Legal
Privacy Policy
This Privacy Policy explains how Scanny (distributed as “Sherlock” in some App Store regions) — the mobile application (“Scanny” or the “App”) and its related services (together, the “Service”) — handles information: what the Service does, what it collects, who it is shared with, where it is processed, how long it is kept, and the choices you have.
1. Who we are and scope
The Service is operated by the developer of Scanny, the seller named on the App’s App Store product page (“we”, “us”, “our”). We are the controller of the personal information described in this policy.
This policy covers information processed through the App and our servers. It does not cover the third-party websites that appear in results, or third-party services that operate under their own policies (see Section 8). The website at scanny.online consists of static pages that set no cookies and contain no analytics or third-party scripts. By using the Service, you agree to this policy.
You can reach us about privacy at support@scanny.online.
2. Summary at a glance
This summary is for convenience only; the numbered sections below are what govern.
- What it does: tells you what is in a photo — a plant, an animal, a dish, a product, a coin, a landmark, text, and more — and, in a face search, finds public web pages where a visually similar face or the same picture appears. It does not tell you who a person is.
- What we collect: the photos you choose to submit (or the part of a photo you frame), the results we produce, a random identifier created by the App, your purchase status, and limited technical data. No name, email address, phone number, or account, and no access to your location, your contacts, or your photo library beyond the single photo you pick.
- Who processes it: our cloud hosting and storage provider; AI image-analysis providers; face-search, reverse image search, and visual search providers; identification databases and reference sources; Apple and our subscription-management provider; and, if enabled, a product analytics provider.
- Retention: the photos you scan are not stored on our servers. For a paid face search we keep a small thumbnail and the results as your history until you delete them. Photos of past scans stay on your device.
- We do not sell your personal information, use your photos for advertising, or use them to train our own models.
3. How the Service works
3.1 Before anything is sent
You take a photo with the camera (which requires your permission) or pick one with the iOS photo picker, which gives the App only the photo you select — not access to your photo library. The App resizes and re-encodes each photo before sending it, so the location (GPS) data and other metadata embedded in the original file are not sent. The App does not ask for access to your device’s location.
3.2 Scanner
The App sends the photo to our server, which reduces it in size and sends it to an AI image-analysis provider to recognize the main subject and draft a result in the App’s language. For a paid scan, depending on what the photo shows, we may also send:
- the photo to an identification service (for plants, insects, and mushrooms), to an image-recognition service (for landmarks), and to a reverse image search provider (for the similar-photos section);
- the photo to a visual search provider to find matching products and their prices — for this lookup, a copy is placed in our private cloud storage behind a link that expires within five minutes, and we delete it as soon as the lookup ends;
- only text, such as the recognized name, to encyclopedias, catalogs (for example, of coins), nutrition databases, shopping search, and a mapping and places provider. The places provider receives the name and coordinates of the recognized landmark — never your location.
For photos of text and documents, the AI provider reads out and translates the text; we never run a reverse image search on them. When a photo shows a person, the scanner describes only what is visible and does not attempt to identify or name the person.
The photo you scan is not stored on our servers. We store the text result (Section 4.2).
3.3 Face search
You frame a face in a circle. Before uploading, the App checks on your device, using Apple’s Vision framework, that the framed area contains a face; if it does not, nothing is uploaded for the face search. The App then uploads only the framed square area — not the whole photo — to our private cloud storage.
If you have a paid search available, our server sends that image to a face-search provider or a reverse image search provider (depending on which search engine we use at the time), which returns pages where a visually similar face or the same picture appears. If you have no paid search available, we do not run the search, and we delete the upload immediately.
Results consist of links to public web pages, the name of each website, the public handle or page title shown for the link where available, a small preview image of the matching picture, and, where available, a similarity score. Any names or other personal information on those pages are published by the third-party websites, not by us. We filter out certain results, such as adult websites.
3.4 “On this photo” and prices
When you start a face search, the App also sends the full photo you picked (resized as described above) to our server, which forwards it to an AI image-analysis provider for a short description of the photo and the things in it, such as clothing and accessories. This happens whether or not a face is found and whether or not you pay for the search. The description never identifies or names the person.
After a paid face search, the App may send cut-outs of up to two of those things — chosen so that they do not overlap a face detected on your device — so that a visual search or shopping search provider can return a starting price.
4. Information we collect
4.1 Photos you submit
The photos, framed areas, and cut-outs described in Section 3 — only the ones you choose to submit, and only when you start a scan or a search.
4.2 Results and history
- Face search. For a paid search: the results described in Section 3.3 and a thumbnail of the framed area (about 256 pixels on its longest side) that replaces the uploaded image, with the date and the search engine that answered. For a failed search: a record without any image — the time, the status, and a technical description of the error. Free previews are not stored.
