
Scanday Privacy Policy
Effective 1 November 2026
On this page
- The short version
- Information that stays on your device
- Information we do not collect
- Purchases and RevenueCat
- Analytics and crash reports
- App updates
- If you write to us
- Why we use information
- Children
- How long information is kept
- Security
- Protection by the companies we use
- International transfers
- Your rights
- Do Not Track
- Changes to this policy
- Türkiye'deki kullanıcılar için (KVKK)
- Usuários no Brasil (LGPD)
This Privacy Policy explains how Scanday (the "app") handles information. The controller is Mobixify LTD ("we", "us"), the publisher of Scanday, company number 16138122. Contact: info@mobixify.com. Company information: mobixify.com/company/. We handle the personal data described here under the UK GDPR and the Data Protection Act 2018. If you use the app in Türkiye or Brazil, the last two sections of this policy explain it in Turkish and Portuguese for you.
The short version
- You do not need an account. The app never asks for your name, e-mail address or phone number.
- Your documents stay on your device. Your scans, imported photos and files, PDFs, JPG exports, library and saved signature are stored in the app on your device. The app does not upload them and we do not receive them. A document leaves your device only when you share it or save it somewhere yourself, or when your device's own backup includes the app's data (see below).
- The app uses Google Firebase Analytics and Crashlytics, with no name, e-mail address, account or advertising identifier, and never with the content of your documents. The app asks for your consent in the EU and EEA and related territories, Gibraltar, Guernsey, Jersey, the Isle of Man and Quebec, and for usage statistics also in Türkiye: there that service stays off until you agree. Elsewhere both are on and the app tells you once. Each has its own switch in Settings. Turning off usage statistics stops them at once; turning off crash reports takes full effect when you restart the app. See Analytics and crash reports below.
- Each time the app starts, it checks whether a newer version is in the store and whether the update is required. It asks Apple (iPhone) or Google Play (Android) and our own server, api.mobixify.com. The request to our server carries no identifier, account, usage event or personal content. See App updates below.
- The app shows no advertising and has no attribution or tracking service, and it does not use your device's advertising identifier. If a later version adds advertising, that version comes with an updated version of this policy.
- Purchases are handled by Apple or Google, and by RevenueCat, which receives a random app user ID (not linked to your name) and your purchase status.
- You can ask us about your data at any time at info@mobixify.com.
Information that stays on your device
The app works on your device and keeps its data there.
- Documents. Your scans, the photos and files you import, the PDFs and JPG images you make, and the changes you make to their pages (crop, rotate, reorder, delete) are stored in the app's own storage on your device. The app has no account and no cloud. It does not upload them to us or to any service, and no usage event or crash report carries a document, an image or a file name.
- Library. The names of your documents, what you type to search them, and your rename and delete actions stay in the app's database on your device.
- Saved signature. If you use the signature tool (Pro), the signature you draw is stored in the app on your device so that you can use it again. The app places it on the page of a PDF when you tell it to. It is not sent anywhere.
- Settings, daily free use and Pro status. Your settings, the count of your free merge or split of the day (kept on your device, not on a server) and the app's copy of your Pro status stay on your device. The Pro status itself comes from RevenueCat, see Purchases and RevenueCat below.
- Scanning on iPhone. The app uses the document scanner built into iOS (Apple's VisionKit). iOS asks you for permission to use the camera, with the message "Scanday uses the camera to scan your documents. Pages stay on your device." The app uses the camera only inside this scanner. You can change the permission at any time in your device settings.
- Scanning on Android. The scanner is Google's ML Kit Document Scanner, which runs inside Google Play services on your device. It brings its own camera screen, so the app itself does not hold the camera permission. Google Play services downloads the scanner component the first time you scan, so that first scan needs an internet connection once. Google handles that download under its own terms and the Google Privacy Policy. The scanner processes the pages on your device, and the app keeps the finished pages in its own storage. Google states that ML Kit, the software behind the scanner, also sends Google diagnostic and usage data about how it works, such as the device make, model and operating system version, the app's package name and version, a device or installation identifier, performance figures, settings such as image format and resolution, the size of the input and output, event types and error codes. Google's software sends this over an encrypted connection, and Google states that it does not pass it on to third parties and handles it under the Google Privacy Policy. Google states that the scanner works entirely on the device, that ML Kit does not send your pages or the scanned results to Google, and that Google uses the diagnostic and usage data to measure performance, to debug, maintain and improve ML Kit and to detect misuse or abuse. It does not come to us. Scanning may not work on a device that has no Google Play services.
- Photos and Files. When you import, the app uses the system picker of your device (the photo picker, or the document picker on iPhone and the file picker on Android). The app asks for no permission to read your photo library or your files, and it sees only the photos and files you pick. When you save to Files, the system save sheet or save dialog opens and you choose the place.
- Sharing. When you tap share or save, the file you chose goes through the system share sheet or the system picker to the app or place you choose. We receive nothing. After you share a file, the policy of the app or service that receives it applies.
- Pages of our website. The Terms, the Privacy Policy and the company information page open as pages of our website in a browser view inside the app when you tap them. Support is not a web page: it opens your e-mail app with a message to info@mobixify.com (see If you write to us). Opening a page is an ordinary visit to our website, which is covered by the privacy policy of our website.
If you use a device backup such as iCloud Backup or the backup of your Android device to your Google Account, the backup may include the app's data, which can mean your documents, library and saved signature. The operating system makes the backup, not Scanday, under your device's backup settings and Apple's or Google's terms. We do not receive it, and the app has no backup or cloud of its own. If you restore a backup on a new device, the app's data may come with it.
Information we do not collect
We do not collect your name, e-mail address, phone number, precise location or contacts, and we do not collect your device's advertising identifier. We do not collect your documents, scans, images, file names or saved signature. The app contains no advertising or attribution service. Besides the purchase and technical information described below, the app sends the analytics and crash information described under Analytics and crash reports below, and the store update check described under App updates below. On Android, Google's own scanner software also sends Google the technical data described under Scanning on Android; it does not come to us. The app sends nothing more. The app does not track you across apps or websites of other companies and does not show the App Tracking Transparency prompt.
If you have chosen in your device settings to share diagnostics with app developers, Apple or Google may give us aggregated crash and usage statistics through their developer tools. The operating system produces them, not code in the app, and they do not identify you to us.
Purchases and RevenueCat
The app is free to start, and scanning is free. Pro tools can be bought in three ways: a monthly subscription; a yearly subscription that starts with a 7-day free trial for new subscribers; or a one-time lifetime purchase. Only the yearly plan has a free trial.
