The short answer
| Quick check | What it tells you |
|---|---|
| The app requires an account | Your scans are probably synced to the company's servers |
| Free, with cloud features | Server processing costs money; it is fair to ask what pays for it |
| Everything works in airplane mode, including text recognition | Processing happens on your phone |
| Data Safety label says "No data collected" | A useful claim, but self-declared; treat it as a starting point |
| A published measurement you can reproduce | The strongest evidence an app can offer |
That is the five-minute version. The rest of this guide explains where scans actually go, the three ways documents leave a phone without the owner noticing, and how to verify any scanner app's behavior yourself.
Where your scans can actually go
Cloud-first scanners are built around upload. An account, cross-device sync, server-side text recognition, and shareable links all depend on your documents living on the company's infrastructure. None of this is hidden, exactly, but it is rarely spelled out at the moment you press the shutter, and it means every scan has a second life on hardware you do not control.
Local apps with cloud features keep files on the device by default, but individual features quietly reach out: text recognition that runs on a server, an optional backup that lands in someone's cloud, a share link that requires an upload first. The app is "local" until the one feature you needed is not.
Fully on-device scanners do everything locally: capture, edge detection, filters, text recognition, export, and storage. There is nothing to sync and no account to attach files to. This is the rarest category, because most business models need the cloud more than you do.
Three ways a scan leaves your phone without you noticing
1. The image stays, the text leaves
Text recognition is the quiet one. Plenty of apps store the scanned image locally but send it to a server to extract the text, because server-side recognition is easier to build than on-device recognition. The searchable text of a tax form, a contract, or a medical letter is every bit as sensitive as its pixels. If an app offers text recognition, it is worth knowing where that recognition runs.
How DocuScanr handles it: text recognition runs entirely on the device, works in airplane mode, and the extracted text is stored inside the same encrypted database as everything else.
2. Sync means copies, and delete is not always delete
Once a document has synced, deleting it from your phone removes your copy, not necessarily theirs. Server-side retention policies, backups of their databases, and processing pipelines are all places a "deleted" scan can outlive your intent. With documents this is not paranoia; it is how server infrastructure normally works.
3. SDK telemetry you never asked for
Even a well-intentioned app ships with third-party components: analytics kits, crash reporters, and transport layers bundled inside common libraries. These phone home with usage data on their own schedule. That traffic is not your documents, but it is network activity happening under the app's name without an obvious trigger.
How DocuScanr handles it: we caught exactly this in our own testing. A Google component bundled inside common libraries tried to upload its usage metrics, so we removed its upload scheduler from the app entirely, at the manifest level, and re-measured until the result was zero attempts. The full story is in the network audit.
Data Safety labels are claims, not audits
The Data Safety section on a Play Store listing is filled in by the developer. Google reviews the declarations, but it does not measure the app's traffic to confirm them, and a label can lag behind what a new version of the app actually does. A label that says "No data collected" is a meaningful public commitment, and a label full of "Data shared with third parties" rows is a clear warning. Just treat both as the beginning of the question, not the answer.
How to check for yourself
- Read the Data Safety label. Thirty seconds, and it filters out the apps that openly declare sharing.
- Run the airplane mode test. Turn off all connectivity, then scan a page, run text recognition, and export a PDF. Whatever still works is running on your phone. One caveat: an app can capture offline and quietly sync later, so also watch what it does when the connection returns.
- See whether it works without an account. No account means there is no server-side identity for your documents to accumulate under.
- Measure it. Android keeps per-app network counters independently of the app. With a USB cable and the adb tool, you can snapshot any app's byte counters before and after a scanning session, no root required. Our network audit walks through the exact commands; they work on any app, not just ours.
What a fully on-device scanner looks like
DocuScanr is built as the third category: document detection, perspective correction, filters, text recognition, annotation, and PDF export all run on the phone, and every document is encrypted at rest with AES-256-GCM. There is no account, because there is nothing to sign in to.
The honest part: DocuScanr still holds network permissions, because bundled libraries (opt-in crash reporting, Google Play billing) declare them. So instead of asking you to trust the architecture, we measured it at the operating system level: zero bytes and zero connection attempts across launch, scanning, and sustained text recognition, with the method published so you can reproduce it on your own device.
Verify, do not trust: the complete measurement, what it caught along the way, and the reproduce-it-yourself commands are on the network audit page.
