Data Safety Disclosure
This page describes the production data flows that must remain consistent with the Data safety form submitted in Google Play Console.
This page is a preparation aid. The publisher must review the final signed AAB, enabled production services and current SDK disclosures immediately before submission.
User-facing summary
Documents, PDFs, HTML OCR output and signatures stay in app-private storage.
All optional network features use HTTPS. Cleartext traffic is disabled.
No Doc Scanner account, advertising SDK or behavioral analytics SDK is present.
AI OCR sends selected pages only after the user configures a provider and confirms the upload.
Production data-flow matrix
| Feature | Data | Destination | Purpose | User control |
|---|---|---|---|---|
| Scanning and local files | Page images, PDFs, HTML, titles, signatures | App-private storage | App functionality | Delete, permanently delete, clear app data or uninstall |
| ML Kit diagnostics | Device/app information, feature events, performance and error codes | Diagnostics, analytics, maintenance and abuse prevention | Required by the SDK when used | |
| Optional AI OCR | Selected page images, OCR instruction, response, request metadata | OpenAI using the user’s API key | App functionality | Optional; confirmation required for each document job |
| Optional support payment | Amount, currency, payment, transaction, device and anti-fraud data | Stripe (hosted Payment Link) | Payment processing, fraud prevention and legal compliance | Optional; starts only when selected |
| Android sharing | User-selected PDF or HTML file | App selected by the user | User-requested sharing | Optional; explicit system share sheet |
| Product website | IP address and standard HTTP request metadata | Peter’s Engineering web server | Security and service operation | Avoid visiting or contact privacy support |
Play Console worksheet
- Data collection: answer Yes if the release includes ML Kit diagnostics, optional AI OCR or enabled Stripe support.
- Data sharing: classify each provider using Google Play’s current service-provider and sharing definitions; do not assume that an SDK is exempt.
- Photos and videos / Files and docs: disclose optional AI OCR because selected document images leave the device.
- Device or other identifiers and diagnostics: reconcile with the current ML Kit SDK disclosure.
- Financial information: reconcile with Stripe’s current Android SDK and payment-flow disclosure if Stripe is enabled.
- Encryption in transit: Yes for network data.
- Account creation: No. The app has no account system.
- Deletion: local document deletion is available in-app; no developer account data exists.
- Ads: No.
What is not transmitted by the default workflow
Document images and recognized text are not sent to Peter’s Engineering. The free Latin-script OCR path runs on device. Google states that ML Kit does not send input images, text or resulting output to its servers, although it does send SDK metrics described above.
Review trigger
Update this page and the Play Console form before enabling cloud backup, adding analytics or crash reporting, changing AI providers, enabling payments, adding accounts, changing retention, or introducing any new SDK that processes user data.