Privacy Policy
Your documents stay on your phone. This page explains the small amount of information the app and its partners handle, why, and what you can do about it.
- We do not upload, read or store the files you scan, open, edit, sign or convert. All of that happens on your device.
- There is no account, no sign-up and no e-mail address is collected by the app.
- The free version shows ads (Google AdMob / Google Ad Manager). We use Google Firebase for crash reports, usage statistics and settings.
- We do not sell your personal information.
- Optional features (home screen launcher, after-call screen, weather, notification shortcuts) are off until you choose them.
- You can ask us to delete data, see how to delete your data.
Contents
- About this policy
- What stays on your device
- Information collected automatically
- Data types at a glance
- Install attribution
- Advertising
- Permissions and why we ask
- Optional features
- Notifications from OneDocument
- Third-party services
- Purchases
- How long data is kept
- Your rights and choices
- International transfers
- Children
- Security
- Changes to this policy
- Contact us
1. About this policy
This policy explains how OneDocument (“the app”, “we”, “us”) handles information when you scan, convert, edit, sign and manage documents on your Android device, and when you use the optional home screen (launcher), the after-call screen and the other optional features described below. “We” means the developer of OneDocument; you can reach us at paypal@rtbdemand.com. By using the app you agree to this policy. If you do not agree, please do not use the app.
2. What stays on your device
Files you open, scan, convert, sign or edit are processed on your device and are not uploaded to us. Scanning, text recognition (OCR), signatures, PDF tools and file conversions all run locally. Document content never reaches Firebase, AdMob or any other service listed in this policy.
These items are stored only on your device and are removed when you clear the app’s data or uninstall it:
- the files the app creates (saved in Documents/OneDocument or where you choose) and your recent files, favourites and file history list;
- your signatures and initials, language, theme, scanner and OCR settings;
- your Pro status and the time Google Play last confirmed it (so that a subscription keeps working for a short period when you are offline);
- your notification choices (which kinds of messages you want, see section 9), your scan streak and the counters used to count scans and tool limits;
- copies of the app’s remote settings (see section 3) and your launcher layout, hidden apps and permission-prompt counters;
- a short on-device diagnostics trail that the app keeps to help us fix problems (for example the last steps of a language change). It stays on the device unless you send it to us.
3. Information collected automatically
To keep the app working and to improve it we use Google Firebase:
- Firebase Analytics – usage events such as screens opened and tools used, and a few yes/no properties (for example whether you have Pro, whether the launcher is your default home app, the app language and whether ads are enabled).
- Firebase Crashlytics – crash reports and non-fatal errors with stack traces, app version, device model, Android version, free memory and the same yes/no properties.
- Firebase Performance Monitoring – start-up time, screen rendering and network request timings.
- Firebase Remote Config – downloads the app’s settings (for example ad frequency, which features are on, which tools are Pro). The request contains the app-instance identifier and basic device information.
- Firebase Cloud Messaging – delivers notifications and gives the app a device token (see section 9).
These services receive technical data such as the app version, device model, Android version, language, country (derived from your network by Google), crash traces and an app-instance ID or your Android advertising ID. They never receive the content of your files, your contacts, your call log or your phone number. Analytics and Crashlytics data is not linked to your name or e-mail address because the app does not have them.
Debug builds used by our developers do not send this data.
4. Data types at a glance
| Data | Collected? | Why | Shared with |
|---|---|---|---|
| Files, photos, scans, signatures | No (stay on the device) | – | – |
| Name, e-mail address, account | No (the app has no account) | – | – |
| Contacts, call log, SMS, phone number | No | – | – |
| Advertising ID and app-instance ID | Yes | Ads, analytics, crash reports, app settings | Google (AdMob, Ad Manager, Firebase) |
| App usage, tool and screen events | Yes | Analytics, improving the app | Google (Firebase) |
| Crash logs, performance timings, device model and OS version | Yes | Diagnostics, stability | Google (Crashlytics, Performance) |
| Notification token, device ID, and basic app status (app version, language, time zone, plan, country, device type, Android version, install source, most used tools, notification choices, simple usage counts) | Yes, to send you notifications | Delivering and choosing notifications, measuring whether they are useful | Google (Firebase Cloud Messaging) and our notification service |
| Install referrer (campaign or source of the install) | Yes | Measuring marketing | Google (Play, Firebase) |
| Approximate or precise location (optional) | Only if you allow it, only for weather | Show local weather on the launcher | Open-Meteo (coordinates only) |
| Purchase status | Yes (status only, no payment details) | Unlock Pro | Google Play |
| List of installed apps | Read on the device only | Build the launcher’s app drawer | Not uploaded or shared |
5. Install attribution
When you install the app from Google Play we read the install referrer, which tells us which campaign or source led to the install (for example a Google Play campaign, or an advertising click identifier). We use it to measure marketing performance and, for installs that came from a paid campaign, to switch on the app’s standard feature set for those installs. It does not identify you personally.