- Apple and Google. Payments are processed by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. On Android, the Google Play Billing library that the app uses for Google Play purchases also sends technical diagnostics about how it works to Google, even if you never buy anything. Google's software sends this, and Google handles it under the Google Privacy Policy. We never see your card or payment details. See the Apple Privacy Policy and the Google Privacy Policy.
- RevenueCat. We use RevenueCat (RevenueCat, Inc.) to check purchases, unlock Pro and restore purchases. The app contacts RevenueCat when it starts, even if you never buy anything. The RevenueCat software in the app creates a random app user ID that is not linked to your name or e-mail address. RevenueCat receives that ID, your purchase history for the app (products, dates, prices, currency and subscription status), the app version, your device type and operating system, and your IP address. On iPhone it also receives your device's tracking setting, which the app only reads and never changes. RevenueCat uses your IP address to work out your country and, according to its documentation, does not keep the address afterwards. We use this information to give you Pro, to prevent fraud and to understand sales in aggregate. RevenueCat acts as our processor under a data processing agreement and stores data on servers in the United States. See the RevenueCat Privacy Policy.
If you ask Apple or Google for a refund, RevenueCat sends them, on our behalf, information about that purchase (for example, that it was delivered) and our refund preference, so that they can decide the request. We do this only with your consent, given in the Terms. You can withdraw it at any time by writing to us.
Analytics and crash reports
Scanday uses two services from Google: Firebase Analytics, which counts how the app is used, and Firebase Crashlytics, which reports crashes. We use them to understand how the app is used and to find and fix crashes. The app uses no other Firebase service (for example, no Firebase Authentication), no other analytics software, and no advertising or attribution service.
- Your choice. Analytics and crash reports have two separate switches. On the consent screen they are "Usage statistics" (Google Analytics) and "Crash reports" (Firebase Crashlytics); in the app's Settings they are "Share usage statistics" and "Share crash reports". In every region you can turn each on or off by itself. Where the app asks for your consent (see Where the app asks below), the service is off until you agree, and you can withdraw your consent at any time with the same switch. Everywhere else both are on by default, and you can turn either off with its switch. Analytics and crash reports are optional, and the app works the same without them. Switching them off does not affect what was sent before.
- Where the app asks. The app decides this on your device, from your region setting and your time zone, not from your IP address. It reads the two separately, and when they point to different rules, the stricter one applies to each service. It asks for your consent, and the service stays off until you agree, when your region or time zone points to the EU or EEA or a related territory (overseas territories included), Gibraltar, Guernsey, Jersey, the Isle of Man or Quebec; when your region setting is Canada but your time zone is not a Canadian one or cannot be read, because Quebec cannot be ruled out; and when it can read neither. For this, any European time zone counts, except those of the UK, Switzerland, Türkiye, Russia and Belarus; for Quebec, the time zones of Montréal and Toronto count, and that also covers most of Ontario. In Türkiye it asks for usage statistics only. In the UK, Switzerland, the rest of Canada and everywhere else, and for crash reports in Türkiye, it does not ask: the services concerned are on, a one-time notice tells you (see The notice below), and each has its switch in Settings.
- The consent screen. Where the app asks, it shows the screen after you have made your first document, and always before any usage event or crash report is sent. It also appears when you try to switch on a switch in Settings that is waiting for your consent. The screen is titled "Your privacy choices", with the sections "About your data" and "Choose what to share". The information and the consent are under separate headings, and the information part links to this policy. The switches start off. In Türkiye the screen has the usage statistics switch only, and its information links to the Turkish section of this policy. "Reject all" and "Accept all" are equally prominent, next to "Save my choices". Closing the screen counts as "Reject all". The app works the same whatever you choose. When your region setting is Türkiye or your time zone is Istanbul, the screen is in Turkish, whatever language the app uses, and states the basis: "KVKK m.5/1 uyarınca açık rıza" (explicit consent under KVKK Art. 5(1)). Your device keeps a record of your choice for each purpose, the time, the version of the text and your region. The screen appears again only when a new version of its text adds a new purpose.
- The notice. Where the app does not ask, it shows one short notice with a link to this policy and a button to open Settings. It says that usage statistics (kept 2 months) and crash reports (kept 90 days) are on, and that you can turn either off in Settings at any time. It does not block anything. No usage event or crash report is sent before the notice has been shown, and the services start once it has. In Türkiye the notice for crash reports is in Turkish, states its basis (legitimate interest, KVKK Art. 5(2)(f)) and links to the Turkish section of this policy.
- When you turn a switch off. Usage statistics stop sending straight away, and the analytics data held on your device is reset. For crash reports, the reports waiting to be sent are deleted, and the switch takes full effect when you restart the app: a crash that happens in between can still be reported. Crash reports that the app collected on your device before you agreed are never sent, even after you agree. Where the app tells you instead of asking, no usage event or crash report is sent before the notice has been shown.
- What identifies you, and what does not. The app has no sign-in, so we set no user ID and the information holds no name, e-mail address or account. The app does not use or collect your device's advertising identifier. Google signals, ads personalization and the collection of user-provided data are off, every data-sharing setting of our Google Analytics account is off, and our Firebase project is not linked to Google Ads, AdMob, BigQuery or Google Play.
- Two properties. Firebase Analytics attaches two properties to what the app sends: whether it is a store build or a test build, and whether you are on the free plan, in a free trial or have Pro.
- Events. The app sends an event when the Pro screen is shown and when it is closed; when you reach a feature that needs Pro, with the name of the feature; when the plans load, with whether they loaded, how many there are, whether a free trial is offered and an error code if there is one; when you choose a plan (yearly, monthly or lifetime); when you start a purchase and how it ended, with the error code that RevenueCat returns; and when you restore purchases, with the result. These events describe the Pro screen, the plans and purchases only. No event carries a document, an image, a file name, text that you typed or the number of pages. Firebase also records its standard automatic events, such as first open, session start, app update, a completed in-app purchase (the product, its price and currency, never your payment details) and, on Android, app removal. The events contain none of your documents, library, signature or personal details.
