# Are Scanner Apps Safe for Client Documents?

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2023-05-14T20:09:44Z
- Updated: 2026-10-11T19:22:20Z
- Category: Phone scans and photos
- Canonical: https://www.schemalaw.com/blog/are-scanner-apps-safe

> Are scanner apps safe for client documents? Check four things first: permissions, the store's privacy disclosure, where the pages go, and your firm's rule.

Scanner apps are safe for client documents only when you have checked four things about the one you use: what it can reach on your phone, what its developer declares in the app store, where your pages go after capture, and whether your firm has approved it. No app is safe or unsafe by category.

A scanner app is a camera with opinions about paper. The scanning itself happens on a device you hold. The questions that matter for a client's lease or medical record are about everything around the scan: accounts, sync, advertising code and stored copies. The app stores publish enough to answer part of that before you install anything, and this post walks through reading it.

## Are scanner apps safe for confidential documents?

Whether a scanner app is safe for confidential documents depends on four things you can check before the first client page: the permissions the app holds, the privacy disclosure on its store page, whether scanned pages leave the phone, and whether the app is on your firm's approved list. An unknown app is an unknown.

The four checks, and where each is answered:

| Check | The question | Where you look |
| --- | --- | --- |
| Reach | What on this phone can the app see? | The phone's permission settings |
| Declaration | What does the developer say it collects, and why? | The App Store privacy label or Google Play's Data safety section |
| Destination | Do pages stay on the phone, go to an account you control, or go to the developer? | The app's settings, its privacy policy and its terms |
| Approval | Has the firm agreed to this app for client paper? | The firm's phone or technology policy |

Two limits apply to all of it. First, the store disclosures are written by the developer. Apple says of its label program that "the information is self-reported by the developer" in its page [about privacy information on the App Store](https://support.apple.com/en-us/102399). Second, a store page is a summary. The privacy policy and terms are the documents that bind, and the same questions you would put to any service that receives a file apply here. Those are set out in the list of [questions to ask an OCR vendor](https://www.schemalaw.com/blog/is-it-safe-to-upload-client-documents-to-an-ocr-tool#which-questions-should-you-ask-an-ocr-vendor).

Whether using a given app is consistent with your professional duties is for you and your jurisdiction's rules. The post on [attorney-client privilege and AI tools](https://www.schemalaw.com/blog/attorney-client-privilege-and-ai-tools) covers that ground. The four checks are the fact-finding that comes first.

## What can a scanning app see once you grant camera and photo access?

With camera access, a scanning app can take pictures and record video while the permission allows. With access to photos or files, it can read whatever that permission covers, which may be far more than the pages you scan. Grant the narrowest option your phone offers and review it afterwards.

### On an iPhone

Apple's iPhone User Guide says that "You control whether third-party apps have access to information in Contacts, Photos, Calendar, and other apps", and that after you grant or deny a request you can change it later under Settings, Privacy & Security. The page on [controlling access to information in apps on iPhone](https://support.apple.com/guide/iphone/control-access-to-information-in-apps-iph251e92810/ios) has the steps. The companion page on [controlling access to hardware features](https://support.apple.com/guide/iphone/control-access-to-hardware-features-iph168c4bbd5/ios) covers the camera, and notes that "Whenever an app uses the camera" a green indicator appears.

The same guide describes an App Privacy Report, which "shows you how apps are using the permissions you granted them and shows you their network activity". For a scanner app that is a useful second opinion. Turn the report on, scan a test page that is not a client document, and read the network activity the report lists for the app.

A photograph of a client's lease or medical bill can carry a place into every copy you send. Turn location off before you capture, then write in the file where the image went. If the scan later serves as documentary evidence, that short record helps with authentication and keeps the chain of custody from depending on a hidden map pin.

### On Android

Google's help page on [changing app permissions on an Android phone](https://support.google.com/android/answer/9431959?hl=en) lists what each permission allows. Three matter for a scanner:

- **Camera:** "Take pictures and record videos."
- **Photos and videos:** "Access photos and videos on your device."
- **Files:** "Access all files on your device."

The page says that for some permissions you may be able to choose "Allow only while using the app" or "Ask every time" instead of a standing grant. It also describes a setting, "Pause app activity if unused", that removes permissions from apps you have stopped opening.

Android has a narrower way to hand over pictures as well. Google's page on the [Photo Picker](https://support.google.com/android/answer/13356023?hl=en) says that with it "you can choose with which apps individual photos and videos get shared", and that some of the steps work only on Android 13 and up. Where a scanner offers it, you hand over the pictures you select instead of opening the whole gallery to the app.

