LectoScan
ENVI
Get the app

← Back to home

Privacy Policy

Last updated: 2026-10-22

This Privacy Policy explains how [9VIL LEGAL ENTITY] ("9vil", "we", "us") handles information when you use the LectoScan mobile app (the "App") and this website. The short version: your documents stay on your device unless you turn on the optional encrypted backup, which only you can decrypt, or run the optional Advanced OCR on a document (its page images are then read by our recognition service and not kept); LectoScan has no accounts, no ads and no tracking.

1. Who is responsible

The data controller for the limited information described below is [9VIL LEGAL ENTITY]. You can reach us at support@9vil.app.

2. Your documents stay on your device

Scans, imported files, the text recognised from them, filenames, folders, tags and the search index are stored on your phone. By default nothing is uploaded. We never receive them and we cannot see or recover them. The only exception is the optional encrypted backup that you can turn on yourself (section 4), which stores an encrypted copy in your own iCloud or Google Drive.

  • The library database is encrypted on the device. Its key is kept in the iOS Keychain or Android Keystore.
  • The recognised text of each document is additionally sealed with a random key unique to that document. Deleting a document permanently deletes its key.
  • If you set an app passcode or biometrics, the passcode is stored only as a salted hash on the device. If you choose "Remember password" for a protected PDF, that password is kept in the platform keystore on your device.
  • Some optional features create files you choose to share or export, for example a PDF sent through the system share sheet. What happens to a file after you share it is governed by the app or service you share it with.

3. Text recognition (OCR)

LectoScan uses Google ML Kit text recognition, which runs on your device. Your images and the recognised text are not sent to Google or to us. ML Kit does send Google diagnostic and performance data about its own use, such as API usage, latency, and model and device information. This data is not linked to you and is not used for tracking or advertising. In the App Store's "App Privacy" details we declare it as Diagnostics (performance data and other diagnostic data), not linked to you, used for analytics.

Advanced OCR (optional, off by default)

Advanced OCR is a separate, optional feature for reading tables, formulas and handwriting. It is off until you turn it on in Settings and accept the notice shown there, and nothing is sent until you start it on a document (Advanced OCR, Extract Text or PDF to Word with Advanced OCR on, or Make Searchable PDF). Then:

  • The page images of that document are sent, one page at a time, over an encrypted connection (HTTPS) to our recognition service, which runs on Cloudflare Workers, and from there to an AI text-recognition model operated by [LLM PROVIDER NAMES] through our model gateway. The model returns the text of the page.
  • Images and recognised text are processed in memory only and are not stored by our service after the request; our logs contain only technical data (a random request identifier, image size, timing, which model answered and whether it succeeded), never the image or its text. They are not used to train AI models.
  • To count your monthly page allowance, the service receives a random, anonymous app identifier (the RevenueCat app user ID, or a random ID created by the App) and keeps a count of pages per month and day, plus a cryptographic hash of each page image so that a retried page is not counted twice. If you have Premium, the service checks your subscription status with RevenueCat using that identifier.
  • The result (text, tables, formulas and the line positions read on your device) is stored only on your device, encrypted like your other page text.

You can turn Advanced OCR off in Settings at any time. Everything else, including the on-device OCR described above, keeps working without it.

4. Optional encrypted backup (Premium)

Backup is off by default. If you have Premium and turn it on in Settings > Backup, LectoScan stores an encrypted copy of your library in your own cloud storage. You choose where:

  • iCloud (iOS only): the CloudKit private database of your own Apple account.
  • Google Drive (iOS and Android): a hidden app-data folder in your own Google Drive. Google sign-in uses only the drive.appdata permission, which gives the App access to its own hidden folder and to no other file in your Drive. The App keeps the email address of the signed-in Google account on your device to show which account is in use. Google's own privacy policy covers the sign-in.

The library is encrypted on your device, before anything is uploaded, with AES-256-GCM under a backup key. That key is wrapped with your backup password (using Argon2id) and with a recovery code that the App shows you. Only you can decrypt the backup. We (9vil) never receive the backup, your backup password or the key, and we cannot restore a backup for you. If you lose both your backup password and your recovery code, the backup cannot be recovered by anyone.

On iOS you can optionally keep the backup key in your iCloud Keychain, so that your other Apple devices can restore without typing the password. Apple's iCloud and Google's services store the backup under your own account and their own terms and privacy policies. Backing up and restoring need an internet connection.