- Crash reports. If the app crashes, Crashlytics sends a report with the stack trace (the technical record of what the app was doing), your device model, your operating system version, the app version and the state of the app at the time of the crash. As Google describes on its Firebase privacy page, Crashlytics also attaches two random installation identifiers to a crash report: the Crashlytics installation UUID and the Firebase installation ID. Crashlytics also sends a report when loading the plans, a purchase or a restore fails. Its message holds only the error code that RevenueCat returns. Reports carry the same two properties, and may carry the step the app was on (plans, purchase or restore) as a single word. Crash reports contain none of your documents, images, file names, library, signature or personal details.
- What Firebase itself processes. Firebase Analytics uses an app instance identifier, a random code for this installation of the app. It is not a name, an e-mail address or an account, and reinstalling the app may create a new one. The app instance identifier (Analytics) and the Firebase installation ID (which Crashlytics attaches to crash reports) are two different random codes: resetting or deleting one does not reset or delete the other. We do not link any of them to who you are and we do not use them to track you. On iPhone, the app does not let Google Analytics use the vendor identifier, a random code that Apple gives to apps from the same publisher on your device. On Android, it does not let Google Analytics use the Android ID (SSAID) or the advertising ID, and the app does not hold the advertising ID permission. Firebase also processes your device model, operating system and app version, and your approximate location (country, region or city), worked out from your IP address. According to Google, Google Analytics does not log or store the IP address.
- Who is involved. Google (Google Ireland Limited and Google LLC) provides both services and acts as our processor, as described under Protection by the companies we use below. We do not sell this information and we do not use it for advertising.
App updates
The app can receive updates to its own code and images. When it starts, it may ask the update service of Expo (650 Industries, Inc.) whether a newer version is available. The request carries your IP address, your operating system (iOS or Android), the app's runtime version and update channel, and a random code that identifies this installation of the app. The code is not linked to your name or to any other app, and it is removed when you uninstall the app. If the app crashed the last time it ran, the request may also carry a short technical description of the error. The request contains none of your documents, library, signature or personal details. We use it only to deliver updates. Expo acts as our processor and may also use aggregated or de-identified data to improve its own services. See the Expo Privacy Policy.
Store update check. Each time the app starts, it checks whether a newer version of the app is in the store and whether the update is required. The check has two parts:
- The store. On iPhone, the app asks Apple's public App Store lookup service for the app's current version in the store. The request carries the app's bundle identifier, your device's region (country code) and, like any internet request, your IP address. Apple handles it as a separate controller under the Apple Privacy Policy. On Android, the app asks Google Play through the Play Store app on your device (Google Play In-App Updates). Google states that it uses device metadata, the app version and the installed modules to tell whether an update is available and how big it is. Google handles this as a separate controller under the Google Play Terms of Service.
- Our server. On both, the app asks our own server, api.mobixify.com, for the app's update policy, that is, which versions must update. The request carries no identifier, account, usage event or personal content. Like any internet request, it reaches our server with your IP address. The server's own log lines record the app, the route, the result and the time it took, and hold no IP address. The web server's access logs include IP addresses and the User-Agent header of each request, which names the app or its network software and its version and, on iPhone, can show the version of the system. Both kinds of log are kept for up to 14 days. Apart from those logs, the server uses the IP address only in memory, to limit repeated requests. Our own team runs the server, which is hosted on Amazon Web Services (AWS) in Frankfurt, Germany (see Protection by the companies we use below). The connection is encrypted (HTTPS).
We use the check to tell the app whether to ask you to update. If the update is required, the app asks you to update from the store. The check has no switch, like the updates above.
If you write to us
If you write to us, we receive your e-mail address and what you tell us. We use them only to answer you. Our mailbox is hosted by Google Workspace.
Why we use information
UK data protection law needs a lawful basis for each use of personal data. The app's data is a random app user ID, purchase records, technical details of your device and requests (including those of the store update check described under App updates), a random app instance identifier, the usage events and the crash reports described above, and anything you write to us.
- Giving you Pro (checking, unlocking and restoring purchases): to carry out our contract with you.
- Preventing fraud and understanding sales in aggregate: our legitimate interests in protecting our income from purchase fraud and in knowing how the app sells. The data is limited to what is described above and you can object, see Your rights.
- Sharing refund-request information with Apple and Google: your consent.
- Delivering app updates: our legitimate interest in keeping the app working and secure. This includes the store update check described under App updates: our server's part of it, and the logs it leaves, rest on this basis, and Apple and Google handle their parts as separate controllers.
- Analytics and crash reports where the app asks for your consent: your consent, which you give on the consent screen and can withdraw at any time with the Settings switches. In Türkiye, for usage statistics, this is explicit consent under Article 5(1) of the Turkish Personal Data Protection Law (KVKK).
- Analytics and crash reports in the UK: our legitimate interests (Article 6(1)(f) UK GDPR) in understanding how the app is used and in finding and fixing crashes. For the rules on storing information on, and reading it from, your device (the Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1), we rely on the exemption for statistical purposes (paragraph 5) for usage statistics, and on the exemption for detecting technical faults (paragraph 4(2)(d)) for crash reports. Google acts as our processor, the data is kept for the periods under How long information is kept, and you can object at any time, see Your rights.
- Analytics and crash reports in Switzerland: our legitimate interests, as an overriding private interest (Article 31 of the Swiss Federal Act on Data Protection). Article 45c of the Swiss Telecommunications Act gives you the choice to switch this off: the Settings switches do that. The data goes to Google LLC in the United States, see International transfers.
- Analytics and crash reports in Canada outside Quebec: your implied consent, together with your choice to opt out. The notice tells you that both are on, and you can switch either off in Settings at any time. Google processes the data in the United States, where US courts and authorities may be able to ask for access to it (see International transfers).
- Analytics and crash reports everywhere else, Brazil included: our legitimate interests in understanding how the app is used and in finding and fixing crashes. In Türkiye, crash reports rest on our legitimate interests under Article 5(2)(f) KVKK, see the Turkish section. The data is limited to what is described above, you can switch each off with its own switch, and you can object, see Your rights.
- Keeping accounting and tax records and meeting other legal duties: a legal obligation.
- Answering your messages: our legitimate interest in replying to you, or our contract with you when your message is about a purchase.
- Documents, library, saved signature, settings and daily free use: these stay on your device and we do not process them.
The app sends the data described above automatically when it is online, except that analytics and crash reports are sent only while their switches are on for you. Scanning on iPhone, importing, editing, the library and your exports work without a connection. On Android, the first scan needs a connection once, so that Google Play services can download the scanner component. Pro is checked, bought and restored, and updates arrive, when you are online. The store update check also runs each time the app starts while you are online. We make no decisions about you by automated means.
