Privacy Policy

ScanLM app for iPhone and iPad, and this website · Effective 3 October 2026

1. Who is responsible

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Bernd Bornhauser
Postfach 403912
70191 Stuttgart
Germany

You can reach the controller through the contact form. No data protection officer has been appointed, as there is no legal obligation to do so.

2. The ScanLM app

No data collection by the developer

ScanLM does not require an account and does not contain analytics, advertising, tracking or crash-reporting software from the developer or from third parties. The developer operates no server for the app and receives none of your documents, text, images, settings or usage data.

Camera

The app asks for access to the camera so you can photograph documents. Images are processed on your device and stored only inside the app’s own documents.

Photo library

If you choose Save Image when sharing a scan, iOS asks for permission to add photos to your library. The app cannot read your photo library. When you import a picture, iOS lets you pick it, and only that picture is handed to the app.

Where your documents are stored

Scans, recognised text, tags, summaries and chat histories are stored on your device, inside the app. If iCloud Drive upload is switched on in ScanLM’s settings, a finished copy of each document (a PDF or images) is also placed in your personal iCloud Drive. iCloud is a service of Apple and is covered by Apple’s privacy policy. The developer has no access to your iCloud.

Text recognition

Text recognition (OCR) uses Apple’s Vision framework and runs entirely on your device.

AI features

The AI features (suggested names, tags and summaries, and chatting with a document) are optional and only work with a model that you set up.

• Your own model server. If you enter the address of a model server in Settings (for example Ollama or LM Studio on your own computer), the app sends what the request needs directly from your device to that address: the recognised text of the document, your chat messages and, only if you switch on Send page images, images of the first pages. You choose and control this server. The developer does not operate it and receives none of this data. If you enter the address of a server run by someone else, that operator’s privacy terms apply. Server addresses and any API keys you enter are stored only on your device.
• Apple Intelligence on the device. If you choose Apple’s on-device model, documents are processed on your iPhone or iPad and do not leave it.
• Apple Private Cloud Compute. Where available and selected, requests are processed by Apple’s Private Cloud Compute under Apple’s privacy terms.

Because text and images go to the model you configured, please only connect servers you trust.

Local network

iOS asks for permission to access your local network the first time the app contacts a model server on it. The app uses this access only to reach the server address you entered.

Sharing and exporting

When you share or export a document, it goes to the app or service you pick in the iOS share sheet. That is under your control and subject to that recipient’s terms.

Information Apple provides to developers

If you have agreed in iOS settings to share analytics with app developers, Apple may provide the developer with aggregated, anonymised usage statistics and crash reports. These do not contain your documents. You can change this at any time under Settings › Privacy & Security › Analytics & Improvements.

Deleting your data

Deleting a document in the app removes it from the device, and the copy ScanLM placed in iCloud Drive is removed at the next sync. Deleting the app removes all of its data from the device. Anything left in iCloud Drive can be removed in the Files app.

3. This website

This website uses no cookies, no analytics and no tracking, and loads no fonts, scripts or other content from third parties.

Hosting and server log files

The website is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit, the server automatically records technical access data: IP address, date and time of the request, the page or file requested, the HTTP status code, the referring page and your browser’s user-agent string. This is necessary to deliver the website and keep it secure; the legal basis is Art. 6(1)(f) GDPR. Server log files are deleted automatically within 14 days. A data processing agreement under Art. 28 GDPR is in place with Strato AG.

Contact form

If you use the contact form, the details you enter are processed: your email address, your message, the topic you choose and, if you provide them, your name and device details. They are used only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to using the app, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering messages.

The message is delivered to the developer’s mailbox by the hosting server’s standard mail function and is not stored on the web server. It is kept in the mailbox for as long as the conversation lasts and for up to one year afterwards, then deleted, unless legal retention obligations apply.

To protect the form against spam, it asks a simple arithmetic question and uses a hidden field that people do not see. To limit the number of messages from one connection, the server keeps a counter under a one-way hash of your IP address that changes every hour; the IP address itself is not stored, and the counter is deleted within two hours. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a form that is not abused. The form sets no cookies and uses no third-party captcha service.

4. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, use the contact form and choose “Privacy request”, or write to the postal address above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for the controller is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de). You can also contact the authority where you live or work.

5. No automated decision-making

Neither the app nor this website uses automated decision-making or profiling within the meaning of Art. 22 GDPR. Suggestions made by an AI model in the app are proposals you accept or reject yourself.

6. Children

ScanLM does not knowingly process personal data of children and collects no personal data from any user.

7. Changes

If the app or this website changes in a way that affects your privacy, this policy will be updated and the effective date above changed.