Last Updated: August 26, 2026
Your Privacy Matters: Everything you scan stays on your device. Your scan history, your Secure Vault, and your settings are never uploaded to us or to anyone else — we have no servers and no account system, so there is nothing for us to see.
One exception, stated plainly: QuickScan is free and supported by banner ads served by Google AdMob. Displaying an ad requires an internet connection and involves Google receiving your device's advertising identifier. This is the only part of the app that talks to the outside world, and it never has access to your scans or your vault. Section 2.7 explains exactly what this means and how to control it.
🔐 AES-256-GCM Encryption | 🛡️ Hardware-Backed Keys | 👆 Biometric Protection
1. Introduction
Welcome to QuickScan! This Privacy Policy explains how QuickScan ("we", "our", or "the app") handles your information when you use our privacy-first QR code and barcode scanning application with Secure Vault. We are committed to protecting your privacy with industry-leading security measures and ensuring complete transparency about our data practices.
By using QuickScan, you agree to the terms outlined in this Privacy Policy. If you do not agree with this policy, please do not use the app.
2. Information We Collect
2.1 Camera Access
QuickScan requires access to your device's camera to scan QR codes and barcodes. The camera is used exclusively for real-time scanning purposes. We do not store, transmit, or share any images or video captured by your camera.
2.2 Scan History
The app stores a local history of your scanned codes on your device. This data includes:
- Scanned code content (text, URLs, etc.)
- Timestamp of when the scan was performed
- Type of code scanned (QR code, barcode, etc.)
- Category classification (automatic)
Important: This scan history is stored locally on your device only and is never transmitted to external servers or shared with third parties.
2.3 Secure Vault (NEW - v1.3.0)
QuickScan now includes an optional Secure Vault feature for storing sensitive scans with military-grade encryption:
- Encrypted Content: Sensitive scans stored in the vault are encrypted using AES-256-GCM encryption
- Encryption Keys: Encryption keys are stored in Android Keystore (hardware-backed security)
- Initialization Vectors: Unique IV for each encrypted item (stored locally)
- Biometric Data: Device biometric authentication (fingerprint/face) is used to unlock the vault - we never access or store your biometric data
- Metadata: Category, label, expiration timestamp, access count, favorite status (stored locally)
Privacy by Design: Items saved to Secure Vault never appear in regular history. All vault data is stored locally on your device with hardware-backed encryption. We cannot access your vault data.
2.4 Smart Privacy Detection (NEW - v1.3.0)
QuickScan includes intelligent privacy detection that automatically identifies sensitive content:
- Pattern Analysis: Detects passwords, cryptocurrency addresses, private keys, and sensitive keywords locally on your device
- Processing: All detection happens on-device using pattern matching and entropy analysis - no data is sent to external servers
- Detection Results: Reasons for detection are shown to you but never transmitted externally
User Control: You can enable or disable smart detection at any time in Settings. Detection results are used only to provide privacy recommendations.
2.5 Biometric Authentication
If you use the Secure Vault feature, the app may request access to your device's biometric authentication (fingerprint or face unlock):
- We never access, store, or process your biometric data
- Biometric authentication is handled entirely by your device's secure hardware
- The app only receives a success/failure response from your device
- Your biometric data never leaves your device's secure enclave
2.6 App Settings
Your app preferences and settings are stored locally on your device:
- Theme preference (follow system, light, or dark)
- Sound and vibration settings
- Auto-detect sensitive content (enabled/disabled)
- Save scans to history (enabled/disabled)
- Vault items skip history (enabled/disabled)
- Vault auto-lock timeout and lock-on-background behaviour
- Clipboard auto-clear delay
- Auto-copy to clipboard
2.7 Advertising (Google AdMob)
QuickScan is free and is funded by banner advertising served by Google AdMob. This is the only feature that transmits anything off your device.