Children
The app is not directed at children under 13, and it does not ask for their name, e-mail address or any other personal details. The only information that leaves the device is the information described in this policy, which is handled in the same way for every user. If you are a parent or guardian and have a concern, write to us at info@mobixify.com.
How long information is kept
- On your device. Information stays there until you delete it in the app or remove the app. A backup that your operating system made may keep a copy for as long as you keep that backup.
- At RevenueCat. We keep a purchase record while the app is on sale and for six years after that, the period in which a claim about a purchase can be brought and records may be needed for tax and accounting. We delete a record sooner if you ask and we no longer need it for those purposes.
- At Expo. Expo keeps update-request data only as long as reasonably necessary for its purposes. The random installation code is not linked to your name and is removed from your device when you uninstall the app.
- At Apple and Google, for the store update check. Apple and Google decide how long they keep the data of the store update check, under their own policies.
- On our server. The server's own log lines and the web server's access logs, which include IP addresses and the User-Agent of each request, are kept for up to 14 days. Apart from those logs, the server holds the IP address only in memory, to limit repeated requests.
- At Google (Firebase). Google Analytics keeps individual-level event and user data for 2 months, and the option that restarts that period when you use the app again is off. Google Analytics reports that contain no identifiers are kept longer. Firebase Crashlytics keeps crash stack traces and the identifiers attached to them for 90 days before it starts removing them from its live and backup systems, as Google states on its Firebase privacy page.
- Messages to us. We keep them for 24 months after the last message in the conversation, then delete them. We keep them longer only if we need them for a legal claim or a legal duty.
- Requests about your data. We keep a record of your request, our reply and the outcome for 3 years after we close the request. We delete any proof of identity once we have checked it.
Security
Your documents, library and saved signature are kept in the app's own storage on your device. Connections from the app to RevenueCat, Expo, Google (Firebase) and our own server are encrypted.
Protection by the companies we use
RevenueCat and Expo are the companies that receive information from the app to run purchases and updates to the app's code and images. We have a written agreement about data (a data processing agreement) with each of them, which is part of the terms we accepted when we opened our accounts. Under it, each must use the information only on our instructions and keep it secure, and each must hold the companies it uses to terms that protect the information as well. We therefore treat each as giving the information the same or equal protection as this policy describes and as Apple's App Store Review Guidelines require. Expo may also use de-identified, combined data to improve its own products. For that use Expo is a controller in its own right.
Google also receives information through Firebase Analytics and Crashlytics. Google acts as our processor, through Google Ireland Limited and Google LLC (a "service provider" under some laws), under its Firebase terms, which include its Data Processing and Security Terms. Google Analytics, which Firebase Analytics uses, is subject to separate terms of Google's. See Google's Firebase privacy and security page.
Our own server receives the store update check described under App updates. Our own team runs the server. It is hosted on Amazon Web Services (AWS) in Frankfurt, Germany. AWS acts as our processor: it provides the hosting and handles the data only on our instructions, under its data processing terms. Our team members who can reach the data are bound by confidentiality.
Apple and Google, which run the stores, are separate controllers and handle information under their own policies. This includes the store update check: Apple handles the request to its App Store lookup service, and Google handles the request that the Play Store app makes for Google Play In-App Updates. On Android, Google Play services, which provides and downloads the document scanner, is Google's software, and the ML Kit software behind the scanner sends diagnostic and usage data to Google as described under Scanning on Android; Google handles both under its own policies.
International transfers
RevenueCat and Expo are based in the United States and process data there. Google Ireland Limited and Google LLC may also process data from Firebase in the United States and wherever else Google or its agents have facilities. The data we send to these companies from the United Kingdom and the EU is protected by these safeguards:
- RevenueCat: the EU Standard Contractual Clauses and the UK Addendum to them, which are part of its data processing agreement.
- Expo: the Standard Contractual Clauses in its terms, and its participation, as it states, in the EU-US Data Privacy Framework and its UK Extension.
- Google (Firebase): Google states on its Firebase privacy page that it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension to the EU-U.S. DPF, and its Firebase terms include the EU Standard Contractual Clauses. For data from Switzerland, the Swiss-U.S. Data Privacy Framework applies, as Google states.
Data held in the United States is subject to US law, and US courts and authorities may be able to ask for access to it. You can ask us for a copy of the safeguards at info@mobixify.com.
The store update check goes to our own server, which is hosted by AWS in Frankfurt, Germany, in the European Economic Area, which the UK treats as adequate. Some of our team members work from Türkiye and can reach the server and its data remotely to operate, secure and support the service. Türkiye has no UK or EU adequacy decision. This is access by our own staff, not a disclosure to another organisation, so we protect it with staff confidentiality obligations and by limiting access to the people who need it. When the app asks Apple or Google Play about updates, your own device contacts them directly.
Your rights
You can ask us for access to your personal data, to correct it, to delete it, to restrict its use, and to receive a copy of it in a portable format. Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds or need the data for legal claims. Apple and Google are separate controllers of the data they hold, so ask them about that data. Your documents, library and saved signature are on your device and we hold no copy of them, so you can delete them yourself in the app or by removing the app. Analytics and crash data are linked only to random identifiers (the app instance identifier and, for crash reports, the installation identifiers described above), not to your name or e-mail address. You can switch each off in Settings at any time, reinstalling the app may create new identifiers, and the data is deleted when its retention period ends.
Your right to object. You can object at any time, at no cost, to our use of usage statistics and crash reports that rests on our legitimate interests: switch them off in Settings, or write to us at info@mobixify.com.
Tell us the order number from your Apple or Google receipt, so that we can find the right record. We will reply within one month of having your request and enough information to find your record. If we need to ask you something first, the clock waits for your answer. For a complex request we may take up to two more months, and we will tell you why within the first month. You can also use Account and data requests.
If you are not happy with how we have handled your personal data, tell us first at info@mobixify.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the Information Commission (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. The ICO may ask whether you have raised the problem with us first. You can also complain to the data protection authority in the country where you live or work.
Do Not Track
The app does not track you across other companies' apps or websites, so it behaves the same whether or not a "Do Not Track" signal is present. RevenueCat and Expo receive only the information described in this policy, and they do not collect information about your activity across other apps or websites through ours. The Firebase services in the app use no advertising identifier and are not linked to Google Ads. The store update check is not used to track you across other companies' apps or websites, and the request to our own server carries no identifier.
Changes to this policy
If we change how the app handles information, we will update this page and its effective date, and we will say so in the app's release notes on the store when a change is material. A version of the app that adds advertising comes with an updated version of this policy.
