Privacy Policy
ScanKit processes your documents in your browser. Your files are not uploaded to our servers. This policy lists the small amount of data our server does handle, what is kept in your own browser, which other providers your browser contacts, and your rights.
1. Who is responsible
The controller of the personal data described here is 62004027611 SOLE PROPRIETOR. Contact: [email protected].
2. Your documents
The PDFs and photos you open, the signatures and handwriting you create, and the files you download are processed in your browser. They are not sent to our server, and we cannot see them. When you drop a file on our home page, it is handed to the app inside your browser, not uploaded.
3. What our server stores
Our server keeps a small record file. It contains only the following.
- A device identifier. A random code stored in the "sk" cookie (see section 5). It identifies a browser, not a person.
- Download counts for each device. The date of your last free download, how many free downloads you made that day, and the total number of free downloads made by that device.
- A hashed form of your IP address, with a weekly count. We store a keyed one-way hash of your IP address, never the address itself, together with the number of free downloads made from it in the current week. The hash cannot be turned back into your address, but the same address always produces the same hash, so we treat it as personal data.
- Subscription links. If you subscribe, your PayPal subscription ID, the device identifiers of the browsers (up to three) using it, and the date your paid period runs to.
We do not store your name, your email address, your payment details, or the content of your files.
What our server handles without storing
- Your IP address. Our server receives it with every request, as all websites do. To limit abusive request rates, it is held in the server's memory for about two minutes and is not written to disk.
- Subscription details from PayPal. To check a subscription, our server asks PayPal for its status, plan, billing dates and the email address on the PayPal account. These are held in memory for up to five minutes and are not saved, except the paid-through date described above.
- Your PayPal email when you restore a subscription. When you use "Restore" in the app, you type your subscription ID and PayPal email. We compare that email with the one PayPal returns, to make sure the subscription is yours, and do not store it.
Logs
Our server software does not keep a log of visits. It records only error messages needed to fix faults. The company that hosts our server may keep its own technical logs, which can include IP addresses, for security and operations.
Messages to us
If you email us, we keep your email address, your message and our reply.
4. Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Run the app and apply the free download allowance | "sk" cookie and device identifier, download counts, hashed IP address with weekly count | Our legitimate interest in offering a limited free allowance and protecting the service from abuse; providing the service you asked for |
| Limit abusive request rates | IP address, in memory for about two minutes | Legitimate interest in keeping the service secure and available |
| Provide and check your subscription | PayPal subscription ID, linked device identifiers, paid-through date; status and PayPal email read from PayPal | Performance of our contract with you |
| Answer your messages and requests | Your email address and message | Legitimate interest in replying; performance of a contract where it concerns your subscription |
| Meet tax, accounting and legal obligations | Subscription and payment identifiers | Legal obligation |
If you accept advertising cookies (section 5), we also measure which of our ads bring visitors and subscribers. The legal basis for that is your consent, which you can withdraw at any time with "Cookie settings" at the bottom of every page. If you decline, no advertising cookie or tag is loaded. We do not sell personal information, and we do not use analytics cookies.
5. Cookies and storage in your browser
ScanKit sets one cookie that the app needs. Advertising cookies are set only if you accept them. Everything else listed here is stored by the app in your own browser and is never sent to us.
| Name | Type | Purpose | How long |
|---|---|---|---|
| sk | Cookie (first-party, HttpOnly, SameSite=Lax) | Holds your device identifier and a signature that stops it being forged. Needed to load the app's effect engine, apply the free allowance and keep your subscription unlocked on this browser. Set the first time the app contacts our server, not on the other pages of the site. | 2 years, or until you delete it |
| scankit.templates | localStorage | Templates you save: your settings, and any signatures or handwriting you placed in them. | Until you delete them or clear your browser data |
| scankit.sigs | localStorage | Signatures and handwriting you save to your library in the Ink Studio. | Until you delete them or clear your browser data |
| scankit-handoff | IndexedDB | Passes a file you drop on the home page to the app. The app opens it and deletes it straight away, and ignores it if it is more than 10 minutes old. | Seconds, normally |
| sk-consent | localStorage | Remembers whether you accepted or declined advertising cookies, so we do not ask on every page. | Until you change it or clear your browser data |
| _uetsid, _uetvid (and Microsoft's MUID) | Cookies (Microsoft Advertising), only if you accept | Let Microsoft Advertising measure whether a visit came from one of our ads and whether it led to a subscription, and let us show our ads again to people who visited. | _uetsid 1 day, _uetvid about 13 months, MUID about 1 year |
| _gcl_au | Cookie (Google Ads), only if you accept and only when we run Google Ads | Lets Google Ads measure whether a visit from one of our ads led to a subscription. | About 3 months |
| slip | sessionStorage | Remembers that you hid the "drop a PDF" slip on the home page. | Until you close the tab |
The "sk" cookie is needed for the app to work and to apply the free allowance, so it is set without asking. Advertising cookies are only set after you choose Accept in the cookie notice; you can change your choice at any time with "Cookie settings" at the bottom of every page. If you delete the cookie, the app sets a new one, and your browser counts as a new device. If you subscribe, you will need to restore your subscription on that browser.
