Privacy Policy
This policy explains what information the Scan60 Android app (package com.kishan.qrcodescanner, "the app") handles, why, who else receives it, and the choices you have. Scan60 is run by Kishan Singh, an individual developer based in Jaipur, Rajasthan, India ("we", "us"). If you have a question, write to [email protected].
- There is no sign-up. We don't ask for your name, email or phone number.
- The camera is used only to scan. Camera images are processed on your phone and are never stored or sent anywhere.
- Your scan history, notes and generated codes stay on your phone.
- To check a scanned link, UPI ID or phone number against scam reports from other users, the app sends a one-way hash of it (not the readable value) to our database.
- If you choose to report a scam, the reported domain, UPI ID or phone number is stored, together with the category you chose, under a random anonymous ID.
- The free version shows ads (Google AdMob). A one-time purchase removes them. We use Google Firebase for anonymous usage and crash statistics.
- We do not sell your information.
1. Information we handle
a. Camera and scanned codes
The app uses your camera to read QR codes and barcodes, and can also read a code from a photo you pick. Images are analysed on your phone and are not stored or uploaded. What a code contains (a link, text, a Wi-Fi network, a contact, a UPI payment request and so on) is shown to you and saved in your history on your phone.
b. Safety checks on scanned codes
Every scan gets a safety verdict. Most of this is done on your phone by rules built into the app. Three things use the network:
- Community lookup. For a link, UPI ID or phone number, the app asks our database whether other users have reported it. It sends only a SHA-256 hash of the domain, UPI ID or number, which cannot be turned back into the original. It does not send the full link, the page content or any of your history.
- Short links. For a known link-shortener address, the app contacts that address from your phone to see where it leads (a "HEAD" request that follows redirects, up to a few hops). The site that runs the short link can see your phone's IP address and basic request details, as with any visit. Nothing is sent to us.
- Website icons. To show a small site icon next to a link, the app asks Google's favicon service for the domain's icon. That sends the domain name (not the full link) to Google.
c. Product lookup
For product barcodes (such as EAN or UPC), the app can look up the product name and photo at Open Food Facts. The barcode number is sent to that service. It is not linked to you by us.
d. Scam reports you choose to send
Only when you tap Report. See section 4.
e. Ads, statistics and crashes
Google AdMob (ads), Google Analytics for Firebase (anonymous usage statistics) and Firebase Crashlytics (crash reports) collect device and usage information, described in section 3.
f. Purchases
If you buy Premium, Google Play handles the payment. We never see your card or payment details. The app asks Google Play whether your account owns the purchase, so it can switch ads off and unlock the Premium features.
2. Stored only on your phone
- Scan history, favourites, notes and tags
- Codes you generate, and the images you save or share
- Your settings: language, theme, history lock and similar choices
- Whether you own Premium, and which scam reports you have already sent from this phone
The optional history lock uses your phone's own screen lock or fingerprint through Android's biometric prompt. The app only receives a yes or no answer. We never receive, store or send your fingerprint, face data or PIN.
3. Services that receive information
| Service | What for | What it receives |
|---|---|---|
| Google AdMob (Google Mobile Ads SDK) | Showing banner, interstitial and rewarded ads in the free version | Advertising ID, IP address, device model and OS, app and ad interaction data, approximate location from IP. See how Google uses data from apps that use its services. |
| Google Analytics for Firebase | Anonymous usage statistics | App opens, screen views, device and OS type, country, an app-instance ID |
| Firebase Crashlytics | Finding and fixing crashes | Crash logs, device model, OS version, app version, an install ID |
| Firebase Authentication (anonymous) | Letting a phone report a scam once without an account | A random anonymous ID. No name, email or phone number |
| Cloud Firestore (Google, Mumbai region) | Storing and looking up community scam reports | Hashes for lookups; reported domains, UPI IDs and numbers for reports (section 4) |
| Google Play (Billing, In-App Review) | The Premium purchase, and asking you to rate the app | Handled by Google under its own policy |
| Open Food Facts | Product details for barcodes | The barcode number and your IP address |
| Google favicon service | Site icons next to links | The domain name and your IP address |
| The site behind a short link | Finding where a short link leads | Your IP address and request details |
These providers act under their own privacy policies. Firebase and AdMob are products of Google LLC; see policies.google.com/privacy.
4. Community scam reports
Scan60 includes a shared list of scams reported by its users, so one person's report can warn the next. When you tap Report on a result, the app signs your phone in anonymously and stores:
- What was reported: for a normal link, only its domain (for example
example.com, never the path or the part after the "?"); for a link-shortener address, the short link's domain and path; for a UPI payment, the UPI ID; for a phone number, the number. - The category you picked (payment fraud, fake website, fake offer, malware or other), a running count, and first and last report times.
- One vote record under your random anonymous ID, with the category and time, so a phone can report an item only once.
A UPI ID or phone number is information about the person or business that owns it, not about you. We keep it only to warn other users, and we only publish a count, never a name. Nobody can download or list the whole database: the app can look up an item only if it already has the value, using the hash. If a reported entry is wrong or concerns you, ask us to remove it using the Delete data page. Please do not report things you haven't actually seen in a scam; see the Terms.
