PDF Secure Scan  /  Privacy Policy

Privacy Policy

PDF Secure Scan app · Operated by Appex s.r.o. · Last updated 9 October 2026

PDF Secure Scan does not collect your documents. Scanning, processing, and storage all happen on your device. Your scans, documents, and PDFs never leave it unless you deliberately share or export them, and we have no technical way to see, receive, or recover them. There is no account of any kind.

1. Who we are

PDF Secure Scan is developed and published by Appex s.r.o., a company incorporated under the laws of Slovakia, with its registered address at Vojvodská 3663/12, 040 01 Košice, Slovakia ("Appex", "we", "us", or "our").

This Privacy Policy explains how the app handles information, and what happens to the limited information we receive if you contact us. It should be read together with our Terms of Use.

2. What we collect

We do not collect, receive, store, transmit, sell, or share your documents or any content you create in the app. Specifically, the app does not:

There is nothing here for us to profile, monetise, or hand over.

There is one exception, described below: on Android only, a small pseudonymous record of your free monthly document quota (section 6a). It does not involve anything you scan.

3. What the app stores on your device

Everything the app produces is stored locally, in the app's own private storage area on your device:

This content is stored in an encrypted vault. The 256-bit encryption key is generated on your device on first use and is held in the platform key store — the Android Keystore or the iOS Keychain. The key is never sent to us or to any server, and is never written to the app's ordinary storage or to logs.

Backups work differently on the two platforms. On Android, the app is excluded from system and cloud backup altogether, so neither your documents nor the key are ever copied off the device by a backup. On iPhone and iPad, an encrypted device backup can include both the vault and the key, which is what allows a phone restored from such a backup to open your library again. In neither case does anything reach us: an Apple device backup is between you and Apple, and we have no access to it.

We have no copy of this key and no access to your vault. Nobody at Appex, and no third party, can decrypt your documents.

The flip side of that design: if the key is lost, the documents cannot be recovered by anyone. That happens if you uninstall the app, reset or wipe the device, lose the device, or move to a new device without an encrypted backup that carries the key store. On Android it also happens on every uninstall, because nothing there is backed up at all. There is no password reset and no recovery. Export anything you need to keep.

4. Camera

The app asks for permission to use your device camera, because scanning a page requires it. This is the only permission the app requires in order to work.

Camera frames are processed on the device — cropping, straightening, contrast, and similar image processing all run locally. No image, preview, or frame is transmitted anywhere. The app does not record audio; audio capture is disabled, and the app does not request microphone access.

While the camera screen is open, the app also reads the device's motion sensors (gyroscope and accelerometer) to tell when the phone is moving, so the outline it draws around a page does not lag behind. These readings are used on the device for that moment only; they are not stored and not transmitted, and no permission is needed for them.

You can withdraw camera permission at any time in your device settings. Scanning will then stop working, but documents already stored in the app remain unaffected.

5. When you share or export a document

You can share, send, export, print, or open documents produced by the app. When you do, you choose the destination — an email client, messaging app, cloud storage service, printer, or another app on your device.

At that point the document leaves PDF Secure Scan, and its handling is governed by the privacy policy and terms of the destination you selected. We are not involved in that transfer, receive no copy, and have no visibility into what happens next.

Please consider what a document contains before you send it somewhere, particularly if it holds personal, financial, medical, or confidential information.

6. Purchases

The app is distributed through the Apple App Store and Google Play. Those stores handle the download, and where the app offers paid features, they also handle payment, renewal, and refunds. Apple and Google process information about that under their own privacy policies, as independent controllers — we do not control that processing.

We do not receive or store your payment card details. Any store statistics available to us are aggregated and do not identify individual users.

To keep track of what has been purchased, the app uses RevenueCat, Inc. as a processor. It identifies your device by a random identifier it generates locally on your device — never your name or email address, and there is no sign-in of any kind. A subscription is tied to the store account it was bought with (your Apple ID or Google account); restoring it works through the app store you bought it from, and the app has no way to move it to a different platform.

6a. Free-tier usage record (Android only)

The app is free for up to 5 documents a month, after which it asks you to subscribe for unlimited scanning; the allowance renews at the start of the next calendar month. That limit has to survive reinstalling the app — otherwise it is not a limit. On iOS the device itself remembers, and nothing leaves the phone. On Android it cannot: the secure storage the app uses is destroyed when the app is uninstalled, so the record is kept in Google Cloud Firestore instead, as our processor.

