Privacy Policy

Effective: September 25, 2026

TruScan is published by Finn Digital LLC. This policy covers the TruScan iOS app and its pages on finndigital.net. Contact [email protected] about privacy, access, correction or deletion.

Scanning happens on your iPhone

Capture, page-edge detection, perspective correction, image enhancement, text recognition (OCR), document classification and naming, passport and ID photo measurement, and machine-readable-zone reading all run on the device, using Apple’s Vision framework and, on supported iPhones, Apple Intelligence. Scanning works with no account and no network connection.

No scan leaves your phone unless you sign in and turn on cloud sync, or you use AI photo enhancement. Those two features are described below. Neither is required to use TruScan.

The copy that stays on your iPhone

Everything TruScan stores on the device is protected by iOS Data Protection. Your scans, their text, the database that indexes them and the temporary files an export is staged in are all written in the class Apple calls complete unless open: a file TruScan is not actively writing cannot be read while your iPhone is locked, including by anyone with the phone in their hand.

You can also put TruScan itself behind Face ID or Touch ID. In Profile → Privacy & Security, “Lock with Face ID” asks for your face, fingerprint or passcode before the app will open, and you choose when it re-locks: immediately, or after 1, 5 or 15 minutes in the background. Whether or not that lock is on, TruScan covers its own screen when you leave the app, so your scans are not in the picture the iPhone puts in the app switcher.

TruScan can also list your scans in the iPhone’s own Spotlight search, if Show scans in Spotlight is on in Profile → Privacy & Security. A scan is listed by its title and kind. Only when TruScan has recognised it as an everyday document — a receipt, invoice, bill, letter, contract, notes or book — are the first three lines of its first page added, and not even then if that page looks like an ID (a driver’s licence, a personal ID number, a heading such as “Passport” or “Identity card”, an ID’s field labels such as DOB or EXP, or a passport’s machine-readable zone) or the scan carries an ID’s details. IDs, and anything TruScan hasn’t recognised as an everyday document (a form, a business card, a tax or medical document, a certificate, or a scan TruScan could not classify), are listed by kind and title only, and their title is shown only if you typed it on this iPhone; otherwise it is listed by what it is (“Passport”, “Scan”). A photo is listed by its caption, if it has a short one, and its date. No image, file, tag or full text is ever indexed. The index is built and kept on your iPhone by iOS, under the same Data Protection as your scans, and it is never sent to us, whether or not your library is encrypted. Turning on the app lock turns it off and empties it, because an app you have locked must not answer the system search field with the titles of your documents. While the lock is on, Siri and Shortcuts cannot search your scans either, and on a locked iPhone Siri asks you to unlock it before it opens one.

None of this is a promise about a phone with no passcode on it. Data Protection has nothing to lock with until you set one.

Accounts and service identifiers

TruScan uses Firebase Authentication. You can continue without a personal sign-in, in which case the app uses an anonymous Firebase account identifier for cloud requests, usage limits and service security. If you choose Sign in with Apple or Google sign-in, Firebase also processes the provider identifier and any name or email the provider supplies; an existing anonymous account is linked to it. We do not receive your Apple or Google password. Service requests expose ordinary network information, including your IP address, to the services handling them.

Cloud sync

Cloud sync is optional and off until you sign in with Apple or Google and hold a TruScan Pro subscription or the lifetime unlock. It is never on for an anonymous account and never on for the free tier. What it copies is your scanned documents: the page images, their thumbnails and the document’s metadata. It does not copy the photographs in the Photos tab — see below. Everything is stored in Google Firebase (Cloud Firestore and Cloud Storage) on servers in the United States, under your account only, and your local library remains the offline copy on the device.

The untouched original of a page is uploaded only if you turn on “Include originals”, which is off unless you switch it on.

Without “Encrypt my library” on

This is the default, and everything a scan carries is readable on our servers. That means the page images and thumbnails, the title, the kind of document TruScan decided it is, its tags, the name of the folder you filed it in, its summary, the full recognized text of every page, and the fields TruScan extracted from it: for a passport or ID card, the name, document number, nationality, date of birth and sex read from the machine-readable zone; for other documents, any email address, phone number or postal address detected in the text. We do not read your documents, and nothing is used for advertising or to train models — but we could, and a policy that implied otherwise would be untrue.