6. Advertising
The free version shows ads served by Google AdMob and Google Ad Manager. These services may use your Android advertising ID and device information to show and measure ads, to personalise them and to limit repeats. Ad formats include banners, native ads, interstitial and app-open ads and, where enabled, rewarded ads. Some ads open the advertiser’s or partner’s website in a browser tab (Chrome Custom Tab); that website then has its own cookies and privacy policy and we do not control it.
- Consent: where the law requires it (for example in the European Economic Area, the UK and some US states) we ask for your choice first using Google’s consent form (User Messaging Platform). You can change your choice at any time under Settings > Ad privacy options when it is shown for your region.
- Android settings: you can reset or delete your advertising ID and opt out of ad personalisation in Settings > Privacy > Ads on your device.
- Pro removes ads.
- We do not sell your personal information. Sharing the advertising ID with Google’s ad services as described here is how ads are delivered; US residents can use the opt-out controls above (limit ad personalisation).
See also How Google uses data from apps that use its services.
7. Permissions and why we ask
Permissions are requested only when a feature needs them and can be refused or revoked at any time in Android settings. The core document tools keep working without the optional ones.
- Camera – scan documents and QR codes. Photos are processed on the device.
- All files access / storage – list and open the PDF, Word and Excel files on your device and save the files you create. A file is read only when you open it or run a tool on it. Without this permission you can still use the system file picker.
- Notifications – messages from OneDocument (see section 9), the optional quick-access shortcut panel and the notice shown while the after-call service runs. You can refuse this permission and keep using the app.
- Phone state, display over other apps, full-screen notification and a foreground service – used only to show the optional after-call screen when a call ends. We learn only that a call ended and how long it lasted. No call log, contacts or phone numbers are read, stored or sent, and the screen is never shown during a call.
- Location (approximate or precise, optional) – show local weather on the launcher’s tools page. Only the coordinates are sent, to the Open-Meteo weather service, and are not stored by us.
- Home app role, list of installed apps, wallpaper and start at boot – work as your home screen when you choose OneDocument as your default launcher: build the app drawer and dock, show your wallpaper, and restart the optional after-call service after a reboot. The app list is used on your device only.
- Internet and network state – ads, Remote Config, news, weather, purchases and downloading on-device recognition models.
- Advertising ID – ads and analytics, see section 6.
8. Optional features
Launcher (home screen)
If you set OneDocument as your default home app it shows your apps, a dock, shortcuts, a clock and optionally weather and news. Launcher settings (layout, hidden apps, gestures, wallpaper choice) are stored on the device. Opening another app from the launcher may be preceded by an ad.
After-call screen
After a call ends, a screen with document shortcuts (Scan, Recent files, Merge, Sign and others) can appear. It only knows that a call ended and its duration. You can switch it off in Settings or by revoking the permissions.
Quick-access notification
A notification with four shortcuts (Scan, Recent files, Merge PDF, Sign PDF). It is created on the device, nothing is sent anywhere, and it comes back about 30 minutes after you dismiss it. Turn it off in Settings > Quick access notification.
Weather and news
The launcher’s tools page can show weather (your coordinates go to Open-Meteo) and news headlines (requested from NewsAPI and public news feeds). Those servers see your IP address like any website you visit. Opening a headline opens the publisher’s website in your browser.
Text recognition and scanning models
OCR, the document scanner and the barcode scanner use Google ML Kit through Google Play services. The recognition itself runs on your device. Play services may download language or scanner models over the internet the first time you use them; no document content is sent in that process.
9. Notifications from OneDocument
If you allow notifications, OneDocument can send you messages such as tips for your documents, a weekly recap, reminders, storage-cleanup suggestions, offers for Pro and news about app updates. To do this the app uses Google Firebase Cloud Messaging and a small notification service run for us at pushportalutility.serviceclic.com.
The app sends this service:
- the notification token that Firebase Cloud Messaging creates for your installation, and a device ID (the Android ID of your device for this app);
- basic app status: the app version, language, time zone, whether you have Pro, whether the app is your home (launcher) app, whether notifications and battery optimisation are on, and which kinds of messages you switched on or off;
- simple counts that let us avoid sending irrelevant messages: the number of files in your history, files and scans in the last 7 days and today, the time of your last scan, the number of large files, an estimate of the space compression could free, the number of times a free user tried a Pro tool, and the length of your scan streak. These are numbers only. No file names, file contents, contact details or location are sent;
- a few coarse facts used to group devices: your plan (free, weekly, six-month, lifetime or trial), your country (from the SIM or the device language setting), whether the device is a phone or a tablet, the Android version, whether the app was installed from Google Play, the names of the tools you use most (up to eight, such as “merge”) and the last tool you used, and a hash of your Google Play purchase token (never the token itself) so that your plan can be kept correct;
- when you receive, open, dismiss or tap a button on a message, a record of that action together with the message’s anonymous ID.