The record contains exactly two things: which calendar month is current, and how many documents you have created in it. It is stored against a key derived from your device, described below. It contains no name, no email address, no file name, and nothing at all about what you scanned.

The key is a SHA-256 hash of your Android device identifier (Settings.Secure.ANDROID_ID) combined with a fixed value specific to this app. That identifier is already scoped by Android to this app alone, and the hash cannot be reversed back to it. We nevertheless treat the key as pseudonymous rather than anonymous: it singles out a device, and under the GDPR that makes it personal data. It is not an advertising identifier, it is never used for advertising, measurement, analytics or profiling, and it is never combined with anything else.

Nothing is written until you save your first scanned document. If you install the app, look at it and remove it again, no record of you exists.

The legal basis is our legitimate interest in enforcing the terms of a free tier that we would otherwise be unable to offer at all. We keep the record for as long as the app is distributed; you can ask us to delete it, as described in section 9. Deleting it resets your monthly usage.

This does not apply on iOS, where no device identifier is collected and no such record is created.

7. If you contact us

If you write to us for support or with a question, we receive what you send: your email address and the content of your message, including any attachment or screenshot you choose to include.

We use that only to answer you and to keep a record of the request. Our support mailbox is provided by Google (Gmail), which processes the message as our email provider and may store it on servers outside Slovakia, under appropriate safeguards.

Please do not send us scanned documents or sensitive content unless it is genuinely necessary for the question you are asking.

The legal basis for handling support correspondence is our legitimate interest in responding to you and, where your message concerns a purchase, the performance of a contract. We keep support correspondence only as long as needed to deal with the matter and to keep a reasonable record of it.

8. Legal bases and your role under data protection law

Because the content you create stays on your device and we have no access to it, we do not act as a data controller or processor for that content. You control it directly, in the app and through your device.

The personal information we process as a controller is: the pseudonymous free-tier usage record on Android (section 6a) and anything you send us by email (section 7). Your documents are not among it, and never have been.

9. Your data protection rights

For the content inside the app, you exercise control directly: you can view, rename, reorganise, export, or delete any document in the app, and deleting the app removes its local data entirely.

To have the Android free-tier usage record (section 6a) erased, write to appex.slovakia@gmail.com and quote the device reference shown in the app, under Subscription. That reference is what lets us find your record — without it, we cannot identify it any more than anyone else can.

For the free-tier usage record and for anything you have sent us by email, and if you are in the EU/EEA or the UK, you have the right to request access, correction, deletion, restriction, or portability, and to object to processing. To exercise any of these, write to us at appex.slovakia@gmail.com. We respond within the period required by law, normally one month.

10. Children

The app is not directed at children under 16. Beyond the pseudonymous Android free-tier record (section 6a) and purchase records (section 6), it collects no personal information from anyone. Younger users should use the app only with the involvement of a parent or guardian, as set out in our Terms of Use.

11. Security

The app relies on the security features of your device and operating system: private app storage, the platform key store, and full-device encryption where your device provides it.

Local encryption protects your documents if someone gains access to the raw files, but it cannot protect them from someone who can already unlock and use your device. Use a device passcode or biometric lock, keep your operating system up to date, and be careful where you export documents.

12. International transfers

Your documents never leave your device, so they are never transferred anywhere.

The limited data described above is processed as follows. The Android free-tier usage record (section 6a) is held in Google Cloud Firestore in the European Union (Google’s eur3 multi-region, Belgium and the Netherlands). Purchase records are processed by RevenueCat, Inc., which may process data outside the EU/EEA, including in the United States, under the safeguards it offers, such as the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. Email you send us is processed by Google (Gmail) on the same basis.

13. Changes to this Privacy Policy

We may update this Privacy Policy, for example if the app gains a feature that changes how information is handled. The current version is always available at this address, and the date at the top shows when it last changed. If a change is material, we will make it clear in the app or on our website.

14. How to complain

If you have a concern about privacy, please contact us first at appex.slovakia@gmail.com.

If you are in the EU/EEA, you can also lodge a complaint with a supervisory authority — in Slovakia, the Office for Personal Data Protection of the Slovak Republic, dataprotection.gov.sk — or with the authority in your country of residence.

15. Contact

Appex s.r.o.
Vojvodská 3663/12
040 01 Košice
Slovakia
appex.slovakia@gmail.com

© 2026 All rights reserved