Legal documents are available in full in Traditional Chinese and English.
PRIVACY
Privacy policy
Your history stays on your phone. Here is what happens when you submit a page.
更新日期 / Updated: 2026-10-19
This policy covers the Textoid OCR app and its recognition service, provided by the app service team. No account or login is required. An anonymous device identity still links your jobs, quota and subscription; “anonymous” does not mean that no device information is processed.
1. How documents are processed
- Captured, imported and edited documents and images are stored in the app’s private storage on your phone.
- Pages you submit for recognition go to our server, then to a third-party recognition service for OCR. Recognition requires an internet connection.
- Results return through our server to your phone for review, editing, search and export. Library organization, page order, bookmarks and notes are primarily managed on the phone. Recognition also sends the job title and necessary job information; this is not whole-library cloud sync. The server queues submitted tasks and retains uncollected results without a day-based expiry; it is not a whole-library cloud sync service.
- Documents or backups you choose to export or share go to the app or location you select. You manage those copies. Library content backups contain pages, saved image versions, text, edits, bookmarks and notes; they are not a backup of the entire app or its raw database. They exclude trash, identity credentials, quota, subscriptions and support conversations, and are not encrypted. Keep the index and every volume securely together. Ordinary document history is backed up separately in Settings.
- Pages you choose to print are prepared as local PDFs and handed to the operating system and your selected print service/printer. Processing and retention by that service, network and printer depend on their own settings and policies.
2. Information and purposes
- Document images, extracted text, tables, job status and technical details: recognition, download, retry, troubleshooting and recovery.
- Anonymous device and installation identifiers, and attestation information: device continuity, access control, abuse prevention and prevention of repeated introductory or referral grants. Depending on the platform, verification uses services such as Apple App Attest/DeviceCheck or Google Play Integrity.
- Quota and subscription records: page reservations, failed-page refunds, entitlement verification and store events. RevenueCat and the Apple/Google stores participate in subscription processing.
- Feature events and error reports: sent to our API to improve reliability. These may include app/OS versions, device model, error stacks, timestamps and anonymous device identity.
- Feedback you provide: messages, app version and optional images. Email support also receives your sender address and message contents.
- In-app support conversations: text you send, staff replies, message timestamps and the anonymous device link are used to respond to questions and synchronize conversations and unread status. Documents and images are not attached automatically.
- Network and security information: the API protection service processes IP addresses and inferred country/approximate location for traffic statistics, abuse prevention and service security. The app does not read precise GPS location.
3. Retention
| Information | Retention and cleanup |
|---|
| Server document images | Accepted images in new tasks have no age-based expiry. Images belonging to completed but unacknowledged new or legacy work are not removed by age either. Explicit deletion or confirmed receipt enables cleanup under the retention policy; incomplete legacy uploads retain their original timeout handling. Images stay on server-local disk, not object storage or a CDN, and are excluded from operational backups. |
|---|
| Server OCR results | Uncollected results from both new tasks and legacy jobs have no day-based expiry. Confirmed receipt enables cleanup under the retention policy; explicit deletion requests can still remove related data. |
|---|
| Feature events | 395 days, followed by database expiration cleanup. |
|---|
| Error reports | 90 days, followed by database expiration cleanup. |
|---|
| In-app feedback and attachments | 365 days. Attached images also stay on server-local disk. |
|---|
| In-app support conversations | Your messages and staff replies are retained until you use Clear my data. Conversations are linked to your anonymous device identity and are not part of library backups. |
|---|
| Documents on your phone | Deleted books/pages generally enter local trash for about 7 days and are removed through app cleanup after expiry. Restoring local content during that period does not restart canceled recognition. Other content remains until you delete it or app data is cleared. Uninstalling, changing devices or device damage may remove local content. |
|---|
| Operational database backups | The latest 14 backups are retained, excluding document and feedback images. Previously backed-up data ages out through rotation; each deletion request does not rewrite all existing backups. |
|---|
Anti-abuse device fingerprint hashes, grant eligibility and deletion status are retained as needed to prevent repeated grants. Some quota/purchase audit records remain after device links or raw content are removed. Support email is retained as needed to handle and follow up on the request; contact us about its handling. Expiration cleanup depends on scheduling and system operation, rather than instantaneous erasure.