5. How we use information
- To scan, show and save your codes, and to run the safety checks you see.
- To warn users about scams that others have reported.
- To show ads in the free version and to switch them off when you buy Premium.
- To measure how the app is used, find crashes and improve it.
- To prevent abuse of the report feature, for example repeated or false reports.
- To meet legal duties, enforce our Terms of Use and protect the app and its users.
We do not use your information for automated decisions that have legal or similarly significant effects on you. The safety verdict is advice shown to you; it does not block anything on its own.
6. Legal basis and consent
We process scan lookups and reports to provide the safety features you use (performance of the service) and, for statistics, security and fraud prevention, on our legitimate interest in running and improving the app. Ads and, where the law requires, advertising and analytics identifiers are used with your consent. In the European Economic Area, the UK and Switzerland the app asks for your choice with Google's consent form, and you can change it any time under Settings › Privacy choices. Where India's Digital Personal Data Protection Act, 2023 applies, we act as the Data Fiduciary for any personal data we handle.
7. Sharing and selling
We do not sell, rent or trade your personal information. We share it only:
- with the service providers in section 3, who process it for us or under their own policies;
- when the law requires it, for example a valid order from a court or government authority;
- to protect the rights, safety or property of users, the public or us; or
- if Scan60 is transferred to a new owner (for example, if the app is moved to another developer account), who must then follow this policy or tell you about changes first.
8. Ads and advertising ID
The free version shows ads from Google AdMob: a banner on some screens, an occasional full-screen ad after a scan, and optional "watch an ad" rewards that unlock a Premium feature once. We keep ads away from the camera, from warnings and from the safety and scam-help screens.
AdMob uses the Android advertising ID and other device data to choose and measure ads. In the EEA, UK and Switzerland, personalised ads and the related storage need your consent through the consent form. To limit ads elsewhere, open Android Settings › Privacy › Ads and delete your advertising ID or opt out of ads personalisation. Buying Premium removes the ads from the app.
The app is not directed at children, and we do not knowingly show personalised ads to children.
9. App permissions
- Camera. To scan codes. Asked the first time you use the scanner.
- Internet and network state. For the safety lookups, ads, statistics and purchases, and to know when you're offline.
- Wi-Fi state and change Wi-Fi state. Only to join a Wi-Fi network when you scan a Wi-Fi code and tap Connect.
- Vibrate. Feedback when a code is scanned.
- Storage (Android 9 and older only). To save a QR image you generate to your gallery.
- Advertising ID. Used by AdMob, as described in section 8.
- Biometric (optional). For the history lock, handled by Android as described in section 2.
10. How long we keep data
- History and settings on your phone: until you clear them or uninstall the app.
- Community reports: kept while they help warn users, and removed on request or if found to be wrong or abusive.
- Analytics events: kept by Google Analytics for at most 14 months, then deleted automatically.
- Crash reports: kept by Crashlytics for 90 days.
- Emails you send us: for as long as needed to answer, and at most 2 years.
We may keep a minimal record longer where the law requires it.
11. Deleting your data
There is no account to delete. To clear what's on your phone, use History › Clear history in the app, or Android Settings › Apps › Scan60 › Storage › Clear storage, or uninstall the app. To have a scam report removed, or to ask about anything else, follow the steps on our Delete data page.
12. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct or complete it;
- delete it;
- withdraw consent, or object to or restrict some processing;
- name someone to exercise your rights if you die or become unable to (a right under India's DPDP Act).
Because the app keeps no account and the community data is anonymous, we often hold nothing that can be tied to you; if so we will say so. Users in the European Economic Area and the UK have these rights under the GDPR. California residents have similar rights under the CCPA/CPRA, and we do not sell or "share" personal information as those laws define it. Write to us using the details in section 17. We will reply within 30 days and will not treat you differently for using your rights. You may also complain to your local data-protection authority, or in India to the Data Protection Board of India.
13. Children
Scan60 is a general utility app and is not directed at children under 13 (or under 16 where the law sets a higher age). We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
14. Security
Connections to our services use encryption (HTTPS/TLS). The scam database is protected by security rules: it cannot be listed or downloaded, entries can only be added one vote at a time, and nothing can be edited or deleted from the app. No password is stored in the app. No method of storage or transmission is completely secure, but we take reasonable steps to protect your information. If a breach affects your personal data, we will notify you and the authorities as the law requires.
15. Where data is stored
Community reports are stored in Google Cloud Firestore in the Mumbai (asia-south1) region. Google may process Firebase and AdMob data on servers outside your country, including in the United States, protected by safeguards such as standard contractual clauses. By using the app you understand that your information may be processed in those countries, subject to this policy and applicable law.
16. Changes to this policy
We will post any change on this page and update the "Last updated" date. If a change materially affects how we use your personal data, we will tell you in the app before it takes effect, and ask for consent where the law requires it.
17. Contact and grievance officer
For privacy questions, requests or complaints, contact:
Kishan Singh, Developer, Scan60. He is also the Grievance Officer under India's Information Technology Act, 2000 and its Rules.
Email: [email protected] (subject line "Scan60 privacy")
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.