Norvela Scanner privacy policy

What the app stores, and where

Everything the app records lives in its own storage area on your device, in plain files that no other app can read:

The page images — the photographs themselves, as ordinary JPEG files.
The text read off them — plus any corrections you typed, and the headings, lists and tables that were recognized.
Your markup — the arrows, circles, highlights, notes and signatures you drew, stored as drawings rather than being burned into the page.
A small manifest per document — its title, the date you scanned it, the order of its pages, and which filter each page uses. It is readable JSON, on purpose: if this app ever stops working, your documents are still a folder of images and a text file describing them.
Signatures you saved — kept with your library so that you can reuse them, as small images of the ink you drew.
Your About Me card, only if you fill one in — the name, address, phone and email the app can offer when a scanned form has blanks for them. It is a file on this device alone, encrypted by iOS while the phone is locked, and deliberately not part of the iCloud library. Nothing from it is written onto a page until you accept that suggestion, and the app never fills the card in for you — not from Contacts, not from your Apple Account, not from a scan. Clear its fields to remove them.
How many scans you started this month, and, if you subscribe, Apple's signed record that Scanner Unlimited is active (in the Keychain). See Purchases.
Two settings — whether you have seen the introduction, and a durable identifier for this installation, held in the Keychain.

That identifier deserves a sentence, because it is the only thing in the app that could be called an ID. It is a random value generated on this device, it is never attached to anything that leaves the device, and it is never sent anywhere, because nothing is sent anywhere. It exists so that a future version could offer an account without losing your documents. Today it identifies you to nobody, including us.

There is no profile, no contact list, no location, no calendar access and no address book. The About Me card is the one place the app holds your own details, and only the ones you typed into it.

What the app sends

Nothing, to us.

Norvela Scanner has no server to talk to. It links no analytics library, no crash reporter, no advertising framework and no third-party SDK of any kind — that last one is a studio-wide rule, not a claim about this release. The app opens no sockets and makes no requests of its own. If you put the device in airplane mode, every feature works exactly as it did before: scanning, reading the text, editing it, marking it up, signing it and exporting it are all local operations.

What iOS sends on your behalf is a different question, and the honest answer is iCloud Drive. The app writes your library into its iCloud container as ordinary files; the system, not the app, copies those files between your devices and Apple's servers. That is the same mechanism that syncs any Files-app folder, it runs under your Apple Account, and it is described in full in the next section.

The other exceptions are the ones you cause, and they are not the app: tapping a link on this page or the support page opens your browser, and sharing a document hands it to whichever app you chose in the share sheet. What happens after that is between you and that app.

Your library and iCloud Drive

This app may be holding the only copy of a page whose paper original went in the bin. Keeping that on one device, recoverable only if a backup happened to be on and you happened to choose “restore from backup” at the right moment, is a thin thread. So when iCloud is available the library lives in the app's iCloud container instead.

It is your iCloud, not ours. The files sit in your iCloud Drive under Norvela Scanner, visible in the Files app, counted against your storage, governed by your Apple Account. Norvela LLC has no key, no console and no copy.
The folder is deliberately visible. You can open it in Files, read the page images as ordinary JPEGs and the manifests as readable JSON, and copy the whole thing somewhere else. If this app ever stops working, your documents are still a folder of pictures and a text file describing them.
iCloud is optional and the app does not need it. Not signed in, disabled for this app, or no network on first launch — the library simply stays on the device and every feature still works.
Moving in copies and never deletes. When the library moves into iCloud the on-device copy is left exactly where it was, untouched, as a fallback.
Deleting the app does not delete the iCloud folder. Because the folder is visible in Files it outlives the app, on purpose — losing somebody's receipts by uninstalling is not a behavior we want. To remove it, delete it in the Files app or in iCloud Drive settings.

What Apple does with data in iCloud is governed by Apple's own privacy policy and by your settings, including Advanced Data Protection, which end-to-end encrypts iCloud Drive if you turn it on.

The camera

Scanning needs the camera, and iOS asks your permission the first time you tap New Scan — not at launch, and not before you have asked for anything.

The camera is used only while that screen is open. There is no background capture, no video recording, and no preview frame is kept: the app receives the pages you chose to keep and nothing else. The photographs are written into the app's own storage and never to your photo library.

You can revoke the permission at any time in Settings → Privacy & Security → Camera, or in Settings → Norvela Scanner. The app will then say so plainly and offer you the import path instead, rather than appearing broken.

Photos and files you import

You can bring in a picture from your photo library or a PDF from Files instead of using the camera. Neither of those asks for a permission, and that is not an oversight.

Choosing photos uses the system photo picker, which runs outside this app: iOS shows you your library, and the app receives only the specific images you picked. It never gets access to the library itself, so there is nothing to grant and nothing to revoke. The file picker works the same way.

The app has no permission to add anything to your photo library, and cannot.

Reading the words off a page

Turning a photograph into text is done by Apple's Vision framework, which is part of iOS and runs entirely on the device. The image is analyzed in memory; the words, their positions, and any headings, lists and tables come back; nothing is uploaded and no third party is involved.

The app also runs a quick check on each capture for a smudged lens, so it can suggest a retake before you throw the paper away. That check is on-device too, and it looks at the photograph you just took and nothing else.