- Scans, including “On this photo.” The text result — the category, name, description, facts, warnings, the list of things detected in the photo with their positions, links, and web addresses of reference and similar pictures — and the AI model’s structured answer, kept so that unlocking a teaser later does not analyze the photo again. Teasers are stored too, so that you can unlock them later. We do not store the photo.
- Price lookups. A record that a lookup was made for a given face search, so that we can limit their number.
- On your device. Photos of past scans are saved on your device only (resized, and protected with iOS data protection) so that your history can show them and a teaser can be unlocked later. If you share a photo to the App from another app, it is held on your device until the App opens it and is then removed. Plant-watering reminders, if you turn them on, are scheduled on your device; we do not receive them.
4.3 Identifier and technical data
- Random identifier. Created by the App on first launch and stored in your device’s Keychain. It is not derived from your name, email address, phone number, Apple ID, or the device’s advertising identifier. It is how our servers and our subscription-management provider recognize your installation. It may remain on the device after the App is deleted and be used again if you reinstall the App on the same device.
- Settings requests. When the App loads its settings, it sends your App Store country or region, a one-way hash derived from the identifier, whether it is a test build, and whether onboarding is complete. We use these to configure the App and to roll out features gradually, and we may record which installations received a feature.
- App language. Sent with scans, so that results come back in the App’s language.
- Server logs. Our servers log technical information about requests — the time, the endpoint called, the response status and duration, a shortened form of your identifier, and event details such as the category of a scan or the number of matches. Logs may also include network information, such as an IP address, that reaches our servers.
- Support emails. “Contact support” in the App’s Settings prepares an email containing a shortened reference to your identifier, the App version, your device model, and your iOS version. If you write to us, we also receive your email address and whatever you include.
4.4 Purchases
Apple processes all payments; we never receive your payment-card number. Through our subscription-management provider we receive information about your App Store purchases linked to your identifier — the product, transaction identifier, dates, price and currency, and renewal, cancellation, and refund events — and our servers ask that provider whether your subscription is active. We keep your coin balance, records of coin purchases and refunds, how many subscription searches you have used in a period, any one-time free coins, and your referral code and redemptions.
4.5 Advertising attribution
If the App was installed after you tapped an Apple Search Ads advertisement, iOS provides an attribution token. The App sends it to our server, which asks Apple’s attribution service whether the installation came from an ad and, if so, which campaign, ad group, keyword, and ad, the country or region, and the conversion type. We store this with your identifier to measure our advertising. Our subscription-management provider may also receive this token. This does not use the device’s advertising identifier (IDFA) or track you across other companies’ apps or websites, and the App does not show the tracking permission prompt.
4.6 Product analytics
We may use a product analytics provider to understand how the App is used. When it is enabled, the App sends: events such as the App being opened; onboarding steps and your answers to onboarding questions (for example, how you heard about the App and what you want to scan); a photo being selected and from where (camera, library, or share sheet); a paywall being shown or closed; a purchase being completed (the product); a search starting and results being shown (counts and scores); a result link being opened or copied (the type of website and its position — never the link); invite actions; and errors. With them go your random identifier and the experiment variant you see. The provider’s software may also collect standard device and app information (such as device model, operating system and app version, and language) and may derive an approximate location, such as a country or city, from your IP address. Analytics never include your photos, results, or links.
4.7 What we do not collect
We do not collect your name, email address (unless you email us), phone number, contacts, or device location; we do not access your photo library beyond the photo you pick; we do not use the advertising identifier; and we never receive your payment-card details. Map locations shown in landmark results come from recognizing the landmark, not from your device or your photo’s metadata.
5. How we use information
We use the information above only for the purposes below.
| What we use | Purpose |
|---|---|
| Photos, framed areas, and cut-outs you submit | Produce the result you request — the scan, face search, description, price, or similar photos — by processing them on our servers and sending them to the providers in Section 8. Not used for anything else. |
| Results, history thumbnails, and teasers | Show your results, let you review your history, and let you unlock a teaser later. |
| Random identifier, technical data, and logs | Operate and secure the Service, apply usage limits, prevent fraud and abuse, troubleshoot, and provide support. |
| Purchase and subscription information | Provide paid features, keep balances accurate, handle refunds, and keep accounting records. |
| Settings requests (country or region, hashed installation ID) | Configure the App and roll out features gradually. |
| Advertising attribution | Measure the effectiveness of our advertising. |
| Analytics events | Understand how the App is used and improve it. |
| Purchase and usage data (“consumption information”) | Only if you request a refund from Apple: help Apple decide your request (Section 9). |
We, and people we authorize, may access stored data when needed to operate, troubleshoot, secure, and improve the Service, to answer support requests, and to investigate abuse.
We do not use your photos to identify people, to build, sell, license, or contribute to any facial-recognition database, to train our own models, for advertising, or for profiling.