Türkiye'deki kullanıcılar için (KVKK)
Bu bölüm, Türkiye'deki kullanıcılar için 6698 sayılı Kişisel Verilerin Korunması Kanunu'nun (KVKK) 10. maddesi uyarınca hazırlanmış aydınlatma metnidir. Yukarıdaki İngilizce politikayla aynı uygulamaları anlatır. Bu bölüm yalnızca bilgilendirir. Analitik için açık rızanız, uygulamadaki ayrı bir ekranda istenir.
- Veri sorumlusu. Mobixify LTD, Scanday uygulamasının yayıncısı, şirket numarası 16138122. İletişim: info@mobixify.com. Şirket bilgileri: mobixify.com/company/.
- Hangi veriler. Hesap gerekmez. Adınızı, e-posta adresinizi, telefon numaranızı, kesin konumunuzu ve cihazınızın reklam kimliğini toplamayız. Belgelerinizi, taramalarınızı, görsellerinizi, dosya adlarınızı ve kayıtlı imzanızı da toplamayız. Taramalarınız, içe aktardığınız fotoğraf ve dosyalar, PDF ve JPG dışa aktarımlarınız, kitaplığınız, kayıtlı imzanız, ayarlarınız ve günlük ücretsiz kullanım sayacınız uygulamanın kendi depolama alanında, cihazınızda saklanır; uygulama bunları yüklemez, bize ulaşmaz. Bize ulaşan veriler aşağıda sayılmıştır.
- Kamera, fotoğraflar ve dosyalar. iPhone'da uygulama, iOS'a yerleşik belge tarayıcısını (Apple VisionKit) kullanır; kamera iznini iOS ister. Android'de tarayıcı, cihazınızda Google Play hizmetleri içinde çalışan Google ML Kit Belge Tarayıcısı'dır; uygulamanın kendisi kamera iznini taşımaz. Google Play hizmetleri tarayıcı bileşenini ilk taramada indirir; bu indirmeyi Google kendi koşulları ve gizlilik politikası kapsamında yürütür. Tarayıcının arkasındaki yazılım olan ML Kit, Google'ın belirttiğine göre nasıl çalıştığına dair tanılama ve kullanım verilerini de Google'a gönderir: örneğin cihazın markası, modeli ve işletim sistemi sürümü, uygulamanın paket adı ve sürümü, bir cihaz veya kurulum kimliği, performans değerleri, görüntü biçimi ve çözünürlüğü gibi ayarlar, girdi ve çıktı boyutu, olay türleri ve hata kodları. Bunu Google'ın yazılımı, şifreli bir bağlantıyla gönderir; Google bu verileri üçüncü taraflara aktarmadığını ve Google Gizlilik Politikası kapsamında işlediğini belirtir. Google, tarayıcının tamamen cihazda çalıştığını, ML Kit'in sayfalarınızı ve tarama sonucunu Google'a göndermediğini ve tanılama ve kullanım verilerini performansı ölçmek, hataları ayıklamak, ML Kit'i sürdürüp geliştirmek ve kötüye kullanımı tespit etmek için kullandığını belirtir. Bu veriler bize ulaşmaz. İçe aktarırken sistemin fotoğraf, belge veya dosya seçicisi kullanılır; uygulama fotoğraf kitaplığınıza ya da dosyalarınıza erişim izni istemez ve yalnızca seçtiklerinizi görür. Paylaşma ve kaydetme, sistemin paylaşım sayfası veya kaydetme penceresi üzerinden, sizin seçtiğiniz uygulamaya ya da yere gider; biz hiçbir şey almayız.
- Yedekler. iCloud Yedekleme veya Android cihazınızın Google Hesabınıza yedeği gibi bir cihaz yedeği kullanıyorsanız, yedek uygulamanın verilerini (belgeleriniz, kitaplığınız ve kayıtlı imzanız dahil olabilir) içerebilir. Yedeği işletim sistemi alır, Scanday değil; biz yedeği almayız, uygulamanın kendi yedeği ya da bulutu yoktur.
- Analitik (Google Analytics for Firebase). Veriler: uygulamadaki olaylar (Pro ekranının gösterilmesi, satın alma başlangıcı ve sonucu gibi), cihaz modeli, işletim sistemi ve uygulama sürümü, IP adresinizden çıkarılan yaklaşık konum ve rastgele bir uygulama örneği kimliği. Hiçbir olay belge, görsel, dosya adı, yazdığınız metin ya da sayfa sayısı taşımaz. Bu kimlik adınıza veya bir hesaba bağlı değildir ve uygulamayı yeniden yüklemeniz yeni bir kimlik oluşturabilir. Amaç: uygulamanın nasıl kullanıldığını anlamak. Hukuki sebep: açık rıza (KVKK m.5/1).
- Çökme raporları (Firebase Crashlytics). Veriler: çökme anındaki teknik kayıt (yığın izi), cihaz modeli, işletim sistemi ve uygulama sürümü, iki rastgele kurulum kimliği (Crashlytics kurulum UUID'si ve Firebase kurulum kimliği; ikisi uygulama örneği kimliğinden ayrı kimliklerdir); bir satın alma başarısız olursa RevenueCat'in döndürdüğü hata kodu. Amaç: çökmeleri bulup düzeltmek. Hukuki sebep: meşru menfaat (KVKK m.5/2-f): çökmeleri bulup düzeltmekte meşru menfaatimiz vardır; bu amaç için yalnızca çökme izi ve rastgele kimlikler işlenir, ad, e-posta veya serbest metin işlenmez, kapatma anahtarı Ayarlar'dadır ve KVKK m.11 kapsamındaki itiraz hakkınızı bu anahtarla ya da info@mobixify.com adresine yazarak kullanabilirsiniz. Uygulama, çökme raporu göndermeden önce bu işlemeyi tek bir Türkçe bildirimle size duyurur; bildirim dayanağı (KVKK m.5/2-f, meşru menfaat) belirtir ve bu bölüme bağlanır. Saklama: 90 gün.
- Satın almalar (RevenueCat; ödemeyi Apple veya Google alır). Veriler: rastgele bir uygulama kullanıcı kimliği, bu uygulamadaki satın alma geçmişiniz ve abonelik durumunuz, uygulama sürümü, cihaz türü, işletim sistemi ve IP adresiniz. Amaç: satın almayı doğrulamak, Pro'yu açmak ve satın almaları geri yüklemek. Hukuki sebep: sözleşmenin kurulması ve ifası (KVKK m.5/2-c). Satın alma dolandırıcılığını önlemek ve satışları toplu olarak anlamak: meşru menfaat (KVKK m.5/2-f).
