Privacy Policy

Last updated: 4 July 2026 · Applies to the Sheaf Android app (com.sheafapp.android)

Sheaf (“the app”, “we”, “us”) is a document scanner for Android. This policy explains what data the app handles and how. In short: Sheaf has no backend of its own. Your documents are stored on your device, and any cloud storage uses your own Google Drive. We do not sell your data, and we never send your scans or their contents to servers we operate.

Who we are

Sheaf is developed by Dhiman Paul. For any privacy question or request, contact dipayon.cse@gmail.com.

No account required

You can use Sheaf without creating an account or signing in. The only optional sign-in is Google authorisation to reach your own Google Drive (see below).

What data the app handles

Your documents (scans, PDFs, recognised text)

Scanned pages, generated PDFs, thumbnails, and any recognised (OCR) text are stored locally on your device in the app’s private storage. They are not transmitted to us. They leave your device only when you choose to share them, save them, or upload them to your Google Drive.

On-device processing

Document scanning and text recognition (OCR), as well as QR/barcode reading, run on your device using Google’s ML Kit. The images processed for these features are not uploaded to us or to Google for this purpose.

Google Drive (optional)

If you connect Google Drive, Sheaf requests the drive.file scope. This scope lets the app access only the files it creates in your Drive — it cannot see your other Drive files. We also request your account email address so the app can show which account is connected. The access token is stored securely on your device and used to talk to Google’s Drive API directly from your phone; it is never sent to a server we operate. You can disconnect at any time in the app and revoke access at myaccount.google.com/permissions.

Purchases

Subscriptions and in-app purchases are processed by Google Play Billing. Google handles payment; Sheaf does not receive or store your payment card details. The app stores your entitlement (whether Pro is active) locally on your device.

Ads

The free version shows ads via Google AdMob. AdMob may use device identifiers (such as the advertising ID) to serve and measure ads. In the EEA, UK and Switzerland, we show a Google-certified consent prompt (UMP) before serving personalised ads. Ads are never shown to Pro or ad-free users. See Google’s advertising policies.

Analytics & crash reporting

We use Firebase Analytics (aggregate usage, such as which screens are used) and Firebase Crashlytics (crash diagnostics) to understand stability and improve the app. This data is about app usage and device/crash information — it does not include the contents of your documents. See Firebase’s privacy information.

Push notifications

If you allow notifications, we may use Firebase Cloud Messaging to send occasional service or promotional messages, and to show progress for background uploads/backups. You can turn notifications off in your device settings at any time.

Permissions we use

• Camera — to capture document scans.
• Notifications — background upload/backup progress and optional messages.
• Internet / network — to upload to your Drive, serve ads, and load analytics/crash and purchase services.

Google API Services — Limited Use disclosure

Sheaf’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from your Google Drive via the drive.file scope is used only to provide and improve the user-facing features you request (uploading, syncing, backing up and restoring your own documents). We do not use it for advertising, we do not sell or transfer it, and we do not allow humans to read it, except as necessary for security, to comply with the law, or with your explicit consent.

Data sharing

We do not sell your personal data. Your documents are shared only where you direct them (a share target you pick, or your own Google Drive). The third-party services listed above (Google Play, AdMob, Firebase) process data as described, as independent providers under their own policies.

Data retention & deletion

Documents and app data stay on your device until you delete them in the app or uninstall the app. You control any files uploaded to your Google Drive directly from your Drive. To request deletion of analytics/diagnostics associated with your device, contact us at the email above.

Children

Sheaf is not directed to children under 13 (or the equivalent minimum age in your region) and we do not knowingly collect their data.

Security

Documents are kept in the app’s private storage. Drive access tokens are stored using the platform’s secure storage. No system is perfectly secure, but we minimise risk by keeping data on-device and avoiding any server of our own.

Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date.

Contact

Questions or requests: dipayon.cse@gmail.com