Privacy Policy

Last Updated: January 22, 2026

1. Introduction

Welcome to CamDocs ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application CamDocs (the "App") and related services.

By using CamDocs, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not use the App.

2. Information We Collect

2.1 Information You Provide

Data Type	Purpose	Retention
Account Information Email address, password (encrypted)	Account creation and authentication	Until account deletion
Display Name Optional name you provide	Personalization	Until account deletion
Scanned Documents Images you capture or import	Core app functionality	Stored locally on YOUR device; Google Drive Sync available for Plus & Pro tiers (not our servers)
Payment Information Processed by Google Play	Subscription purchases	Managed by Google

2.2 Information Collected Automatically

Data Type	Purpose	Privacy Measures
Device Information Device model, OS version	App compatibility and troubleshooting	Basic info only, no unique identifiers
AI Usage Statistics Token counts, model used	Quota tracking and aggregate analytics	Anonymized - user IDs are hashed (one-way, cannot be reversed)
Login Activity Last login timestamp	Security and account management	Opt-in only - disabled by default, you must enable this

2.3 Information We Do NOT Collect

• Location data
• Contacts or address book
• Microphone recordings
• Browsing history
• Biometric data
• Your document content (stored only on your device/Drive)
• IP addresses
• Third-party analytics (no Mixpanel, Amplitude, etc.)

3. How We Use Your Information

We use the information we collect to:

• Provide Services: Enable document scanning, OCR text extraction, and AI-powered summaries
• Manage Your Account: Create and maintain your account, process subscriptions
• Improve the App: Analyze usage patterns to enhance features and fix bugs
• Communicate: Send service-related notifications (password resets, subscription updates)
• Ensure Security: Detect and prevent fraud, abuse, and security threats

4. AI Summary Processing

When you request an AI summary of your document:

• The extracted text from your document is sent securely (HTTPS/TLS) to our AI provider for processing
• We use third-party AI providers to generate summaries
• Document text is processed in real-time and discarded by the AI provider after processing
• Summaries are stored locally on your device for quick access
• Server-side caching may temporarily store summaries to avoid redundant AI calls for the same content
• You can delete your summaries at any time from your device
• AI usage is logged anonymously - we track token counts for quota management but cannot identify which user made which request

4.1 OCR Text Extraction

When you extract text from your documents using OCR:

• Text is processed entirely on your device - OCR extraction happens offline, locally on your phone
• Extracted text is stored ONLY on your device - we NEVER send OCR text to our servers
• We cannot see, read, or access your extracted text
• If you uninstall the app, your extracted text is permanently deleted

5. Data Storage and Security

5.1 Where Your Data is Stored

• Documents: Stored locally on YOUR device. Google Drive Sync available for Plus & Pro subscribers (we never access your Drive content).
• AI Summaries: Stored locally on your device for offline access. Server may cache summaries temporarily to avoid redundant AI calls.
• OCR Extracted Text: Stored locally on YOUR device only - never sent to any server (except when you request an AI summary)
• Account Data: Stored on secure cloud servers (Supabase) with encryption at rest
• Passwords: Hashed using bcrypt (12 salt rounds) - we never store plain text passwords
• AI Usage Logs: Anonymized with one-way hash - cannot be traced back to individual users

5.2 Security Measures

• All data transmission uses TLS/SSL encryption (HTTPS)
• Database encryption at rest
• JWT-based authentication with secure token handling
• Password reset via email only (admins never see passwords)
• Regular security audits and updates
• Access controls and monitoring
• Google Drive OAuth uses minimal scope (drive.file - only app-created files)

5.3 What We Cannot Access

• Your scanned documents (stored on your device)
• Your locally stored AI summaries (encrypted on your device)
• Your extracted OCR text (stored locally, only sent when you request AI summary)
• Your Google Drive files (you authenticate directly with Google)
• Your plain text password (we only store the hash)
• Individual AI request history (only anonymized aggregates)

6. Third-Party Services

We use the following third-party services:

Service	Purpose	Privacy Policy
Supabase	Database hosting (account data only)	Link
Google Play	App distribution, payments	Link
Google Drive	YOUR backup storage (you connect your own account)	Link
AI Providers	Document summarization	Processing only, no data retention

7. Data Retention

• Account Data: Retained until you delete your account
• Documents: Retained locally on your device until you delete them. Google Drive copies stay in YOUR Drive until you delete them.
• AI Summaries: Stored locally on your device until you delete the document or uninstall the app. Server-side cache retained temporarily for performance.
• OCR Text: Stored only on your device - retained until you delete the document or uninstall the app.
• AI Usage Logs: Retained indefinitely but fully anonymized - cannot be linked to individual users
• Login Tracking: Only retained if you opt-in; disabled by default

8. Your Rights and Choices

8.1 All Users

• Access: View your account information in the app settings
• Update: Modify your display name and password anytime
• Delete: Delete individual documents or your entire account
• Export: Export your documents in various formats (PDF, PNG, JPG)
• Privacy Controls: Enable or disable login activity tracking (disabled by default)
• Google Drive: Connect or disconnect your Drive at any time

8.2 European Users (GDPR)

If you are in the European Economic Area (EEA), you have additional rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Portability: Receive your data in a portable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

8.3 California Users (CCPA)

If you are a California resident, you have the right to:

• Right to Know: Know what personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell your data)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

9. Children's Privacy

CamDocs is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us to have the information deleted.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an in-app notification for significant changes

12. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

• Email: admin@camdocs.app
• Support: admin@camdocs.app

For GDPR-related inquiries, please include "GDPR Request" in the subject line. For CCPA requests, include "CCPA Request." We will respond within 30 days.