- İade talepleri. Apple'dan veya Google'dan iade istediğinizde RevenueCat, bizim adımıza, o satın almayla ilgili bilgileri (örneğin teslim edildiğini) ve iade tercihimizi onlara gönderebilir; böylece talebinize karar verebilirler. Hukuki sebep: bir hakkın tesisi, kullanılması veya korunması için veri işlemenin zorunlu olması (KVKK m.5/2-e). Bu konudaki taleplerinizi info@mobixify.com adresine iletebilirsiniz.
- Uygulama güncellemeleri (Expo). Veriler: IP adresiniz, işletim sistemi, uygulamanın çalışma zamanı sürümü, güncelleme kanalı ve rastgele bir kurulum kodu. Amaç: uygulamanın güncellemelerini iletmek. Hukuki sebep: uygulamayı çalışır ve güvenli tutmaya yönelik meşru menfaat (KVKK m.5/2-f).
- Mağaza güncelleme denetimi. Uygulama her açıldığında mağazada daha yeni bir sürüm olup olmadığını ve güncellemenin zorunlu olup olmadığını denetler. iPhone'da Apple'ın herkese açık App Store sorgulama hizmetine sorar; istek uygulamanın paket kimliğini (bundle identifier), cihazın bölgesini (ülke kodu) ve her internet isteğinde olduğu gibi IP adresinizi taşır; Apple bunu kendi gizlilik politikasına göre ayrı bir veri sorumlusu olarak işler. Android'de uygulama, cihazdaki Play Store uygulaması aracılığıyla Google Play'e sorar (Google Play In-App Updates); Google, güncelleme olup olmadığını ve boyutunu belirlemek için cihaz meta verilerini, uygulama sürümünü ve yüklü modülleri kullandığını belirtir; Google bunu Google Play Hizmet Şartları kapsamında ayrı bir veri sorumlusu olarak işler. İki platformda da uygulama kendi sunucumuza (api.mobixify.com) uygulamanın güncelleme politikasını, yani hangi sürümlerin güncellenmesi gerektiğini sorar. Bu istek kimlik, hesap, kullanım olayı ya da kişisel içerik taşımaz; sunucumuz, her internet isteğinde olduğu gibi IP adresinizi alır. Sunucunun kendi günlük satırları uygulamayı, yolu, sonucu ve süreyi kaydeder, IP adresi içermez; web sunucusunun erişim günlükleri IP adresini ve her isteğin User-Agent başlığını içerir; bu başlık uygulamanın ya da ağ yazılımının adını ve sürümünü belirtir, iPhone'da ise sistemin sürümünü gösterebilir. İki günlük de 14 güne kadar saklanır. Bu günlükler dışında sunucu IP adresini yalnızca bellekte, tekrarlanan istekleri sınırlamak için kullanır. Sunucumuzu kendi ekibimiz işletir; sunucu Amazon Web Services'te (AWS) Frankfurt, Almanya'da barındırılır (AWS veri işleyendir). Bağlantı şifrelidir (HTTPS). Amaç: uygulamaya sizden güncelleme isteyip istemeyeceğini bildirmek. Hukuki sebep: uygulamayı çalışır ve güvenli tutmaya yönelik meşru menfaat (KVKK m.5/2-f). Güncelleme zorunluysa uygulama sizden mağazadan güncellemenizi ister. Bu denetimin kapatma anahtarı yoktur.
- Bize yazdığınız mesajlar. Veriler: e-posta adresiniz ve yazdıklarınız. Amaç: size yanıt vermek. Hukuki sebep: meşru menfaat (KVKK m.5/2-f); mesajınız bir satın almayla ilgiliyse sözleşme (KVKK m.5/2-c).
- Muhasebe ve vergi kayıtları ile diğer yasal yükümlülükler. Hukuki sebep: hukuki yükümlülük (KVKK m.5/2-ç).
- Toplama yöntemi. Veriler uygulamadan, internete bağlı olduğunuzda otomatik olarak gelir. Analitik ve çökme raporları yalnızca kendi anahtarları açıkken gönderilir. Mağaza güncelleme denetimi uygulama her açıldığında, internete bağlı olduğunuzda yapılır ve anahtarı yoktur. Mesajlarınız e-postayla gelir.
- Kimlere ve neden aktarılır. Google (Google Ireland Limited ve Google LLC), Firebase Analytics ve Crashlytics hizmetlerini sunmak üzere verileri bizim adımıza işleyen hizmet sağlayıcı (veri işleyen) olarak alır. RevenueCat, Inc. satın almaları yönetmek için, Expo (650 Industries, Inc.) güncellemeleri iletmek için alır; ikisi de veri işleyen olarak çalışır. Apple ve Google mağazaları ödemeleri ve mağaza güncelleme denetimini kendi politikalarıyla, ayrı veri sorumluları olarak işler. Sunucumuz AWS'de Frankfurt, Almanya'da barındırılır; AWS barındırmayı yalnızca bizim talimatlarımızla yapan veri işleyendir. Türkiye'den çalışan ekip üyelerimiz sunucuya ve verilere uzaktan erişebilir. Veriler yurt dışına, esas olarak ABD'ye ve sunucumuz için Almanya'ya aktarılır ve orada işlenir; ABD hukukuna göre ABD mahkemeleri ve makamları ABD'deki verilere erişim isteyebilir. Bu verileri satmayız ve reklam için kullanmayız.
- Saklama süreleri. Cihazınızdaki veriler, siz silene veya uygulamayı kaldırana kadar cihazınızda kalır; işletim sisteminin aldığı bir yedek, yedeği sakladığınız sürece bir kopya tutabilir. Google Analytics, kimlik düzeyindeki olay ve kullanıcı verilerini 2 ay saklar; bu süre uygulamayı yeniden kullanmanızla yenilenmez. Firebase Crashlytics çökme kayıtlarını 90 gün saklar, sonra sistemlerinden silmeye başlar. RevenueCat'teki satın alma kaydı, uygulama satışta olduğu sürece ve ondan sonra altı yıl saklanır. Expo, güncelleme isteği verilerini amacı için makul olduğu kadar saklar. Apple ve Google, mağaza güncelleme denetiminin verilerini kendi politikalarına göre saklar. Sunucumuzun günlük satırları ve IP adresini ve her isteğin User-Agent başlığını içeren web sunucusu erişim günlükleri 14 güne kadar saklanır; bu günlükler dışında sunucu IP adresini yalnızca bellekte tutar. Mesajlar, konuşmadaki son mesajdan 24 ay sonra silinir. Verilerinizle ilgili başvurunuzun kaydı, başvuruyu kapattıktan sonra 3 yıl tutulur.
