Papyrion: PDF Scanner & OCR
Last updated: 29 September 2026 · Version 1.1
The controller responsible for processing personal data in connection with the "Papyrion: PDF Scanner & OCR" app is:
auronet GmbH
Labbéstr. 18
41169 Mönchengladbach
Germany
E-Mail: info@auronet.de
Papyrion turns paper into searchable PDFs on your phone: you scan one or more pages, review and straighten them, and export or share the result — then find documents again with full-text search. Everything runs on your device. There is no backend and no cloud AI service — your scans and recognised text never reach us. They only leave your phone if you choose to connect your own ownCloud or OpenCloud server for automatic upload (§6). You can use the app without an account; no name, email, or sign-in is required.
The app is free to download. Scanning, filters, standard-quality PDF/JPEG export, and the document library are free. On-device text recognition (OCR), full-text search, folders, high-resolution export, naming templates, the app lock, and automatic upload to your own ownCloud / OpenCloud server are a one-time in-app purchase — there is no subscription and there are no ads.
| Category | Examples | Where it lives |
|---|---|---|
| Page images | Scanned pages, cropped/rotated/filtered versions, originals kept for re-cropping, exported PDFs, JPEGs and text files you create | On device only (app storage) |
| Recognised text | OCR words, positions and confidence scores, and the search index built from them | On device only (local database; Pro feature, see §5) |
| Camera / photo library / file access | Used to scan a page or import a picture or file you choose | On device |
| App preferences | Document titles and folders, view and sort options, paper format, naming template, app-lock and OCR-language choices, the Pro unlock flag, your analytics choice, and the random analytics ID | On device only (local app storage; the analytics ID and your analytics choice are held in the system keychain / keystore) |
| Cloud upload (optional, Pro) | The address of your own ownCloud / OpenCloud server, your username and an app token you create there; the list of documents waiting for upload and their upload status | Server address, username and app token: system keychain / keystore on your device, never backed up to other devices. Uploaded PDFs: your own server (see §6) |
| Analytics events | A randomly generated app-local ID plus technical context added automatically by the analytics SDK — app version and build, OS name and version, platform, device manufacturer and model name, screen size, language and time zone — and feature events (e.g. app opened, screen viewed, scan started/completed with page count, page edited, OCR completed with timing/language/confidence bucket, export with format/quality/page count/text layer, cloud server connected with its type (ownCloud / oCIS / OpenCloud), cloud upload with outcome code, page count and size/duration bucket, paywall shown, purchase started / completed / restored, settings changed, error shown). PostHog additionally derives an approximate location (country/region level) from the IP address of the request; the IP itself is not stored on the event. No page images, no document titles, no OCR text, no name or email, no server address, username or folder, and no advertising or device identifier (no IDFA, IDFV, or Android Advertising ID) | PostHog (EU cloud) — only if you opt in, see §7 |
| Purchase data | Purchase / receipt status, entitlement status | App store / RevenueCat |
| Technical data | App version, OS version, crash reports collected by Apple or Google if you have enabled sharing in your device settings, or by our crash reporting if configured (no screenshots, scrubbed of document content) | On device / app store |
We do not upload your scans to us, build advertising profiles, run ads, or sell data. We do not require an account.
With the Pro unlock, the app reads the text on your pages on-device and stores the words — with their positions — in the local database so you can search your archive and export searchable PDFs and text files. Recognition runs only after purchase: free users have no OCR data at all. If the unlock lapses (e.g. after a refund), the OCR features hide again but your stored text is kept.
With the Pro unlock you can connect your own ownCloud or OpenCloud server (or one run by your organisation) under Settings → Cloud upload. Nothing is uploaded unless you set this up. Once connected, each new document is sent as a PDF — including its title as the file name and, if you keep the option on, the recognised text as a searchable layer — directly from your device to that server over an encrypted HTTPS connection. You can also choose to upload documents you scanned earlier.
We use PostHog on its EU cloud to understand which features are used and where people get stuck — only if you opt in under Settings → Privacy → Share usage data (off by default). Events carry no page images, no document titles, no recognised text, no name, no email, and no advertising or device identifier — the only identifier is a random ID the app generates for itself on first launch, which is not linked to you and which we cannot connect to any other account or service. Alongside it, the analytics SDK attaches the technical context listed in §3 (app version, OS, device model, screen size, language, time zone), and PostHog derives an approximate country/region from the request IP. On Android the random ID is removed when you uninstall; on iOS it is stored in the system keychain, which the operating system may keep across a reinstall.
Screen-view events are sampled: a fixed share of installations (currently 25%, chosen by hashing the random ID) reports them and the rest never send them at all. All other events are recorded in full. You can opt out at any time in the app under Settings → Privacy → Share usage data. The switch takes effect immediately: no further events are sent, and on the next launch the analytics client is not started at all.
| Purpose | Legal basis |
|---|---|
| Scanning, recognising, organising and exporting your documents (on-device) | Performance of a contract, Art. 6(1)(b) |
| Uploading your documents to the server you connected, at your request | Performance of a contract, Art. 6(1)(b) |
| Processing purchases & validating receipts | Performance of a contract, Art. 6(1)(b) |
| Usage analytics (feature adoption, funnel analysis) | Consent, Art. 6(1)(a) — opt in via Settings, withdraw any time, see §7 |
| Stability, diagnostics, security | Legitimate interest, Art. 6(1)(f) |
Because scanning and recognition are on-device, we do not share your documents with anyone. If you connect your own server (§6), your device sends documents straight to it — that server is yours, not a recipient of ours. The only external parties we work with are:
Transfers outside the EU/EEA. Analytics events are processed in the EU. RevenueCat, Inc. is based in the United States, so purchase and entitlement data is transferred there; that transfer is covered by the EU standard contractual clauses in our data processing agreement with RevenueCat, supplemented by the EU–US Data Privacy Framework where RevenueCat is certified. Apple and Google process purchases under their own terms and transfer mechanisms.
OCR, full-text search, folders, high-resolution export, naming templates, the app lock and automatic upload to your own server are unlocked by a one-time in-app purchase (Papyrion Pro, currently €9.99 — the exact price is shown in the app in your local currency). There is no subscription and no automatic renewal. Payment is handled by the app store; we do not receive full payment details (e.g. card numbers), only the purchase/receipt status needed to unlock Pro. A previous unlock can be restored via Restore Purchases on the paywall. Refunds are handled by the app store under its policies — contact Apple or Google, not us, for refund requests. Consumer withdrawal rights that apply where you live are unaffected; note that because the unlock immediately starts recognising your library on-device, you may lose a statutory withdrawal right for that digital content.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Because your scans and recognised text live only on your device, you control them directly — delete them or uninstall the app at any time. You can withdraw analytics consent directly in the app by switching off Settings → Privacy → Share usage data. For anything else, contact info@auronet.de.
You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany (ldi.nrw.de). You may also complain to the authority where you live or work.
We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. Text recognition and search are local measurements of the pages you supply; they produce no decision about you as a person. You are not required to provide any personal data: the app works without an account, and analytics is optional — switching it off has no effect on any feature.
We have not appointed a data protection officer, because the criteria in Art. 37 GDPR and § 38 BDSG do not apply to us. Data protection enquiries reach us at the address in §1.
The app is a general-purpose document tool and is not directed to children under 16, and we do not knowingly collect data from children — scans and recognised text are processed only on-device and are never uploaded to us.
We may update this policy, for example when adding features or in response to legal changes. The current version is always available in the app and at this address.
© 2026 auronet GmbH · Papyrion: PDF Scanner & OCR