### What to grant a scanner app

| Permission | A scanner needs it for | Grant |
| --- | --- | --- |
| Camera | Capturing pages | Yes, limited to while the app is in use where the phone offers that |
| Photos or gallery | Importing pictures already taken | Only selected items, or not at all if you scan live |
| All files | Saving to a folder you choose | Question it; a save dialog does the same job without a standing grant |
| Contacts, location, microphone | Nothing a page capture requires | No |

An app that will not open without contacts or location has given you a reason to read its privacy policy before going further. A camera photo may also carry the place it was taken, which is one more reason to refuse location to a scanner.

## Reading an App Store privacy label for a scanner app

Scroll to App Privacy on the scanner app's App Store page and read three things: which heading each data type sits under, whether "User Content" appears, and the purposes listed beside it. Then remember that the developer wrote the label and that Apple's definition of "collect" has limits.

### The headings

Apple's support page on [privacy information on the App Store](https://support.apple.com/en-us/102399) explains the headings a label can carry.

- **Data Used to Track You.** Apple describes this as data from the app "linked with your data collected from other companies' apps, websites, or offline properties, and used for ads or shared with a data broker".
- **Data Linked to You.** Data "collected in a way that is linked to your identity, such as to your account, your device, or your details".
- **Data Not Linked to You.** Apple says that to use this heading a developer "must use privacy protections such as stripping any direct identifiers" before collection.
- **Data Not Collected.** On Apple's own [privacy labels page](https://www.apple.com/privacy/labels/), this label reads "The developer does not collect any data from this app."

### The line that matters for scanned pages

Apple's developer documentation on [app privacy details](https://developer.apple.com/app-store/app-privacy-details/) lists the data types a developer chooses from. Under User Content it includes "Photos or Videos", defined as "The user's photos or videos", and "Other User Content", defined as "Any other user-generated content". If either appears on a scanner app's label, tap through to see the purpose given: app functionality, analytics, advertising or something else. A scanner that lists your photos under an advertising purpose has answered your question.

### What "collect" leaves out

The same developer page defines the word the whole label rests on:

> "Collect" refers to transmitting data off the device in a way that allows you and/or your third-party partners to access it for a period longer than what is necessary to service the transmitted request in real time.

Read that twice. Under this definition, a page sent to a server, processed and discarded straight away does not count as collected. So a label that says "Data Not Collected" does not, on its own terms, promise that a page never left the phone. It is a statement about retention and access after the request is served. To learn whether pages are transmitted at all, you need the privacy policy or a direct answer from the developer.

Apple's support page also notes that developers "may choose not to disclose a data type" in limited cases, and that an app with different practices in free and paid versions "should report all of the data types collected for both cases". A label on a free app may therefore describe the paid tier as well, or the reverse. The developer's privacy policy is where the difference is explained, if it is explained anywhere.

## Reading the Data safety section for a scanner app on Google Play

Open the app's Google Play listing, find Data safety and select See details. Read what is collected, what is shared, the stated purposes, whether data is encrypted in transit and whether you can ask for deletion. The developer supplies the answers, and the definitions have exceptions.

Google's help page on [the Data safety section](https://support.google.com/googleplay/answer/11416267?hl=en) explains each part.

### Collected and shared

Google says data "is generally considered 'collected' when the developer uses their app to retrieve data off your device", and "shared" when it is "accessed by the app and transferred to a third party". For a scanner, look for two data types in the list: "Photos and videos", and "Files and docs", which Google defines as "Your files or documents, or information about your files or documents, such as file names."

### The exceptions

The page then lists cases a developer need not disclose as collection. Two matter here.

- Where "An app accesses the data only on your device and it is not sent off your device."
- Where data is "sent off the device but only processed ephemerally", which Google explains as the developer using the data "only when it is stored in memory" and retaining it "for no longer than necessary to service a specific request".

Sharing has its own carve-outs, including data "transferred to a service provider to process it on the developer's behalf". So a Data safety section with no "Files and docs" entry is consistent with an app that never transmits your pages, and also with one that sends each page to a hosted service for recognition and does not keep it. The section alone cannot tell you which.

### Security practices and deletion

Under security practices a developer can declare that the app "Encrypts data that it collects or shares while it's in transit". The page also describes an optional independent security review, and is direct about its scope: "This review does not verify the accuracy and completeness of the developer's Data safety section disclosure."

The Data deletion part says apps that offer account creation must provide an in-app path to delete the account and associated data, and a web link for the same request. If a scanner app makes you create an account, find that path before you scan a client page, not after.