What Google receives when an ad is requested:
- Advertising ID: A resettable identifier assigned by Android to your device. It is not tied to your name or account, and you can reset or delete it at any time in Android Settings → Privacy → Ads.
- Device and network information: IP address, device model, operating system version, language, and approximate (coarse, IP-derived) location.
- Ad interaction data: Whether an ad was shown, viewed, or clicked.
What Google never receives:
- Anything you scan — no scanned content, URLs, WiFi passwords, or barcode values
- Your scan history, in whole or in part
- Any Secure Vault item, encrypted or decrypted, or any vault metadata
- Your encryption keys, which cannot leave your device's hardware keystore
The ad component is a self-contained view at the bottom of the screen. It has no access to the app's database or keystore. No advertisement is ever displayed on the Secure Vault screen or on any screen showing decrypted content.
Your controls:
- Consent (EEA, UK, and Switzerland): On first launch you are shown a consent form provided by Google's User Messaging Platform. No ad is requested until you have made a choice. You can change that choice at any time via Settings → Ad Privacy Options.
- Non-personalised ads: If you decline consent for personalised advertising, ads are still shown but are not based on an advertising profile.
- Reset or delete your advertising ID: Available in Android system settings, independently of this app.
- Content rating: We request that AdMob serve only ads rated G (general audiences).
Google's handling of this data is governed by its own privacy policy, available at policies.google.com/privacy, and by the Google Advertising Technologies notice at policies.google.com/technologies/ads.
Everything else in QuickScan works offline. Scanning, generating codes, history, and the Secure Vault all function with no network connection. Turning off networking simply means no ads are shown.
3. How We Use Your Information
The information collected by QuickScan is used solely for the following purposes:
- Scanning Functionality: Camera access is used to scan QR codes and barcodes in real-time
- Scan History: Stored locally to allow you to review previously scanned codes
- Secure Vault: Encrypted storage for sensitive scans with biometric protection
- Smart Detection: On-device pattern matching to identify sensitive content and provide privacy recommendations
- App Settings: To remember your preferences and provide a personalized experience
- Advertising: Your device's advertising identifier is used by Google AdMob to select and measure the banner ads that keep the app free (see Section 2.7)
4. Data Storage and Security
All data collected by QuickScan is stored locally on your device using storage mechanisms provided by the Android operating system. We implement the following security measures:
4.1 Standard Storage
- Regular scan history is stored in a local SQLite database (via Room) inside the app's private storage directory, which Android isolates from other apps. This database is not itself encrypted — if you want a scan encrypted, save it to the Secure Vault, which is (see 4.2).
- App settings are stored locally using Jetpack DataStore in the app's private storage. Settings are not encrypted; they contain only preferences, never scanned content.
- The scan history and Secure Vault database is excluded from Android cloud backup and from device-to-device transfer, so it is never copied to Google Drive or onto a new phone.
- No scanned content, vault data, or personal information is transmitted over the internet. Network access is used only to request advertisements (Section 2.7).
- We operate no servers and no cloud storage of any kind.
4.2 Secure Vault Storage (Military-Grade)
- Encryption Algorithm: AES-256-GCM (Advanced Encryption Standard with Galois/Counter Mode)
- Key Size: 256-bit encryption keys
- Key Storage: Android Keystore (hardware-backed, TEE/Secure Element)
- Authentication Tag: 128-bit GCM authentication tag for data integrity
- Unique IVs: Each encrypted item uses a unique initialization vector
- Keystore-Enforced Unlock: The vault key is bound to your biometric or device credential. The Android Keystore itself refuses to release it until you authenticate — the prompt is not merely a screen the app draws.
- Screenshot Protection: While the vault is unlocked, screenshots and screen recording are blocked and its contents are hidden from the app switcher.
- Clipboard Protection: Secrets copied from the vault are marked sensitive (so Android does not show them in its paste preview) and are wiped from the clipboard after a delay you choose.