6. Legal bases (EEA, UK, and similar laws)
Where these laws apply, we process information on the following bases:
- Contract: to provide the features you request and to process your purchases.
- Consent: to process the image you submit for a face search, which some laws treat as biometric data. You give it by submitting the image and starting the search, and you can withdraw it by deleting your history and not using the feature.
- Legitimate interests (or your consent, where the law requires it): to secure the Service, prevent fraud, troubleshoot, measure our advertising, and understand and improve the App.
- Legal obligation: to keep accounting records and respond to lawful requests.
7. We do not sell your data
We do not sell, rent, or trade your personal information, and we do not “share” it for cross-context behavioral advertising. We disclose information only to the service providers described in Section 8, only to operate the Service, and only for the purposes stated. We may also disclose information if required by law or valid legal process, or to protect the rights, safety, or security of our users, the public, or us.
8. Who we share information with
We share information only with the categories of service providers below, only as needed for the feature you use, and only for the purposes in Section 5. They process it under their own terms and privacy policies, which we do not control.
8.1 Cloud hosting and storage providers
Host our servers and database, and store uploaded images, history thumbnails, and the temporary copies used for product lookups.
8.2 AI image-analysis providers
Receive the photo you scan, the photo sent for “On this photo,” and, for some results, the recognized name; they return the recognition, description, facts, and text readings and translations.
8.3 Face-search, reverse image search, and visual search providers
Receive the framed image for a face search; the photo for the similar-photos section and for landmark recognition; and the photo or a cut-out for product and price lookups. They return links to matching pages and preview images of matching pictures.
8.4 Identification databases and reference sources
Plant, insect, and mushroom identification services receive the photo. Encyclopedias, coin catalogs, nutrition databases, museum collections, shopping search, and a mapping and places provider receive only text queries, such as the recognized name (and, for a landmark, its coordinates).
8.5 Apple and our subscription-management provider
Apple processes payments and refunds. Our subscription-management provider receives your random identifier and your App Store purchase records, validates purchases, tells our servers whether your subscription is active, and may receive the advertising-attribution token described in Section 4.5.
8.6 Product analytics provider
If enabled, receives the events and information described in Section 4.6.
8.7 Websites that appear in results
To display some results — for example, previews of similar photos, product images, and reference pictures — the App loads images directly from the websites that host them, so those websites receive your IP address and standard request information. When you open a link, the website opens in your browser under its own privacy policy.
8.8 Legal requests and business transfers
We may disclose information when required by law or to protect rights and safety (Section 7), and to a successor if the Service is merged, acquired, or transferred, subject to this policy.
9. Refund requests (consumption information shared with Apple)
If you request a refund for a purchase in the App through Apple, we — directly or through our subscription-management provider — may send Apple “consumption information” to help Apple evaluate your request. It describes the purchase and how the App has been used, and may include: how long your installation has existed, whether the purchased coins or features were used, an approximate measure of your in-app usage, the approximate total value of your purchases and refunds in the App, the platform, and our recommended resolution. It does not include your name, email address, payment-card number, or any photo or result.
Apple already holds your purchase record. This information is shared only in response to a refund request that you initiate, and solely so that Apple can decide it. By requesting a refund through Apple, you consent to this sharing.
10. International data transfers
We and our providers process information in several countries, which may differ from your country of residence and may not offer the same level of data protection — including countries that are not the subject of an adequacy decision under EU or UK data-protection law. When you submit a photo, it may be transferred to such countries to produce the result you request.
If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, such transfers are made because they are necessary to provide the service you request and, for a face search, on the basis of your explicit consent, which you give by submitting the image and starting the search. If you do not want your photo transferred on this basis, do not submit it.
11. Data retention
| Data | How long we keep it |
|---|---|
| Photo you scan, photo sent for “On this photo,” cut-outs for prices | Not stored on our servers — processed and passed to the providers in Section 8. The temporary copy for a product lookup is deleted as soon as the lookup ends. |
| Image uploaded for a face search when no paid search is available | Deleted immediately. Nothing is stored. |
| Image uploaded for a paid face search | Replaced by a thumbnail of about 256 pixels. The thumbnail and results are kept as your history until you delete the search or clear your history. |
| Failed face search | The uploaded image is deleted. A record without any image (time, status, technical error) is kept until you clear your history. |
| Scan results and teasers | Until you delete them in the App, where it offers a scan history, or ask us to delete them. |
| “On this photo” descriptions | Until you clear your face-search history in the App, or ask us to delete them. Clearing removes the description; a bare record of when it was made (without any text) is kept to enforce the daily limit on free descriptions. |
| Photos of past scans | On your device only, until you delete the scan, clear your history, or delete the App. |
| Random identifier | In your device’s Keychain; it may survive deleting and reinstalling the App on the same device. On our servers, as the key for the records in this table. |
| Purchases, coin balance, refunds, subscription usage, free coins, referral codes and redemptions, feature-rollout and advertising-attribution records | As long as needed to provide the Service, keep balances accurate, prevent fraud, and meet accounting and legal obligations. |
| Server logs | Kept for operating, securing, and troubleshooting the Service. |
| Backups | Our database backups contain balance, purchase, refund, subscription-usage, free-coin, and referral records. They do not contain your photos, search history, or scan results. |
Deletions from cloud storage are carried out automatically by our servers. In rare cases — for example, when an upload reaches our storage but the search request never reaches our server, or when a deletion fails for a technical reason — a copy may remain in storage longer than described above. You can ask us to remove any such data.