Fonts you upload into the Ink Studio stay in memory for that session only and are not saved or sent anywhere.
6. Other providers your browser contacts
Some parts of the app are loaded from other providers. When that happens, your browser connects to them directly, so they receive your IP address and normal browser information (such as the browser type and the page that made the request). They do not receive your documents.
- Google Fonts, fonts.googleapis.com and fonts.gstatic.com: handwriting and signature fonts are loaded from here when you open the Ink Studio.
- Microsoft Advertising, bat.bing.com and bat.bing.net: only if you accept advertising cookies. It receives the pages you visit on our site, whether you subscribed and the subscription price, together with your IP address and browser information, and uses them as described in Microsoft's privacy statement.
- Google Ads, googletagmanager.com and googleadservices.com: only if you accept advertising cookies and only while we advertise on Google. It receives the same kind of information about visits and subscriptions.
- PayPal, paypal.com: PayPal's checkout is loaded only when the subscription window opens. If you subscribe, PayPal collects your payment details and processes them as an independent controller under its own privacy policy, and may set its own cookies. We never receive your card or bank details.
Our server, in turn, contacts PayPal to check subscriptions, sending only the subscription ID. Our hosting provider stores and runs our server on our behalf.
The fonts used by the website itself, and the PDF engine (pdf.js) the app uses to open PDFs, are hosted on our own server.
7. How long we keep it
- "sk" cookie: 2 years in your browser, unless you delete it sooner.
- Download counts and hashed IP records: only the current day's count (per device) and the current week's count (per IP hash) affect anything. Older counts have no effect, but our server does not yet delete these records automatically. You can ask us to delete them at any time (see section 8).
- Subscription links (subscription ID, linked device identifiers, paid-through date): while your subscription exists, and afterwards for as long as we need them for tax, accounting and dispute purposes.
- Data held in memory: IP addresses for about two minutes, PayPal subscription details for up to five minutes.
- Emails to us: as long as needed to deal with your request and any follow-up.
- Data in your browser: until you delete it. We cannot delete it for you, and we cannot recover it.
8. Your rights
Depending on where you live, including under the GDPR, the UK GDPR and California law, you may have the right:
- to know what we hold about you and to get a copy;
- to correct inaccurate data;
- to have data deleted;
- to object to processing based on legitimate interests, and to restrict processing;
- to receive your data in a portable format where the law provides it;
- not to be treated differently for using these rights.
To use any right, email [email protected]. Our records do not contain your name or email address, so tell us what we need to find them:
- if you subscribe: your PayPal subscription ID (it starts with I-). We will confirm it is yours, for example by checking the PayPal email on it;
- for free downloads: the IP address you used, which we can hash to find the weekly count. The device identifier sits in a cookie that page scripts cannot read, so if we cannot locate your device record we will tell you, and deleting the "sk" cookie in your browser breaks the link to it.
Deleting a subscription's device links signs those browsers out of the subscription; it does not cancel the subscription, which you do in PayPal. We will respond within the time the law requires, normally within one month.
If you think we have handled your data unlawfully, you can complain to a data protection authority, such as the one in the EU country where you live or work, or the UK Information Commissioner's Office. We would appreciate the chance to resolve the matter first.
9. Children
ScanKit is not for people under 18. We do not knowingly collect data about them. If you believe a child has used the service, contact us and we will delete what we can identify.
10. International transfers
PayPal, Cloudflare, Google and our hosting provider may process data in countries other than your own, including outside the EEA and the UK. Where the law requires it, these transfers rely on safeguards such as adequacy decisions or standard contractual clauses. You can ask us for details.
11. Security
The "sk" cookie is signed and cannot be read by page scripts, connections use HTTPS, and IP addresses are stored only in hashed form. No system is perfectly secure, but because your documents stay in your browser, they never pass through our server.
12. Changes to this policy
We may update this policy. The date at the top shows the current version. Before any change in how your documents are handled, such as processing them on our server, or any other material change, we will update this policy and give notice on the site or in the app before it takes effect.
13. Contact
Privacy questions and requests: [email protected]. See also our Terms of Service and contact page.