- Auto-Expire: Optional ephemeral storage (1-72 hours) with automatic cleanup
What This Means: AES-256-GCM is a current, widely reviewed encryption standard, and your key lives in your device's hardware-backed keystore rather than in the app. Someone with physical access to your unlocked-but-not-authenticated device cannot read your vault.
An important consequence: because the key is tied to your device credentials, removing your screen lock causes Android to destroy that key, and vault items encrypted with it can no longer be decrypted. This is the same property that makes the protection real. If you may change or remove your screen lock, export an encrypted backup first — it is protected by a password you choose and is the only copy that survives.
5. Data Sharing and Third Parties
We never sell, rent, or trade your information, and we never share anything you scan.
5.1 What we never do
- Share your scan history or vault data with anyone, for any purpose
- Sell your data to advertisers, data brokers, or marketers
- Upload your scans, vault items, or settings to external servers or cloud services
- Transmit encryption keys or encrypted vault data off your device
- Use analytics, telemetry, or crash-reporting services
- Build a profile of you, or connect your device to any identity we hold
5.2 Our one third party: Google AdMob
QuickScan displays banner advertisements supplied by Google AdMob, a third-party advertising network. To do that, Google receives your device's advertising identifier along with device and network information, as detailed in Section 2.7.
We want to be exact about the boundary: Google is an advertising partner, not a recipient of your data. It receives what is required to select and measure an advertisement. It does not receive, and has no technical means of reaching, anything you have scanned or stored.
We receive no personal information from Google in return — only aggregate, anonymous statistics about how many ads were shown.
6. Permissions Required
QuickScan declares the following permissions:
- Camera (Required, prompted): To scan QR codes and barcodes. Without this, the core functionality cannot work.
- Internet and Network State (Automatic): Used solely to request and display advertisements, and to show the consent form where one is required. No scanned content, history, or vault data is ever sent over the network.
- Advertising ID (Automatic): Allows Google AdMob to read your device's resettable advertising identifier for ad selection and measurement. You can reset or delete this identifier in Android system settings at any time.
- Vibration (Automatic): Haptic feedback when a code is recognised. Can be turned off in Settings.
- Biometric / Device Credential (Optional, prompted): To unlock the Secure Vault. Only used if you use that feature. We never see your biometric data.
- Storage (Optional, prompted — Android 9 and older only): To save generated QR codes to your gallery. Android 10 and newer do not require this.
Permissions marked "prompted" require your explicit approval and can be revoked at any time in your device's settings, though revoking them will limit the corresponding functionality. Permissions marked "automatic" are granted at install time because Android classifies them as non-sensitive.
7. Data Retention and Deletion
You have complete control over your data:
- Scan History: Delete individual scan records or clear entire history anytime through Settings
- Secure Vault: Delete individual vault items or all vault data anytime. Deleted items are immediately and permanently removed.
- Auto-Expire: Vault items can be set to automatically delete after 1-72 hours
- Complete Data Removal: Uninstalling the app permanently deletes all locally stored data, including scan history, vault data, encryption keys, and app settings
Note: Due to hardware-backed encryption in Secure Vault, once data is deleted, it cannot be recovered - not even by us.
8. Privacy by Design
QuickScan implements privacy-first architecture:
- No Analytics: We use no analytics, telemetry, or crash-reporting SDK. We collect no usage statistics about you. The only third-party code in the app is Google's advertising library (Section 2.7).
- Offline First: Every feature except advertising works with no network connection
- Local Storage: All your data stays on your device — we operate no servers
- Excluded from Cloud Backup: Your history and vault are deliberately kept out of Android's automatic backup and device transfer
- Incognito Scanning: History can be switched off entirely, so scans leave no record at all
- Smart Detection: Automatically identifies sensitive content (passwords, crypto, private keys) on-device and recommends secure storage
- Vault Skip History: Items saved to Secure Vault never appear in regular history (default: enabled)
- Ads Kept at Arm's Length: No advertisement is ever shown on the Secure Vault screen, and the ad component cannot reach your data
9. Children's Privacy
QuickScan is a general-audience application. It is not directed at children, is not listed in Google Play's Designed for Families programme, and we do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction).