Where the law requires your consent for analytics (for example in the EEA and the UK) the counts and coarse facts above are sent only after you agree in Google’s consent form; without it the app sends only what is needed to deliver notifications and to respect your choices (the token, device ID, language, time zone, app version, whether you have Pro, whether notifications are on, and your notification choices). Requests carry a Firebase App Check token, which proves to our service that the request comes from the genuine app on a genuine device; it is not linked to you.
Our service is switched on or off from a settings page the app reads, and the app treats it as off whenever it cannot be reached. The information is used only to deliver and choose notifications and to see whether they are useful; it is not sold and is not used for advertising.
Your choices: in Settings > Notifications in the app you can turn notifications off and delete your notification data; where the screen offers it you can also choose which kinds of messages you receive. You can also turn notifications off, or mute individual message categories, in Android settings for OneDocument. Uninstalling the app invalidates the token. To delete the device record, use Settings > Notifications > Delete my notification data in the app (where shown, the same screen lets you copy your device ID for data requests; the button removes the record from our service, deletes the token and turns notifications off until you switch them on again), or see Delete your data.
10. Third-party services
OneDocument uses the following services. Each handles data under its own privacy policy.
- Google Play services and Google Play Billing
- Google AdMob and Google Ad Manager
- Google Firebase (Analytics, Crashlytics, Performance Monitoring, Remote Config, Cloud Messaging)
- The notification service run for us (see section 9).
- Google ML Kit (on-device text recognition, document scanner, barcode scanner)
- Open-Meteo (weather) and NewsAPI and public news feeds (headlines)
- Websites opened from ads, news items or links (Chrome Custom Tabs) are run by their owners.
11. Purchases
Pro subscriptions (weekly, six-month) and the lifetime unlock are handled entirely by Google Play. We receive only your purchase status (what you own and whether it is active), never your name, card or payment details. You manage or cancel subscriptions in Google Play (Settings > Manage subscription in the app opens it).
12. How long data is kept
- On your device: until you delete it, clear the app’s data or uninstall the app.
- Firebase Analytics: event-level data is kept for a limited period configured by us, not more than 14 months, then aggregated or deleted by Google.
- Crashlytics: crash reports are kept for 90 days.
- Notification service: the device record (token, device ID, app status and counts) is kept while the token works. When Google reports that the token is no longer valid (for example after an uninstall) the counts and choices are cleared at once and the record is deleted 30 days later. Records of messages sent and of events (shown, opened, dismissed) are kept 90 days. A request log (status, response time, app version and a short keyed hash of the network address; no request content, token or device ID) is kept 7 days. Deleting your data in the app removes all of it for your device.
- Advertising IDs and ad data: controlled by Google under its own policy; reset or delete your advertising ID in Android settings.
- E-mail you send us: kept for as long as needed to answer you and meet legal duties, then deleted.
13. Your rights and choices
- On your device: clear history in Settings, revoke any permission in Android settings, switch off optional features, change your ad consent, reset your advertising ID, or uninstall the app to remove everything stored on the device.
- Your legal rights: depending on where you live (for example the EEA, the UK under GDPR and UK GDPR, California under CCPA/CPRA, India under the DPDP Act and similar laws) you may have the right to access, correct or delete personal data, to restrict or object to processing, to withdraw consent and to data portability, and to complain to your data-protection authority. Because the app has no account and holds no name or e-mail address, most data we hold is tied only to an anonymous app-instance or advertising ID.
- How to use them: write to paypal@rtbdemand.com (see Delete your data). We answer within 30 days. We may need your app-instance ID or advertising ID (we explain how to find it) to locate what relates to your device.
- Legal bases (EEA/UK): consent for personalised advertising and analytics where required; our legitimate interest in keeping the app secure, stable and improving it; contract performance for purchases and the features you ask for.
- We do not make decisions that have legal effects on you by automated means, and we do not sell personal information.
14. International transfers
Google processes Firebase and advertising data on servers in various countries, including the United States. Google relies on recognised transfer mechanisms (for example standard contractual clauses and the EU-US Data Privacy Framework where applicable). Weather and news requests go to the providers’ servers wherever they are located.
15. Children
OneDocument is not directed at children under 13 (or under 16 in the EEA, or the minimum age in your country) and we do not knowingly collect their data. If you believe a child has used the app, write to us and we will help remove any related data.
16. Security
Documents are processed on your device and connections to online services use HTTPS. Stored settings that decide which tools are available are protected against tampering. No method of electronic storage or transmission is completely secure, so keep your device protected with a screen lock and updates.
17. Changes to this policy
We may update this policy, for example when we add a feature or a service. The date at the top shows the latest version. Material changes are announced in the app or on this page, and continuing to use the app after a change means you accept it.
18. Contact us
Questions or requests about your data? Write to paypal@rtbdemand.com with the subject “OneDocument privacy”.