The assistant

A document has an Ask tab where you can put a question about the page in front of you. It is answered by Apple's on-device foundation model, using only the text that was read off that page.

The feature is off unless your device has Apple Intelligence and you have turned it on. On a device without it, the tab says so in a sentence and everything else in the app works normally — the app does not need it and does not fall back to a server, because there is no server.

When it is available, the model runs on the device. Your document is not uploaded, not used to train anything, and not retained after the conversation ends. What Apple Intelligence does and does not do is governed by Apple's own privacy terms, which you can read in Settings.

Search

So that you can find a scan later by what is printed on it, the app adds each document's title and text to Spotlight — the search index built into iOS. That is how a scan turns up when you search from your Home Screen.

The index is on your device and is managed by iOS. It is not a service we run and we cannot read it. Deleting a document removes it from the index in the same action, and deleting the app removes everything it ever donated.

Exporting writes a file — a PDF, a Word document, a spreadsheet, Markdown, rich text, CSV, plain text or a JPEG — into a temporary folder on your device and then hands it to the standard iOS share sheet.

The app does not upload anything to Google Drive, Dropbox, OneDrive or anywhere else. Those apps appear in the share sheet because you have them installed, and iOS puts them there. When you pick one, iOS passes the file to it and this app's involvement ends. Whatever you send then falls under that app's privacy policy, not this one.

PDF passwords

A PDF export can be password-protected. The password is used once, to encrypt that file, and is not stored anywhere — not in the document, not in the app, not in the Keychain, and certainly not with us.

That means nobody can recover it, including us. The app says so before you export, which is the only honest place to say it.

Tracking and advertising

There is none. The app does no tracking as Apple defines it, contains no advertising, and never presents an App Tracking Transparency prompt because there is nothing to ask about. Its bundled privacy manifest declares no collected data types and no tracking domains.

It declares two required-reason API categories, both of which are housekeeping: reading its own preferences, and checking there is enough free space before writing a file. Neither reads anything about you or your device.

Crash reports and diagnostics

The app collects no diagnostics of its own and sends none. It writes messages to the system log while it runs, which is the same log every app writes to; those stay on your device, and anything that could contain your document's contents is redacted by the system before it is written.

Separately, iOS itself can send crash reports to developers if you have turned that on in Settings → Privacy & Security → Analytics & Improvements → Share With App Developers. That channel belongs to Apple, not to us: Apple decides what it contains, Apple removes identifying information, and we see only aggregated, anonymized reports through Apple's developer tools. If that setting is off, we receive nothing at all. Nothing in this app influences it either way.

Children

Norvela Scanner is a document tool and is suitable for any age. Because it collects no personal information from anyone, it collects none from children. There are no accounts, no messaging, no social features and no advertising. The one purchase, Scanner Unlimited, goes through Apple and its parental controls (Ask to Buy).

We do not knowingly collect personal information from children under 13, and could not do so without rewriting the app, because there is no mechanism in it that transmits anything.

Purchases

Norvela Scanner is free for five new scans a month. Scanner Unlimited, a yearly subscription that renews automatically, removes that count. Nothing you have already made is ever locked: opening, editing, signing and exporting stay free.

Purchases are handled entirely by Apple, under your Apple Account. When you buy, restore or redeem a code, iOS talks to the App Store on your behalf — the same way it does for any app. We never see your name, your Apple Account or your payment details. The app receives only Apple's signed record that the subscription is active, keeps it in the device Keychain so the app still knows when you are offline, and sends it nowhere.

The count of this month's scans is a number kept on this device. It is never sent anywhere. Manage or cancel the subscription in Settings → your name → Subscriptions, or from the app's own Settings screen.

Deleting everything

Delete the app. Everything it stored goes with it, because everything it stored was inside it. There is no copy on a server for us to delete, no account to close, and nothing to email us about.

To remove one document instead, use Move to Trash from its menu. It stays in the app's own Trash until you empty it — deliberately, because this app may be holding the only copy of a page whose paper original went in the bin. Emptying the Trash removes the files and withdraws the document from Spotlight.

Two copies means two deletions. If your library is in iCloud Drive, removing the app from the device does not remove that folder — delete Norvela Scanner in the Files app or in iCloud Drive settings as well. And if you have iCloud Backup turned on, your device backup may include the app's files in the same way it includes every other app's. Both are between you and Apple; we have no access to either.

Your rights

Privacy laws including the GDPR and the CCPA give you rights to access, correct, export and delete the personal data a company holds about you, and to know whether it is sold or shared.

We hold none. Norvela LLC has no database containing you, receives nothing from this app, and sells and shares nothing because there is nothing to sell or share. Your data is already entirely in your possession, on your device, under your control — and the app can hand you every document as an ordinary file at any time. You are welcome to write to us to confirm that, and the answer will be this paragraph.

Changes to this policy

If a future version of the app ever collects or transmits anything, this policy will be updated and the date at the top will change before that version is submitted to the App Store — not after. The app's App Store privacy label and its bundled privacy manifest would change in the same release.

Contact

Questions about this policy, or about anything the app does with your data: support@norvela.app.

Norvela LLC, United States. See also the Norvela Scanner support page.

Norvela Scanner — Privacy Policy