With “Encrypt my library” on

You can turn on end-to-end encryption in Profile → Encryption (“Encrypt my library”). When it is on, every one of the fields above — including the kind of document and the recognized text — and every page image and thumbnail is encrypted on your iPhone before it is uploaded, with AES-256-GCM under a key derived from a passphrase you choose. For an encrypted library our servers hold only document and page identifiers, page count and order, image dimensions, timestamps, the key identifier, folder identifiers, folder order and dates, the storage paths of each page’s files — which reveal whether an original was kept — and encrypted data we cannot read. We cannot tell what kind of document it is, what it says, whose name is on it, or what your folders are called.

Your passphrase never leaves your iPhone. It is stretched on the device with PBKDF2-HMAC-SHA256 and used to wrap the key that seals your scans; what we store is the wrapped key, which is useless without the passphrase. We have no copy of the passphrase, there is no reset link, and there never will be one — that is what makes the promise above true rather than a policy.

The recovery code shown when you turn encryption on is the only other way in. It wraps the same key a second time, so it opens your library on a new iPhone if you forget the passphrase. Keep it somewhere safe. If you forget your passphrase and lose your recovery code, nobody can recover your synced scans — not us, not Apple, not Google. You can ask TruScan for a new recovery code at any time, which makes the old one stop working.

Turning encryption off re-uploads your synced scans without it, and the keys are destroyed only once that has finished. AI photo enhancement is unaffected either way: it works on photographs, which are never encrypted and never synced.

Turning sync off stops future synchronization; it does not by itself delete the copy already stored in your account. Deleting your account removes it — see Retention and deletion below.

Photographs are not synced

The Photos tab — pictures taken in Photo mode or imported from your photo library — stays on the device. Cloud sync does not copy it. The only way a photograph reaches our servers is if you enhance it, which is described next, and a photograph uploaded that way is kept in your account so you can go back to an earlier version.

Deleting a photograph in TruScan deletes its cloud copies too, as soon as the app can reach them. If the account that uploaded it is not the one you are signed in as, TruScan keeps trying under the right account and shows a row in Profile → Photos until it succeeds, rather than quietly giving up.

AI photo enhancement

This is the one feature that sends a picture to a model that reads it, and it is the named exception to everything above: it is a photograph you chose, one at a time, after you have agreed to it. Enhancement is an optional, per-photograph action. The app asks for your consent before the first enhancement. When you enhance a photograph, TruScan uploads that photograph to your account and sends it through Finn Digital’s enhancement service, which processes it with third-party AI models hosted by fal.ai. The enhanced result is stored in your account alongside the original, and earlier versions are kept so you can go back.

What is kept, and where: the photograph you selected is stored in your account, the enhanced result is stored beside it, and every earlier version is kept so you can go back to one — until you delete the photograph in the app, or delete your account, at which point all of them go. Enhancement never touches your scanned documents: only a photograph you choose, one at a time. The request includes the app’s authentication token and that one photograph. It does not include your document library. Your photographs are not used to train models — not by Finn Digital and not by the model providers under the terms we use. Provider-side processing, security and abuse-monitoring retention may apply while a request is handled.

Advertising, tracking and analytics

TruScan contains no advertising, no third-party advertising SDK and no tracking. It does not use an analytics SDK by default and does not request the advertising identifier. This version of TruScan links no crash-reporting or analytics SDK at all — there is nothing to opt out of. If a future version adds crash reporting it will be opt-in, and this page will say so before it ships. We do not sell personal data.

Purchases

Apple processes all payments. Your subscription status is read from Apple on your device and stays there — it is what unlocks Pro features and restores a purchase. We do not receive it on a server of ours, and we never receive payment-card numbers or your Apple Account password.

Photos, files and system permissions

TruScan asks for camera access to scan, and for photo-library access only when you import a photograph or save an export. Files you export — PDFs and images — go where you send them; once shared, copies held by a recipient are outside the app’s control.

Retention and deletion

Local scans stay on the device until you delete them or remove the app. When you delete a synced scan, it stays in Recently Deleted for 30 days; its copy on our servers is removed when you choose Delete Now or Delete All, or after 30 days. Anything else in your account stays until you delete it. Profile → Account → Delete account removes everything: the stored files, the document and photograph records, and the account itself. You may need to sign in again first. You can also request deletion by writing to [email protected]; we verify ownership before acting on a request and aim to respond within 30 days.

Limited transaction, fraud-prevention, security, backup and legally required records may remain where necessary. Deleting TruScan or your account does not cancel an App Store subscription; cancel that through Apple separately.

Children

TruScan is not directed at children under 13 and is not designed for unsupervised use by children. If you believe a child has provided information through the app, contact us and we will delete it.

Changes

We update the date on this page when the policy changes, and where practical announce material changes in the app.

Contact

Finn Digital LLC — [email protected].