Draft for publisher review. The developer’s legal name and release-specific ML Kit disclosures must be confirmed before publication.
About this policy
This policy describes how ScanNova, listed on Google Play as QR Code Scanner & Maker (package com.scannova.app), handles information. It also explains support correspondence and visits to these information pages. In this policy, “we” refers to the app’s publisher.
Legal developer / data controller: to be confirmed before publication. Privacy and support contact: karadagkemal76@gmail.com.
The app does not require an account. QR codes and barcodes can contain personal or confidential information, even when that information is processed only on your device.
Camera, gallery and permissions
ScanNova requests camera permission when you choose to allow camera access for live scanning. Camera controls include zoom and the flashlight where supported. You can deny or revoke this permission in Android settings; live scanning then requires permission to be restored.
When you choose an image from the gallery, Android provides access to the image you select. The app does not request broad photo-library or storage access. Creating a QR code does not require camera permission.
Optional vibration provides scan feedback. The app does not request access to your contacts, location, microphone or Android’s saved Wi-Fi passwords, and it does not request notification permission. Contact and Wi-Fi QR content comes from what you enter or scan.
On-device scanning and creation
Camera frames and selected images are processed on the device using Google ML Kit to identify QR codes and barcodes. QR creation also takes place locally. The reviewed application code does not upload camera images or QR payloads to a publisher-operated server or maintain a camera-image archive.
This local processing description is separate from the technical information that Google documents for its SDK, explained below. It should not be read as a claim that every component involved in running the app makes no network requests.
Records, Favorites and local protection
Records and Favorites are stored in the app’s private local database. QR and barcode payloads, including Wi-Fi passwords and Contact QR contents, are protected at rest with AES-GCM using an app-specific key held in Android Keystore. Existing unencrypted records are converted when the updated app first opens the database, preserving their record identity, date and favorite status.
Record metadata, such as format, category, date and favorite status, is not separately encrypted by this protection. Form and current-code values saved for screen restoration are encrypted, but values must be readable in memory while you view or use them. Encryption does not protect an exported QR image, the clipboard, the keyboard or a screenshot. Hardware-backed key storage is not guaranteed on every device.
If protected records cannot be opened, the app shows a storage error rather than silently replacing them with plaintext or deleting them. Losing the device-bound key can make records unrecoverable.
Wi-Fi codes and Save my details
A Wi-Fi QR code can contain a network name and password. A Contact QR code can contain a name, phone number, email address, address or other details you provide. These contents remain available in encrypted Records so you can use the code again. Anyone who can read a QR image you export may be able to recover the information it contains.
If you generate a Contact QR code with Save my details enabled, the remembered profile is stored in the app’s private preferences. This profile is separate from encrypted QR records and is not additionally encrypted by the record-encryption feature.
Turning Save my details off immediately clears the remembered profile. Older profile values left behind while the preference was off are cleared when the updated app starts. Turning it off does not automatically clear fields already visible in the current form or delete Contact QR records; use the record deletion controls for those records.
Retention and deletion
Records have no automatic expiry. Turning Add scans to history off prevents new scans from being automatically added; it does not remove existing records. Created QR codes and explicit Favorite actions may still create records.
You can delete an individual record from its menu. Settings → Clear all records removes all Records and Favorites, current form drafts and pending export values held by the app, and the app’s private QR sharing cache. A remembered Contact profile remains a separate preference; turn Save my details off to clear it.
QR sharing files older than 24 hours are cleaned up when another Share QR action runs. This is not a promise of deletion exactly 24 hours after creation. Logical deletion and database cleanup do not guarantee forensic erasure from flash storage.
Deleting records or uninstalling the app does not recall exported images, clipboard contents or copies held by recipients. Delete saved files through the gallery, file manager or chosen document provider and manage recipient copies separately. Cloud synchronization by a gallery or document provider is controlled by that provider.
Share, Copy, Save and external links
Share QR creates a PNG in the app’s private cache and offers it to an app you choose through Android’s sharing interface, using a temporary read grant. Share content as text sends the code’s text through the same user-initiated sharing flow. The receiving app handles that content under its own terms and privacy practices.