5. Permissions the App may ask for

  • Camera, to scan pages. Images are processed on the device.
  • Photos and files, only for the items you choose to import. Android may also pass files to the App when you use the system share menu.
  • Biometrics, if you enable biometric unlock. The App only receives a pass or fail result from the operating system; it never sees your fingerprint or face data.

6. Purchases and Premium

Premium is sold as an in-app purchase or subscription through Apple App Store or Google Play. Apple or Google processes your payment and we never receive your card or billing details. To manage entitlements we use RevenueCat, a subscription management service. RevenueCat receives:

  • an anonymous App User ID generated by the App (not linked to your name or email);
  • purchase and receipt data from the store (product, purchase and expiry dates, transaction identifiers, subscription status);
  • technical information such as app version, platform, country or region and IP address, which RevenueCat uses to deliver the service and prevent fraud.

RevenueCat acts as our processor. Its handling of data is described in its own privacy policy at revenuecat.com/privacy. This purchase data does not include any of your documents.

7. What we do not do

  • No advertising, ad SDKs or ad identifiers.
  • No tracking: we do not track you across other companies' apps and websites, and nothing in the App is used for tracking or advertising.
  • No third-party analytics, usage-tracking or crash-reporting services. The only third-party diagnostics are the ones Google ML Kit sends about its own use (see section 3), plus the purchase data described in section 6. Advanced OCR (section 3) sends page images only when you run it yourself.
  • No accounts, so no profile of you exists on our side.
  • We do not sell or share personal information, and we never receive your documents, backups, backup password or keys (except page images you send with Advanced OCR, which are processed and discarded, see section 3).

8. Contacting support

If you email support@9vil.app, we receive your email address and whatever you choose to write or attach. We use it only to answer you and improve the App, and keep it as long as needed for that purpose. Please do not send sensitive documents unless we ask and you agree.

9. This website

The website is static. It does not use cookies, analytics or trackers. The Sora and Be Vietnam Pro fonts are served from this website itself, so no third party receives your details because of fonts. Our hosting provider, Cloudflare, processes standard server logs (such as IP address and requested page) to deliver and protect the site.

10. Legal bases and retention

Where data protection law requires a legal basis, we rely on performance of a contract (to provide Premium you purchased), legitimate interests (preventing fraud and answering support requests) and, where needed, your consent. Information held by RevenueCat is retained for as long as needed to provide entitlements and meet legal and accounting duties. Diagnostic data sent by ML Kit is handled by Google under its own policies. Data on your device is kept until you delete it or uninstall the App. An encrypted backup in your iCloud or Google Drive is kept there until you delete it, for example from your iCloud or Google Drive storage settings, and uninstalling the App does not delete it.

11. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, or Vietnam's personal data protection rules), you may have rights to access, correct, delete, restrict or object to processing of personal data we hold, and to complain to your data protection authority. Because we do not hold your documents, your backups or an account, the only data we can look up is support correspondence and, via RevenueCat, the anonymous purchase record. Your backup lives in your own iCloud or Google Drive and you manage it there; you can delete it at any time, and we cannot access or restore it for you. To exercise a right, email support@9vil.app and include your anonymous App User ID if you have it (shown in the App's Premium or settings screen where available).

12. Data transfers

RevenueCat, Apple, Google, Cloudflare and the Advanced OCR model provider ([LLM PROVIDER NAMES], only when you use that feature) operate globally. Google (ML Kit diagnostics, Google sign-in and Google Drive) and Apple (iCloud) may process data, including your encrypted backup, in the regions they use for your account. Purchase, diagnostic or log data may therefore be processed outside your country, including in the United States, under safeguards such as standard contractual clauses where required.

13. Children

LectoScan is a general-purpose tool and is not directed to children under 13 (or the higher minimum age in your country). We do not knowingly collect personal information from children. Because documents stay on the device unless backup is turned on, a parent or guardian controls what the child scans. If you believe a child has sent us personal information, contact us and we will delete it.

14. Security

We design the App so that sensitive data stays local and encrypted, and so that any backup is encrypted on your device before it leaves it. No method is perfectly secure; protect your device with a screen lock and keep your operating system updated.

15. Changes to this policy

We may update this policy. The date at the top shows the latest version. For material changes we will give notice in the App or on this site before they take effect.

16. Governing law and contact

This policy is governed by the laws of [JURISDICTION], without limiting any mandatory consumer rights you have in your country. Questions: support@9vil.app.