IdScanner/Privacy Policy
Privacy Policy
IdScanner has no account and no sign-in, and nothing a guest hands you leaves the device it was scanned on. The app does report how it is used. This page draws that line precisely, including the parts that are your responsibility rather than ours.
Last updated: 4 October 2026
The short version. Nothing a guest hands you is uploaded — no name, no date of birth, no document number, no photograph. Those stay in the app's own storage on your iPhone and are deleted when you delete the app. The app does send product analytics about how it is used, described in full below.
Who we are
IdScanner is published by Oksana Ogeyko ("we", "us"), an independent iOS developer. You can reach us at support@idscanner.slumbiapp.com.
What the app does not do
Stating this plainly, because the boundary is the whole point. The app:
- does not create an account or ask you to sign in;
- does not upload, transmit or back up scanned names, dates of birth, document numbers or addresses — those never leave the device;
- does not use cookies, pixels or the Advertising Identifier, and does not track you across other companies' apps or websites;
- does not perform face recognition and does not capture, store or process anyone's face or other biometrics. Comparing the photograph on a document with the person presenting it is the operator's judgement, not the app's;
- does not store photographs or video of documents. Camera frames are analysed in memory and discarded.
Analytics
The app uses Amplitude to understand how it is used — which features get reached, where the purchase flow is abandoned, and how often a scan produces a verdict. Without it we are guessing about a tool people rely on at work.
What is sent with a scan is deliberately narrow:
| Sent | Never sent |
|---|---|
| The kind of document (licence, ID card, passport MRZ, manual entry) | The name on it |
| The issuing state, province or country | The date of birth |
| The age as a band — 18–20, 21–24, and so on | The exact age |
| The verdict category (pass, underage, expired, check ID) | The document or licence number, or its hash |
| Feature use: paywall shown, purchase made, offer code entered, ban added, export run, manual entry used and what opened it, scanning help shown, a code that could not be read and the kind of failure (never its content), whether you allowed camera access, that the app asked for a rating — and, if you answer it, which of a fixed list of reasons you picked when closing the paywall | The address or postal code, and the ban list itself |
The age is a band rather than a number on purpose: an exact age, a timestamp and a small venue together can single out one person, and a band cannot. Events are tied to an app-generated identifier for the installation, not to you — there are no accounts — and not to any advertising identifier.
The app also switches off collection Amplitude would otherwise perform by default: the vendor device identifier (IDFV), the IP address and the country, city, region and metro area inferred from it, and the mobile carrier. Automatic screen and tap capture is off as well, because it would record on-screen text — which on the result screen is a guest's name.
The events the app can send are a fixed list defined in its source code; there is no mechanism for sending an arbitrary payload. If you would rather send nothing at all, tell us and we will describe the current options honestly.
Camera
The app requests camera access solely to read a barcode (AAMVA PDF417) or a machine-readable zone (ICAO 9303) and, for the front-side check, to read printed text from the front of a document. This processing happens entirely on the device, in memory. No image is written to storage, to your photo library, or to any network.
What is stored on your device
All of the following lives in the app's own storage on your iPhone. It is not visible to us, and it is removed if you delete the app.
| What | Default | Kept for |
|---|---|---|
| Scan history — for each scan: the name, the age as a number, the result, the issuing jurisdiction and the sex recorded on the document. It does not store the date of birth, the document number or the address, even though the app read them to reach its verdict. | Off. Nothing is recorded unless you switch it on. | Your choice of 24 hours, 7 days or 30 days, after which entries are deleted automatically. You can also delete individual entries or clear the history at any time. |
| Ban list — guests your venue has barred | Empty | Until you remove the ban or delete the app. Stored as an irreversible salted hash of the document number, using a random key generated on that installation. It contains no names, no dates of birth and no document numbers, and cannot be reversed to recover them. |
| Statistics — counts of scans, admissions, refusals and results by hour | On | 35 days. Counts only: no names, no dates of birth, no document numbers. CSV export of statistics contains the same aggregate counts and no personal data. |
| Settings and counters — age threshold, quick mode, visitor count, purchase state | — | Until changed or the app is deleted. |
Duplicate detection within a shift uses the same irreversible hash as the ban list, so recognising a repeat scan does not require storing the document number either.
The app can export scan history to CSV. That file contains the personal data listed above and leaves the app the moment you share it, so where it goes next is your decision and your responsibility. The separate statistics export contains aggregate counts only.
Your responsibilities as the venue
This part is genuinely yours rather than ours, and it matters.
If you switch scan history on, you are recording personal data about your guests on your own device. Under the GDPR, UK GDPR, or state privacy laws such as the CCPA, that generally makes your business the controller of that data — not us, because we never receive it. What you may lawfully record, how long you may keep it, what you must tell guests, and how you respond if they ask, depends on your jurisdiction and your licence conditions.
The retention setting exists so you can match whatever rule applies to you. If you have no obligation to keep records, the safer choice is to leave scan history off.
Purchases
IdScanner Pro is sold through Apple's In-App Purchase system. Payment, billing and subscription management are handled entirely by Apple; we never see your payment details, and no payment information passes through the app. The app receives only Apple's confirmation of whether an active entitlement exists, which it stores on the device. Apple's handling of your purchase is governed by Apple's Privacy Policy.
If you contact us
If you email us for support, we receive your email address and whatever you choose to write, and we keep that correspondence only as long as needed to deal with your request. Please do not send us details of a scanned guest — we neither need them nor want them, and we cannot look up your scans in any case.
Your rights
Depending on where you live, you may have rights to access, correct, delete or export personal data a company holds about you, and to object to its sale or sharing.
About your guests we hold nothing — no name, no date of birth, no document number ever reaches us, so there is nothing for us to produce, correct or delete. About you, the operator, we hold the analytics events described above, tied to an identifier for your installation. We do not sell or share personal data. To ask what is held against your installation, or to have it deleted, write to us at the address below.
To delete what the app stores on your device, use the in-app controls (clear history, remove bans, reset statistics) or delete the app. To exercise a right in relation to correspondence you have sent us, write to support@idscanner.slumbiapp.com.
Children
IdScanner is a professional tool for venue staff and is not directed at children. We do not knowingly collect personal information from anyone, children included.
International transfers
No scan data is transmitted, so none of it crosses a border. Analytics events are processed by Amplitude, which operates in the United States and the European Union; see Amplitude's privacy policy for how it handles them. Any email you send us may be processed by our email provider in the country where it operates.
Changes to this policy
If the app's behaviour ever changes in a way that affects this policy, we will update this page and change the date at the top. Material changes will be reflected in the app's App Store listing as well.