- Rızanızı geri çekme. İki anahtar ayrı ayrı çalışır ve Ayarlar'da bulunur: "Kullanım istatistiklerini paylaş" (Google Analytics) ve "Çökme raporlarını paylaş" (Firebase Crashlytics); Ayarlar'dan istediğiniz zaman değiştirebilirsiniz. Rıza ekranında yalnızca "Kullanım istatistikleri" anahtarı bulunur; çökme raporları açık gelir ve uygulama bunu tek, engellemeyen bir bildirimle size bildirir. Rıza ekranı, ilk belgenizi oluşturduktan sonra (ya da Ayarlar'da onay bekleyen bir anahtarı açmak istediğinizde), hiçbir kullanım olayı ya da çökme raporu gönderilmeden önce çıkar ve anahtar kapalı başlar. Ekranın başlığı "Gizlilik tercihleriniz", bölümleri "Aydınlatma" ve "Açık rıza tercihleriniz"dir; aydınlatma bu bölüme bağlanır. Cihazınızın bölge ayarı Türkiye ya da saat dilimi İstanbul ise ekran, uygulamanın dili ne olursa olsun Türkçedir. Ekranı kapatmak "Tümünü reddet" seçeneğini seçmekle aynıdır. Seçiminiz (her amaç için tercihiniz, zamanı, metin sürümü ve bölge) cihazınızda kayıt olarak tutulur. Ekran, yalnızca yeni bir metin sürümü yeni bir amaç eklediğinde yeniden gösterilir. Bir anahtarı kapattığınızda: kullanım istatistikleri hemen durur ve cihazdaki analitik verileri sıfırlanır; çökme raporlarında gönderilmemiş raporlar silinir, kapatma uygulamayı yeniden başlattığınızda tam geçerli olur ve arada oluşan bir çökme raporu yine gönderilebilir. Rızanızdan önce (çökme raporlarında bildirim gösterilmeden önce) cihazda toplanan çökme raporları, rıza verseniz bile hiç gönderilmez. Rıza ekranında "Tümünü reddet" ile "Tümünü kabul et" aynı belirginliktedir ve "Seçimlerimi kaydet" düğmesinin yanında yer alır. Uygulama, seçiminiz ne olursa olsun aynı şekilde çalışır. Rızanızı geri çekmeniz, önceki işlemeyi hukuka aykırı yapmaz.
- KVKK m.11 kapsamındaki haklarınız. Kişisel verilerinizin işlenip işlenmediğini öğrenme; işlenmişse bilgi isteme; işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme; yurt içinde veya yurt dışında aktarıldığı kişileri bilme; eksik veya yanlış işlenmişse düzeltilmesini isteme; KVKK m.7'deki şartlar çerçevesinde silinmesini veya yok edilmesini isteme ve bunun aktarıldığı kişilere bildirilmesini isteme; işlenen verilerin münhasıran otomatik sistemlerle analiz edilmesi sonucu aleyhinize bir sonuç çıkarsa itiraz etme; kanuna aykırı işleme nedeniyle zarara uğrarsanız zararın giderilmesini isteme.
- Başvuru. info@mobixify.com adresine e-posta ile yazın. Kaydınızı bulabilmemiz için Apple veya Google makbuzunuzdaki sipariş numarasını ekleyin. Başvurunuza en geç 30 gün içinde yanıt veririz. Yanıttan memnun kalmazsanız Kişisel Verileri Koruma Kurulu'na şikâyet edebilirsiniz (kvkk.gov.tr).
Usuários no Brasil (LGPD)
Esta seção é para usuários no Brasil, conforme a Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018). Ela descreve as mesmas práticas da política em inglês acima.
- Quem é o controlador. Mobixify LTD, publicadora do Scanday, número de registro da empresa 16138122. Contato: info@mobixify.com. Informações da empresa: mobixify.com/company/.
- Para que usamos os dados. Para conferir compras, liberar o Pro e restaurar compras (RevenueCat); para entregar atualizações do app (Expo) e verificar se há versão nova na loja; para entender como o app é usado e corrigir falhas (Google Analytics e Firebase Crashlytics); para responder às suas mensagens; e para cumprir obrigações legais, como registros contábeis e fiscais. Os seus documentos, digitalizações, a biblioteca, a assinatura salva, os ajustes e o contador diário de uso gratuito ficam no seu dispositivo, no armazenamento do próprio app; o app não os envia e nós não os recebemos. Não coletamos seu nome, e-mail, telefone, localização precisa, documentos, imagens, nomes de arquivos nem o identificador de publicidade do aparelho.
- Câmera, fotos e arquivos. No iPhone, o app usa o digitalizador de documentos do iOS (VisionKit da Apple), e o iOS pede a permissão da câmera. No Android, o digitalizador é o ML Kit Document Scanner do Google, que roda dentro do Google Play services no seu aparelho; o próprio app não tem a permissão da câmera. O Google Play services baixa o componente do digitalizador na primeira digitalização, sob os termos e a política de privacidade do Google. O ML Kit, o software por trás do digitalizador, também envia ao Google, segundo o Google, dados de diagnóstico e de uso sobre o seu funcionamento: por exemplo, a marca, o modelo e a versão do sistema do aparelho, o nome e a versão do pacote do app, um identificador do aparelho ou da instalação, números de desempenho, ajustes como o formato e a resolução da imagem, o tamanho da entrada e da saída, tipos de evento e códigos de erro. Quem envia é o software do Google, por conexão criptografada; o Google afirma que não repassa esses dados a terceiros e que os trata conforme a Política de Privacidade do Google. O Google afirma que o digitalizador funciona inteiramente no aparelho, que o ML Kit não envia ao Google as suas páginas nem o resultado da digitalização e que usa os dados de diagnóstico e de uso para medir o desempenho, depurar, manter e melhorar o ML Kit e detectar uso indevido ou abuso. Eles não chegam até nós. Para importar, o app usa o seletor do sistema e vê apenas as fotos e os arquivos que você escolher; ele não pede permissão para ler a sua biblioteca de fotos nem os seus arquivos. Ao compartilhar ou salvar, o arquivo vai pela tela de compartilhamento ou pela janela de salvar do sistema para o app ou o local que você escolher; não recebemos nada.