12. Deleting your data and your choices
The Service does not use accounts, so there is no account to close. You control your data directly:
- Delete any face search, or clear your entire face-search history, in the App at any time. This removes the corresponding thumbnails and results from our servers; clearing your history also removes records of failed searches and the text of “On this photo” descriptions.
- Where the App shows a scan history, delete any scan or clear all scans. This removes the results from our servers and the photos from your device.
- Ask us to delete any data associated with your installation by writing to support@scanny.online. Writing from “Contact support” in the App’s Settings includes the reference we need to find your data.
- Deleting the App removes the photos of past scans from your device, but does not delete data on our servers. Delete your history first, or email us.
- Camera access and notifications can be turned off at any time in iOS Settings.
Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to restrict or object to certain processing, to withdraw consent, and to complain to a data-protection authority. To exercise them, contact us at the address above; we will respond as required by applicable law. Because we do not collect your name or contact details, we identify your data by your installation’s identifier, so you may need to make the request from the device in question.
13. Security
We use administrative and technical safeguards appropriate to the sensitivity of the data:
- data between the App and our servers travels over HTTPS (encrypted in transit);
- uploaded images and history thumbnails are kept in private cloud storage, and the App reaches them only through links that expire (within five minutes for uploads, within one hour for history thumbnails);
- access to our servers and storage requires credentials held only by authorized personnel, and our logs generally record only a shortened form of your identifier;
- on your device, photos of past scans are stored with iOS data protection, and the identifier is kept in the Keychain.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Consent and biometric-law notice (Illinois, Texas, Washington, and similar laws)
Scanny does not identify people or tell you who a person is. Nevertheless, some laws — including the Illinois Biometric Information Privacy Act (BIPA), Texas CUBI, and Washington’s biometric law — define “biometric identifiers” broadly, and comparing a face against other images may fall within that definition in some interpretations. Out of caution, we provide this notice.
- What is processed: the framed image you choose to submit for a face search. The photo sent for “On this photo” is only described, never used to identify anyone.
- Purpose: solely to perform the search you request and return links. We do not use it to identify you or anyone else, for advertising, for profiling, or to train our own models.
- Consent: you give your consent by submitting an image and starting the search. If you do not consent, do not run a face search.
- Disclosure: the image is disclosed only to our hosting and storage provider and to the face-search or reverse image search provider that performs the search (Section 8). We do not sell, lease, trade, or otherwise profit from any facial data.
- Retention and destruction: we retain only the history thumbnail and the results of a paid search, and we destroy them when you delete them, when the purpose for which the image was submitted has been satisfied, or within the period required by applicable law, whichever is earliest. Results may include preview images of other people’s pictures found on the web; they are kept and deleted together with the search.
You should only submit images you have a lawful basis to submit. Scanny is intended for lawful uses such as checking where your own photos appear online or whether a profile photo is used elsewhere. It must not be used to harass, stalk, or harm any person, or for decisions about credit, employment, insurance, or housing.
15. U.S. state privacy disclosures (CCPA/CPRA and similar)
This section applies to residents of California and other U.S. states with comparable laws. In the preceding 12 months, the categories of personal information we have processed are: identifiers (a random identifier, a hashed installation ID, purchase transaction identifiers, and network information in logs); commercial information (purchases and refunds); photos you submit, which may include biometric information in some interpretations; and internet or other electronic activity (App usage events, results, and logs). We use this information for the business purposes in Section 5 and disclose it only to the service providers in Section 8.
- We do not sell your personal information and do not share it for cross-context behavioral advertising.
- We do not use or disclose sensitive personal information for purposes other than providing the Service you request.
- Subject to your local law, you may have the right to know, access, delete, and correct your personal information, and to be free from discrimination for exercising these rights. To exercise them, contact us at support@scanny.online.
16. Children
Scanny is intended only for users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. You must not submit images of minors for a face search or a similar-photos search. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us with information, contact support@scanny.online.
17. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where required, provide additional notice. Continued use of the Service after an update means you accept the revised policy.
18. How to contact us
If any translated version of this policy conflicts with the English version, the English version governs.