### A side-by-side reading aid

| You want to know | App Store label | Google Play Data safety |
| --- | --- | --- |
| Are my pages kept by the developer? | "Photos or Videos" or "Other User Content" under User Content | "Photos and videos" or "Files and docs" under data collected |
| Is the data tied to me? | Data Linked to You | No matching heading; read the privacy policy |
| Is it used for advertising? | Data Used to Track You, and the purposes shown | "Advertising or marketing" as a purpose |
| Does it go to other companies? | Tracking heading and the privacy policy | Data shared |
| Is transient processing shown? | No, by the definition of "collect" | No, where processed ephemerally |
| Who wrote it? | The developer | The developer |

## Does a scanner app upload your pages to its own servers?

A scanner app can upload your pages to its own servers, and the store page may not say. Pages can stay on the phone, go to a storage account you control, or go to the developer's service. To find out which, read the app's settings and policy and watch what it does with a test page.

### Three destinations

1. **The phone only.** Google's guide to [scanning with Files by Google](https://support.google.com/files/answer/15598575?hl=en) says scans are found in a dedicated "Scanned" folder in the "Downloads" directory. Samsung's page on [scanning with a Galaxy phone or tablet](https://www.samsung.com/us/support/answer/ANS10003696/) says the document "will be saved in the Gallery app". A file on the phone can still be swept up by whatever backs up or syncs that folder or gallery, so check those settings as well.
2. **A storage account you chose.** Google's guide to [scanning documents with Google Drive](https://support.google.com/drive/answer/3145835?hl=en&co=GENIE.Platform%3DAndroid) says the scans are saved "as searchable PDFs on your Google Drive". The page lands in whichever Google account the app is signed in to. On a phone with both a personal and a firm account, that is worth a look before every session.
3. **The developer's own service.** An app may send pages to its servers to recognize text, to sync between your devices or to back them up. Nothing in this post can tell you which apps do; the app's own documents have to.

### How to find out for the app in your hand

- **Read the settings screen.** Look for sync, backup, cloud, account and "improve our services" switches, and note which are on by default.
- **Search the privacy policy** for "upload", "server", "process", "retain", "train" and "third parties".
- **Try airplane mode.** Scan a harmless page with the phone offline. If scanning works and text recognition does not, recognition is happening somewhere else.
- **Check for an account wall.** An app that will not save without sign-in has a server side by design.
- **Look at network activity.** On an iPhone, Apple says the App Privacy Report shows an app's network activity.

The airplane-mode test is evidence, not proof. An app can queue an upload until the connection returns. Treat a clean result as one good sign among the others.

### After the scan

The copies do not end with the app. A scan can sit in the app's own library, the gallery, a downloads folder, a cloud trash and a message thread at once. The post on [deleting scanned documents from a phone](https://www.schemalaw.com/blog/delete-scanned-documents-from-phone) goes through each place. And when the scan moves on to a converter, the same destination question applies there. Schema Law states four commitments on every plan: "Your documents are never used to train an AI model", "Documents stay inside your own account", "Encrypted in transit and at rest" and "Delete any document, at any time". They appear in [the security section of the homepage](https://www.schemalaw.com/#security).

## A scanner app rule a firm can put in its phone policy

A workable rule names the approved scanning apps, says which account scans are saved to, limits permissions, bans personal cloud sync for client pages, and sets a deadline for removing scans from the phone. Keep it to one page so that people read it.

### Sample wording

Adapt this to your firm. It is a starting draft, not advice on what your jurisdiction requires.

> **Scanning client documents with a phone**
>
> 1. Use only the scanning apps on the firm's approved list. The list is reviewed when an app changes owner, changes its privacy policy or adds a cloud feature.
> 2. Before first use, set the app's permissions to camera only, while in use. Do not grant contacts, location or microphone.
> 3. Save scans to the firm's storage account. Never save client pages to a personal cloud account or a shared family album.
> 4. Turn off any in-app sync, backup or "improve the product" setting unless the firm has approved it in writing.
> 5. Do not install a scanning app to handle a single urgent document. Use the phone's built-in scanner or camera and tell the office.
> 6. Within one working day of sending a scan to the office, delete it from the app, the gallery, the downloads folder and every trash or recently deleted folder.
> 7. Report at once any scan saved or sent to the wrong place.

### How the firm builds the approved list

For each candidate app, one person records the answers to the four checks: permissions requested, the App Store label and Data safety entries on the date reviewed, where pages are stored and processed according to the policy, and the deletion path. Keep a dated screenshot of each store disclosure, because developers can revise them. The built-in scanners on a phone are the natural first entries, and the post on [choosing a free app to scan documents](https://www.schemalaw.com/blog/best-free-app-to-scan-documents) compares the options on features.

A scanner app rule is one clause of a wider policy on where client documents may be sent. The post on [a law firm AI policy for document uploads](https://www.schemalaw.com/blog/law-firm-ai-policy-document-upload) covers the rest. For Schema Law's plans and what each includes, see the [pricing page](https://www.schemalaw.com/pricing).

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)