Because the app is ad-supported, we take the following measures:
- We request that AdMob serve only advertisements rated G (general audiences)
- We do not tag ad requests as directed to children, because the app is not a children's app
- We do not collect any information that would identify a user's age
If you believe a child has provided personal information through this app, please contact us using the details in Section 13 and we will act on it. Parents should supervise children's use of the Secure Vault feature.
10. External Links
When you scan a QR code containing a URL, QuickScan may offer to open the link in your device's web browser. Please note:
- We are not responsible for the privacy practices of external websites
- We recommend reviewing the privacy policies of any websites you visit
- Opening external links is always optional and requires your explicit action
- Sensitive URLs can be saved to Secure Vault instead of being opened immediately
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes:
- The "Last Updated" date at the top will be revised
- Significant changes will be communicated through the app or app store listing
- Continued use of the app after changes constitutes acceptance of the updated policy
12. Your Rights
As a user of QuickScan, you have the following rights:
- Access: Access all your stored scan history and vault items through the app interface
- Deletion: Delete any or all of your scan records and vault items at any time
- Export: Export your scan history to CSV/JSON format
- Control: Full control over when and how the app accesses your camera and biometric authentication
- Transparency: Clear visibility into what data is stored, encrypted, and protected
- Privacy Settings: Configure auto-detection and vault history behavior
- Biometric Control: Enable or disable biometric vault access at any time
13. Contact Us
14. Legal Compliance
QuickScan is designed to comply with applicable privacy laws and regulations, including:
- GDPR (General Data Protection Regulation): For users in the EEA. Because scan and vault data never leaves your device, we are not a data controller for it. For advertising, we rely on your consent as the lawful basis, collected through Google's User Messaging Platform before any ad is requested. You may withdraw consent at any time via Settings → Ad Privacy Options.
- UK GDPR and the Swiss FADP: The same consent flow and controls apply.
- CCPA / CPRA (California): We do not sell or share your personal information as those terms are defined. California residents may exercise their rights by contacting us (Section 13); note that we hold no personal information about you, so there is generally nothing for us to disclose or delete on our side — deletion is performed by you within the app.
- PIPEDA (Canada) and other regional privacy regulations
Because we hold no user data ourselves, most rights under these regimes are exercised directly on your device: view, export, and delete everything from within the app. Rights concerning advertising data held by Google are exercised through Google, whose policy is linked in Section 5.2, and through your device's advertising settings.
15. Security Incidents
In the event of a security incident:
- Because your scans and vault are stored only on your device and we operate no servers, there is no central database of user data that could be breached
- If a vulnerability is discovered in the app, we will release a security update as quickly as we are able
- Users will be notified through app store release notes and, where appropriate, in-app
- We encourage users to keep the app updated to the latest version
No software is free of defects. The measures described in this policy reduce risk; they do not eliminate it. Keeping your device's operating system current and its screen lock enabled remains the single most effective protection for your vault.
16. Consent
By installing and using QuickScan, you consent to:
- The collection and local storage of scan history as described in this policy
- The use of your device's camera for scanning purposes
- Optional use of Secure Vault with AES-256-GCM encryption
- Optional use of device biometric authentication for vault access
- On-device smart privacy detection (can be disabled)
- The storage of app settings and preferences locally on your device
Advertising consent is handled separately and explicitly. Where the law requires it, you are asked before any advertisement is requested, and your answer is recorded. Continuing to use the app does not imply consent to personalised advertising.
You can withdraw consent for specific features by disabling them in Settings, changing your choice under Settings → Ad Privacy Options, resetting your advertising ID in Android settings, or uninstalling the app.