 5/2-c, GDPR Art. 6(1)(b) — contract): create and secure your account, run the conversions and features you request, manage your plan, subscription and daily limits.

To show ads in the free version (consent where the law requires it, otherwise legitimate interest): ads are served by Google AdMob.

Security (KVKK Art. 5/2-f, GDPR Art. 6(1)(f) — legitimate interest): prevent abuse, apply rate limits, detect fraud, fix errors.

Legal obligations (KVKK Art. 5/2-ç, GDPR Art. 6(1)(c)): keep records required by law and answer lawful requests.

Communication: service emails (verification, password reset, subscription expiry notices) and the push notifications you allow. We may also send occasional product announcements by email; write to privacy@scanterapp.com to stop them.

We do not sell your account information or your files, and we do not use the content of your documents for advertising. The only data that reaches an advertising network is the advertising and device data collected directly by the AdMob SDK, described in “Advertising and your choices”. We do not pass your email address, name, files, scans or Ask AI questions to it.

4. Third-party services

These are the third parties that receive data through the app or our servers. Each acts under its own terms and privacy policy. You can follow the links to read them.

The app does not include analytics or attribution SDKs such as Firebase Analytics, Crashlytics, AppsFlyer or Meta SDKs.

5. Advertising and your choices

The free version of the app shows ads from Google AdMob: banner ads in the document viewer and editor, a full-screen rewarded ad when you open the app (at most once per hour), and optional rewarded ads that you can choose to watch to get one more operation after your daily limit. Premium subscribers do not see ads. The website shows no ads.

AdMob receives the advertising and device data listed in the table above directly from your device. We do not pass your email address, name, files, scans or Ask AI questions to AdMob.

iOS: the app asks for your permission with Apple’s tracking prompt (App Tracking Transparency). If you tap Allow, AdMob may use your device’s advertising identifier (IDFA) to show personalized ads and measure their effect; Apple calls this “tracking”. If you decline, we request only non-personalized ads and the IDFA is not available to the app. You can change this at any time in Settings › Privacy & Security › Tracking.

European Economic Area, United Kingdom and Switzerland: where the law requires consent, Google’s consent message is shown before ads are requested.

Android: you can reset your advertising ID or opt out of ads personalization in your device settings (usually Settings › Google › Ads; the path varies by device).

Version note: the consent prompts described above are introduced by the app update that follows this policy (October 2026). Earlier versions of the app request ads without them. Please update the app, and you can use your device’s advertising settings at any time.

6. Ask AI

Ask AI sends the text of the question you type to our server, which forwards it, together with our own instructions, to Google’s Gemini API to generate the answer. Only the question text is sent — not your documents, scans, images, name or email address.

We do not store your questions or the answers. We only keep a record that a question was asked (your account ID and the time) to enforce the daily limit.

Google processes the question as our service provider under the Gemini API terms (ai.google.dev/gemini-api/terms). Please do not type sensitive information such as identity numbers, health or financial details or passwords into Ask AI. Answers are generated by AI and can be wrong.

7. Your files

On your device: scanning, merging, splitting, compressing, editing, signing, watermarking and rotating PDFs happen on your device. These files are not sent to us.

Conversions on our server: image to PDF, PDF to image, Word, Excel and PowerPoint to PDF, PDF to Word and PDF to PowerPoint run on our server (LibreOffice). The file you choose is uploaded over an encrypted connection and converted, and the uploaded copy is deleted when the conversion finishes. The result is available from a temporary download address and is removed by an hourly cleanup of files older than one hour, so converted files are gone within about one to two hours. The website’s PDF tools work the same way.

Cloud storage: if you are a Premium subscriber you can save files to your cloud storage from the app. They are stored on our servers in Türkiye until you delete them or delete your account. On the free plan, files saved to cloud storage are deleted automatically every night, and if your Premium subscription ends, your stored files are deleted in the next nightly cleanup. Keep a copy on your device.

Converted files and cloud files are delivered from long, random web addresses. Anyone who has the exact address could open the file while it exists, so please do not share these links.

We do not analyze the content of your files and we do not use it for advertising.

8. Retention and deletion

Account data (email, name, password hash, plan, sign-in tokens, notification token): kept while your account exists.