Offline recognition and user statistics
Free basic offline recognition runs on your phone with bundled models. Images and recognized text are not uploaded for this processing, and no subscription or cloud credits are needed. Documents are sent to our server only when you choose cloud recognition. Separate connected features such as update checks, purchases, support and optional notifications retain their stated purposes.
When connected and anonymously verified, the app may report foreground status and time to our own server for a five-minute online-device count. It does not continue reporting in the background; offline-only use cannot be counted. Counts represent devices, not unique people. A new device’s first successful connection triggers one internal Telegram operations notification containing only the app name, platform, random event reference and protected admin link, without document content or device identifiers. Sent signup notification records expire after at most 30 days. The latest foreground state is removed with device data.
4. Processing services and identity recovery
The third-party recognition service receives submitted OCR images. Our server requests deletion of provider results after processing and retries unsuccessful cleanup. We do not promise immediate, simultaneous deletion of every third-party copy.
RevenueCat and the app stores handle purchase, restore, renewal and refund entitlements. An anonymous device identifier is used as the subscription identity; no separate app account is required.
Android Block Store: Google Play services helps store/recover anonymous device identity, installation identity and refresh credentials. Its cloud backup is enabled only when end-to-end encrypted backup is available. Document images and text are excluded; this is not cloud document backup. Recovery remains subject to device/platform conditions and backend verification.
Internal support and subscription notifications through Telegram: New support messages and subscription, cancellation-of-renewal and refund events trigger Telegram notifications to our internal team for customer support and subscription operations. Support notifications contain only the app name, notification type, a random conversation reference and a protected admin link. Subscription notifications contain only the app name, event type, environment label (production, test or unknown), verification status, an event reference and a protected admin link. Notifications exclude message text, documents, device identifiers, orders or receipts, amounts and payment-card data. Event references support internal lookup and do not make user records publicly accessible.
The app uses no advertising or third-party analytics SDKs. Processing services operate under their applicable terms. Contact the service team for further information about processing locations and practices.
Android completion notifications: New versions may use Google Firebase Cloud Messaging (FCM) and its required installation identity service. They process push registration tokens, installation identifiers and device/connection information needed for delivery. Notifications contain only random task references, result revisions and generic completion text, never document titles, images or recognized text. Firebase Analytics, Crashlytics and other analytics services are not used. You may decline or disable notifications in system settings and still open the app to collect results. Our server retains the latest push token until rotation, invalidation, unregistration or Clear my data. Notification queues expire after at most 28 days; this does not change retention of uncollected OCR results.
5. Deletion and your choices
Delete an individual document, or use Settings → Clear my data to request clearing of local and related server data. Full clearing requires a connection: the app waits for server confirmation before clearing local documents and identity credentials. If offline or the request fails, do not assume everything has been erased; reconnect and retry.
The server flow deletes document images, results, jobs, related feedback, in-app support conversations and pending support notifications, revokes refresh credentials and schedules provider-result cleanup. The anti-abuse records, audit records, backup rotation and third-party store records described above are not guaranteed to disappear immediately. Exported, shared or independently saved copies cannot be deleted remotely by us.
Clearing data or uninstalling does not cancel a subscription or reset introductory-page eligibility. Manage subscriptions through the original store. Back up important documents first.
If you cannot use the app, email us for deletion assistance. We may need minimal information, such as an anonymous device or job ID, to identify the data. Do not send passwords or private documents. An email address that is not linked to the app may be insufficient to locate anonymous records.
6. This website and updates
This static website embeds no analytics, advertising, external fonts or tracking cookies. Language selection only changes the displayed version and URL parameter. Email links open your mail app; official store-help links take you to those services. Policy changes will update the date on this page. Contact us with questions.