- Backups. Se você usa um backup do aparelho, como o Backup do iCloud ou o backup do seu Android na sua Conta Google, o backup pode incluir os dados do app (o que pode incluir seus documentos, a biblioteca e a assinatura salva). Quem faz o backup é o sistema operacional, não o Scanday; nós não o recebemos e o app não tem backup nem nuvem próprios.
- Base legal. Para a análise de uso e os relatórios de falhas, usamos o legítimo interesse (LGPD, art. 7º, IX, e art. 10) de entender o uso do app e corrigir falhas. Quando a região e o fuso horário do aparelho não apontam para uma região em que pedimos consentimento, o app não pede consentimento: cada chave começa ligada e você pode desligá-la. O app mostra um aviso único, que não bloqueia nada, dizendo que as duas chaves estão ligadas, com atalho para os Ajustes. Os dados se limitam ao descrito na política, sem perfil e sem publicidade. Nenhum evento leva documento, imagem, nome de arquivo, texto digitado ou número de páginas. Para compras usamos a execução de contrato (art. 7º, V); para atualizações (inclusive a verificação de atualização na loja) e prevenção de fraude, o legítimo interesse (art. 7º, IX); para registros legais, o cumprimento de obrigação legal (art. 7º, II).
- Verificação de atualização na loja. A cada abertura, o app verifica se há uma versão mais nova na loja e se a atualização é obrigatória. No iPhone, o app consulta o serviço público de consulta da App Store da Apple; o pedido leva o identificador de pacote (bundle identifier) do app, a região do aparelho (código do país) e, como qualquer pedido pela internet, o seu endereço IP. A Apple trata esses dados como controladora separada, sob a sua própria política de privacidade. No Android, o app consulta o Google Play por meio do app Play Store do aparelho (Google Play In-App Updates); o Google informa que usa metadados do aparelho, a versão do app e os módulos instalados para saber se há atualização e qual é o tamanho dela, e trata isso como controlador separado, sob os Termos de Serviço do Google Play. Nos dois sistemas, o app pergunta ao nosso próprio servidor (api.mobixify.com) qual é a política de atualização do app, isto é, quais versões devem atualizar. Esse pedido não leva identificador, conta, evento de uso nem conteúdo pessoal; como qualquer pedido pela internet, ele chega ao servidor com o seu endereço IP. As linhas de log do próprio servidor registram o app, a rota, o resultado e o tempo que levou, e não guardam endereço IP; os logs de acesso do servidor web incluem endereços IP e o cabeçalho User-Agent de cada pedido, que indica o app ou o seu software de rede e a versão dele e, no iPhone, pode mostrar a versão do sistema. Os dois tipos de log ficam por até 14 dias. Fora desses logs, o servidor usa o endereço IP apenas na memória, para limitar pedidos repetidos. Nossa própria equipe opera o servidor, hospedado na Amazon Web Services (AWS), em Frankfurt, Alemanha (operador). A conexão é criptografada (HTTPS). Finalidade: informar ao app se deve pedir que você atualize. Base legal: legítimo interesse (LGPD, art. 7º, IX). Se a atualização for obrigatória, o app pede que você atualize pela loja. Essa verificação não tem chave para desligar.
- Pedidos de reembolso. Quando você pede um reembolso à Apple ou ao Google, o RevenueCat envia a eles, em nosso nome, informações sobre essa compra (por exemplo, que ela foi entregue) e a nossa preferência de reembolso, para que decidam o pedido. Base legal: consentimento (art. 7º, I), dado nos Termos. Você pode retirar o consentimento a qualquer momento escrevendo para info@mobixify.com.
- Por quanto tempo. Os dados no seu dispositivo ficam até você apagá-los no app ou remover o app; um backup feito pelo sistema operacional pode manter uma cópia enquanto você mantiver esse backup. O Google Analytics guarda os dados de eventos e de usuário em nível individual por 2 meses; esse prazo não recomeça quando você volta a usar o app. O Firebase Crashlytics guarda os relatórios de falhas por 90 dias. Os logs do servidor e do servidor web, que incluem endereços IP e, nos logs de acesso do servidor web, o User-Agent de cada pedido, ficam por até 14 dias. O registro de compra no RevenueCat fica enquanto o app estiver à venda e por seis anos depois. As mensagens ficam por 24 meses após a última mensagem da conversa. O registro do seu pedido sobre dados, da nossa resposta e do resultado fica por 3 anos depois que encerramos o pedido.
- Compartilhamento e tratamento nos Estados Unidos. Os dados de análise e de falhas vão para o Google (Google Ireland Limited e Google LLC), que age como operador, em nosso nome, sob os termos do Firebase. Os dados enviados ao Google, ao RevenueCat e à Expo podem ser tratados nos Estados Unidos; pela lei americana, tribunais e autoridades dos EUA podem pedir acesso a eles. Não vendemos esses dados nem os usamos para publicidade. O nosso próprio servidor fica na AWS, em Frankfurt, Alemanha (operador, que trata os dados apenas conforme as nossas instruções), e membros da nossa equipe que trabalham na Turquia podem acessá-lo remotamente; a Apple e o Google tratam a verificação de atualização na loja como controladores separados.
- Seus direitos e como se opor. Você pode pedir confirmação do tratamento, acesso, correção, bloqueio ou eliminação de dados desnecessários ou tratados em desconformidade, portabilidade e informação sobre as entidades com as quais compartilhamos os dados (LGPD, art. 18). Você pode se opor ao tratamento feito com base no legítimo interesse: desligue as duas chaves em Ajustes no app (a de estatísticas de uso, do Google Analytics, e a de relatórios de falhas, do Firebase Crashlytics), e o app deixa de enviar: a análise para na hora e os dados de análise guardados no aparelho são zerados; nos relatórios de falha, os que aguardam envio são apagados, o desligamento vale por completo quando você reinicia o app e uma falha ocorrida nesse intervalo ainda pode ser enviada; ou escreva para info@mobixify.com, com o número do pedido do recibo da Apple ou do Google, para que possamos achar o seu registro. Atendemos aos pedidos nos prazos da LGPD.
- Reclamação à ANPD. Você também pode apresentar reclamação à Autoridade Nacional de Proteção de Dados (ANPD), em gov.br/anpd.