Delete your account: in the app go to Settings › Delete my account. Deletion happens immediately and removes your account, sign-in tokens, cloud files, usage events, notifications and support messages from our systems. If you cannot use the app, send the request at scanterapp.com/delete-account.html or email privacy@scanterapp.com; we complete it within 30 days. We keep a minimal record of the deletion request itself (email address, IP address, date, status) as proof that we handled it.

Uploaded and converted files: deleted within about one to two hours (see “Your files”). Cloud files: see “Your files”.

Conversion log: for each conversion we keep a technical record (job ID, conversion type, original file name, size, status, time and, when the request is linked to your account, your user ID). It never contains file contents. At present it has no automatic deletion date; you can ask us to erase it.

Ask AI: questions and answers are not stored. The record of each question (account ID and time) is kept until you delete your account.

Subscription records: notifications we receive from Apple and RevenueCat about your subscription (transaction identifiers, status, dates) are kept for billing reconciliation and fraud prevention; there is no automatic deletion date at present.

Server logs: web server and application logs (IP address, time, requested address, user agent, errors) are kept for up to 12 months for security and legal obligations, then deleted.

Support messages: kept until you delete your account or ask us to delete them.

Data held by others: deleting your Scanter account removes your data from our systems. Data held by Google (ads, Gemini, push notifications), RevenueCat, Apple and Mailgun follows their own retention rules; you can contact them directly or write to us.

9. Security

Technical and organizational measures we apply:

Traffic between the app or website and our servers is encrypted in transit with HTTPS (TLS 1.2/1.3). This is encryption in transit, not end-to-end encryption: our server processes your file to convert it.

Passwords are stored on our servers only as bcrypt hashes. Sign-in sessions use tokens.

On your device the app keeps your sign-in token in its local storage and, if you turn on “Remember me”, your sign-in details too.

Rate limiting and abuse filters are applied.

No internet service is 100% secure. If a data breach affects you, we will notify you and the relevant authorities (KVKK Board, supervisory authorities) within the legally required time.

10. Children

The Service is not directed at children under 13. The U.S. COPPA rules apply to children located in the United States; GDPR Art. 8 (age 13–16 depending on the EU member state) applies in the EU. We do not knowingly collect personal data from children under 13; if we learn that we have, we delete it promptly.

11. International transfers

Our servers, and the data we hold as described in this policy, are in Türkiye. Some of the providers listed above process data outside Türkiye and outside the EU/EEA: Google (AdMob, Firebase Cloud Messaging, Gemini API, Google Sign-In), RevenueCat and Mailgun (United States), and Apple. For users in Türkiye these transfers are made in line with KVKK Art. 9. For EU/EEA and UK users they rely on adequacy decisions (GDPR Art. 45) or Standard Contractual Clauses (GDPR Art. 46) provided by those companies.

12. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–22 you have the right to:

Confirm whether your personal data is being processed and request access.

Have inaccurate data corrected.

Request erasure (the right to be forgotten).

Object to or restrict processing.

Request data portability in a structured, machine-readable format.

Withdraw any consent you previously gave — for example tracking for ads, in your device settings.

Lodge a complaint with the relevant authority (KVKK Board, your EU supervisory authority).

To use these rights, write to privacy@scanterapp.com. You can delete your account yourself as described in “Retention and deletion”.

13. Cookies and local storage

The website uses only strictly necessary local storage in your browser (your sign-in token). It sets no advertising, profiling or analytics cookies. You can clear it at any time in your browser; you will need to sign in again.

The website loads fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address and browser details to Google when a page opens.

14. App permissions

Camera: to scan documents. Photos and files: to import images and PDFs and to save results. Notifications: optional, only if you allow them. On Android, the Google advertising library also adds the system advertising ID permission.

We do not request location, contacts, calendar or microphone access.

15. Changes to this policy

We may update this policy from time to time. We post the new version here with a new date, and we will tell you in the app or by email about material changes. The “Last updated” date at the top shows the current version.

Version 2.0 (October 14, 2026): rewritten to describe the services the app uses today (advertising, subscriptions, Ask AI, notifications and sign-in), cloud storage, retention periods and your advertising choices. It replaces version 1.0 (June 1, 2026).

16. Contact

You can reach us as data controller at:

Privacy requests: privacy@scanterapp.com

General support: info@scanterapp.com

Web: scanterapp.com

If you are in Turkey, you may also submit KVKK-specific requests using the methods described in our KVKK Disclosure Notice (Turkish only — local law).