Copy places the selected content on the system clipboard. Paste reads clipboard text when you request it; the app does not continuously monitor the clipboard. Android, your keyboard and other apps with permitted clipboard access can affect how copied information is handled.
Save writes a QR image to the media collection on Android 10 and later. On Android 7–9, Android’s document picker lets you select the destination without broad storage permission. Saved images can contain the full underlying payload, including a password.
Opening a link launches an external browser. The destination may receive normal browser request information and applies its own privacy policy. ScanNova does not automatically open every scanned link.
Google ML Kit and technical diagnostics
ScanNova uses Google ML Kit barcode-scanning 17.3.0 with its model bundled in the app. Google documents technical information for bundled features, including per-installation identifiers, device and app details, performance, configuration and event/error metrics. The stated purposes are diagnostics and usage analytics; Google describes HTTPS protection for these transfers.
Google also describes using API metrics to maintain and improve its services and detect misuse. This is separate from the on-device processing of images and decoded contents. The reviewed ScanNova code does not enable ML Kit auto-zoom; its manual camera zoom controls should not be confused with that SDK option.
Google says the technical data listed in its disclosure is not passed onward to third parties. That statement does not establish that Google acts only on the publisher’s instructions, or settle whether a transfer to Google qualifies for a service-provider exception in Google Play’s Data Safety form.
The Android audit’s limited runtime observations did not establish release-specific transmission or its absence. They did not inspect Google Play Services communications, and one initial traffic baseline used the test package’s UID. No fixed SDK retention period or publisher-controlled remote-deletion procedure has been verified. Google’s general privacy and retention pages are linked below, but they do not establish a ScanNova-specific deletion deadline. Turning scan history off is not an SDK telemetry opt-out.
Publication review: confirm the exact release’s SDK data handling and the corresponding Google Play declarations before publishing. This draft does not conclude that the app collects no data.
Backup and security limits
The reviewed Android configuration disables app backup and excludes app databases and preferences from configured cloud and device-transfer paths. Device manufacturers and external providers can behave differently; this is not a guarantee about every transfer tool or every copy of exported data.
Record encryption reduces exposure of stored payloads. It does not mean all app data is encrypted, that a compromised or unlocked device cannot expose information, or that deleted information can never be recovered.
This website and support email
These information pages contain no advertising, publisher-added analytics or tracking scripts. The reviewed website code does not use cookies, localStorage or sessionStorage, and does not request third-party fonts, images or JavaScript. It has no account, web form, database or application backend. No tracking-cookie mechanism is included.
When hosted on Vercel, delivery and security of the website can involve processing request information such as IP address, browser information and requested URLs. Hosting-provider logging and retention must be confirmed for the production configuration; the lack of analytics scripts does not eliminate hosting infrastructure processing.
The support address karadagkemal76@gmail.com uses Google/Gmail infrastructure. If you email us, your email provider and Google process your address, subject, message and any attachments. We use the information you send to respond and investigate your request. Please do not send Wi-Fi passwords, confidential QR contents or unrelated personal information. No fixed support-message retention period or deletion completion time has been confirmed; these arrangements and any applicable legal obligations must be finalized before publication.
Questions and privacy requests
Contact karadagkemal76@gmail.com for privacy questions or requests about support correspondence, including a request to delete a message you sent. Identify the relevant correspondence without sending passwords or additional confidential QR content. Requests must be assessed under applicable law and the providers’ handling arrangements; the publisher has not yet confirmed a fixed retention period, response deadline or provider-backup deletion schedule.
Local Records are managed on your device; support has no publisher server copy to retrieve or erase through this website. We cannot remotely delete exported files, recipients’ copies or information controlled by third-party providers. Remote handling of any SDK technical information remains subject to the verification described above.
Depending on the law that applies, you may have rights of access, correction, deletion or other rights concerning your personal information. The applicable jurisdiction and publisher identity still require confirmation; no specific legal deadline is asserted in this draft.
Changes to this policy
This policy may be updated when the app or its information practices change. The last-updated date identifies the version shown here. Before publication, the publisher must confirm the legal developer identity, intended audience, applicable legal requirements and unresolved technical disclosures.
Looking for practical help?
Visit ScanNova Support →