Privacy policy

1. Who is responsible

Responsible for the TidyScan app and this website:

Silvan Gross
Bühlstrasse 4
8645 Jona
Schweiz
Switzerland
E-mail: hello@tidyscan.org

Please send all privacy questions and requests to this e-mail address.

2. In brief

• Your scanned documents are stored only on your phone, in the folders you choose. TidyScan has no cloud storage of its own.
• No user account, no advertising, no analytics or tracking. We do not sell data.
• Offline naming runs entirely on your phone.
• Only if you switch on AI naming and confirm the notice in the app, the first page of a scan or shared file is sent to Google Gemini to suggest a name. The PDF itself never leaves your phone.

3. Data on your phone

Scans (PDF files), your folders, keywords, settings and the learned corrections (how you corrected sender, document type and folder) are stored only on your device. If you save your own Gemini API key, it is encrypted with a key from the Android Keystore and leaves your device only in requests to Google. Android backups of the app data are switched off.

Uninstalling the app deletes all app data. PDFs you saved in your folders stay there until you delete them.

4. Scanning and offline text recognition

The document scanner (Google Play services) and the text recognition (Google ML Kit) run on your device. The recognised text is used only to suggest name and folder and is not stored.

Files you give to TidyScan via “Share” or “Open with” (PDFs and images, e.g. e-mail attachments) are briefly copied into the app’s own storage on the device, read there and deleted after filing. When saving, TidyScan writes title, sender, document type and keywords into the PDF as document properties. This information is part of the file and visible to anyone you pass the PDF on to.

According to Google, these components send technical data to Google for diagnostics and usage analytics, such as device model, Android version, app version, performance metrics and error codes (ML Kit data disclosure). TidyScan has no access to this data.

5. Optional AI naming (Google Gemini)

AI naming is off by default. Only when you switch it on and agree to the notice in the app, the following is sent for each scan and each shared file: a reduced image of the first page, the text recognised on it, and the names and keywords of your folders. Google Gemini returns a suggestion for sender, document type, topic, date and folder.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching AI naming off in the app.

Without your own key: via the TidyScan server

The request goes through the TidyScan server (Google Cloud Functions, region Zurich, Switzerland) to the Gemini API. The server forwards the content and does not store it. It stores only:

• a random, anonymous user ID (Firebase Anonymous Authentication),
• your plan, the number of AI scans per month and any extra scans,
• Google Play purchase tokens and product IDs, to verify subscriptions and purchases.

TidyScan uses the paid tier of the Gemini API. Under the Gemini API Additional Terms, Google does not use the content to improve its products. Google logs requests and responses for a limited period, solely to detect abuse and for legal obligations.

With your own Gemini API key

The request goes directly from your phone to Google; the TidyScan server is not involved. The terms of your key apply. Please note: for users outside Switzerland, the EEA and the United Kingdom, Google may use content sent with a key in its free tier to improve its products, and human reviewers may read it.

6. Subscriptions and purchases

Payments are processed by Google Play under Google’s terms. TidyScan never receives your payment details. To activate your plan, the app sends the purchase token to the TidyScan server, which checks it with the Google Play Developer API.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

7. Server, security and logs

All connections are encrypted (HTTPS). The database (Cloud Firestore, region Zurich) cannot be accessed by apps directly, only by the server. Firebase App Check with Google Play Integrity checks with Google that requests come from the genuine app.

Technical logs (time, anonymous user ID, error messages, never document content) are kept by Google Cloud for about 30 days for operation and troubleshooting. Legal basis: legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

8. Service providers and transfers abroad

TidyScan uses Google as service provider: Google Cloud and Firebase (server, database, anonymous sign-in, App Check), the Gemini API (AI naming) and Google Play (distribution and payments). The server and the database are located in Zurich. Gemini requests may be processed in Google data centres in other countries, including the USA.

Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework (list). Switzerland and the EU recognise this framework as providing adequate protection. More: Firebase privacy, Google privacy policy.

9. How long data is kept

• Document content sent for AI naming: not stored by TidyScan (for Google see section 5).
• Server record (anonymous ID, plan, counters, purchase tokens): as long as you use TidyScan, or until you ask us to delete it.
• Technical logs: about 30 days.
• E-mails to us: as long as needed to answer them.

10. Delete your data

• On your phone: uninstall TidyScan. This removes all app data and your own Gemini key. Your saved PDFs stay in your folders.
• On the server: write to hello@tidyscan.org with the subject “Delete data”. If you had a subscription or bought scans, include the order number from your Google Play receipt (it starts with GPA.) so that we can find your record. We delete it within 30 days and confirm by e-mail.
• Subscriptions: uninstalling does not cancel them. Cancel in Google Play: profile picture → Payments & subscriptions → Subscriptions.

11. This website

This website uses no cookies, no analytics, no tracking and no external fonts or scripts. It is hosted by GitHub Pages (GitHub, Inc., USA). To deliver the pages and protect against attacks, the host processes technical data such as your IP address (privacy statement of the host). If you write to us by e-mail, we use your message only to answer it.

12. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object. You can withdraw your consent at any time with effect for the future. Write to hello@tidyscan.org.

You may also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.

13. Children

TidyScan is intended for adults. Google allows the use of the Gemini API only from the age of 18. We do not knowingly process data of children.

14. Changes

We update this policy when the app, our service providers or the law change. The current version is always available on this page; the date at the top shows the last change.

15. Legal notice

TidyScan is a product of
Silvan Gross
Bühlstrasse 4
8645 Jona
Schweiz
Switzerland
E-mail: hello@tidyscan.org