Privacy
Policy

Regional availability · September 28, 2026

AI is disabled for the China mainland App Store storefront. If the storefront cannot be determined, only on-device features are enabled. The backend also rejects AI requests identified by Cloudflare as originating in China mainland. The App Store country code accompanies service requests to enforce regional availability. Scanning, OCR, document management, PDF export and manual reminders remain available. Interface language does not determine storefront eligibility.

1. Scope and availability

This policy covers TinyWorld's Quét Giấy Tờ AI, including App Store version 1.0 and newer test builds. No TinyWorld account is required. Features may vary by version and storefront.

2. On-device documents

Page images, OCR, corrections and saved AI results use an encrypted iPhone vault. Encryption keys and tester tokens use Keychain. Shared files pass through a file-protected inbox. Apple Vision performs local OCR; PDFs may use existing text layers. Document contents are not used for advertising.

3. Optional AI and providers

Before sharing, the app shows a dedicated disclosure identifying the data and recipients (Cloudflare and OpenAI). You must explicitly opt in; closing, skipping or declining does not send document content. On-device scanning, OCR and storage remain available without consent.

TinyWorld requires its processors, Cloudflare and OpenAI, to provide the same or equivalent protection for shared data under this policy, through the applicable service terms and data processing agreements. Data is used to fulfill requests, operate and protect the service. TinyWorld does not enable API content sharing for training or use documents for advertising. Data travels over HTTPS and service access is restricted. Provider retention is described below; this is not a zero-retention commitment.

After consent, each summary/question sends the necessary OCR text and your question, if any, through TinyWorld's Cloudflare service to OpenAI. Original images/PDFs are not sent. Our application server does not intentionally persist contents/responses; the app saves results locally. Failed AI requests are not automatically retried. Revoke future permission in Settings → AI & usage.

We use store:false, which does not mean zero provider retention. OpenAI API data is not used for training by default; abuse-monitoring logs may contain content and be retained up to 30 days, or longer where legally required or reasonably necessary to protect the service or others from harm. See https://developers.openai.com/api/docs/guides/your-data. Cloudflare processes traffic and connection information to operate/protect the service. Remove unnecessary sensitive information before sending.

4. Verification and limits

Some existing testers use individually assigned tokens. Version 1.0 uses Apple App Attest to verify installations for Free AI without embedding an OpenAI key. Apple processes verification information through App Attest. Cloudflare stores an installation reference, public key, anti-replay counter and last-use time, not the device's private key.

The server retains token/installation-linked usage and budget counters for cost control and abuse prevention, without OCR contents. The new flow hashes IPs for abuse counters instead of storing raw IPs. These records are not used for advertising tracking. Personal and service-wide limits both apply.

5. Permissions and sharing

Camera access supports scanning; only selected photos/files are imported. Notifications support reminders, Calendar write access is for events you choose, and device authentication protects the vault if enabled. Manage permissions in iPhone Settings. Exported copies are outside the encrypted vault and need separate protection. Version 1.0 adds PDF export from saved page images without AI.

6. Retention and deletion

Delete individual documents or use Settings → Security & data → Delete all data. The vault/key are excluded from iCloud backup: deleting the app or losing a device can lose documents. Keep originals or export important copies. Offloading may retain data. Source files, exports and Calendar events are managed separately.

App Attest records inactive for over 90 days expire and are cleaned on a subsequent verification request. Challenges last at most five minutes. Usage/budget counters are retained for reconciliation and abuse prevention, without automatic deletion yet. Request deletion of identifiable service records at [email protected]; access verification may be needed. App deletion does not erase data already processed by providers, whose policies apply.

7. Ads, purchases and analytics

App Store version 1.0 contains no advertising SDK and offers no new Pro or Remove Ads purchases. Previous purchases remain readable/restorable through Apple; we do not receive card details. Some earlier TestFlight builds include Google Mobile Ads and optional test ads; Google may process device/connection information in those builds.

Charts and optional action counts are calculated locally. Version 1.0 contains no third-party behavioral analytics SDK. Apple may process transactions, diagnostics and TestFlight feedback under its policies and your settings.

Version 1.1 addendum · 8 October 2026

Version 1.1 is being prepared as Scan Tài Liệu: PDF & AI. The following changes apply when using 1.1; they do not mean 1.0 collects this additional data or Pro is already on sale.

AI still requires separate sharing consent. If you enable Automatic Summary, OCR text from each newly imported document is sent for summary, categorization and tagging within your remaining allowance. Buying Pro does not enable AI or authorize sharing. Disable automatic processing or revoke AI consent in Settings; existing documents are not automatically reprocessed.

To prevent duplicate provider calls, the Cloudflare service may cache results in memory for up to five minutes, without writing OCR, questions or results to the database. Request IDs, hashed fingerprints and deduplication state are retained for up to 24 hours. Usage counters and content-free token/cost aggregates are retained for operation and reconciliation. Failed processing refunds the personal allowance; a connection loss after successful processing may still consume a use. AI is not automatically retried.

Pro uses Apple's auto-renewable subscriptions. The service receives signed transaction evidence and checks current status with Apple. It stores a hashed original transaction reference, product ID, expiry, verification environment and installation association to grant/restore access, enforce limits and handle expiry/revocation. It does not receive card details or Apple passwords. Verification/entitlement records and usage counters do not yet have automatic deletion schedules; contact [email protected] to request deletion of identifiable records, subject to access verification. Deleting app data does not cancel a subscription; manage/cancel through Apple Subscriptions. Restoring Pro does not restore documents.

Google Analytics for Firebase initializes only after you enable its separate choice in Settings → Privacy. It collects an app instance identifier, sessions, app interactions, device/app information, approximate location derived from connections and in-app product/price information measured by the SDK. Data is linked to an app instance and used for analysis and app improvement, not advertising tracking or personalization. Analytics receives no page images, OCR, document titles/categories/amounts, search terms, AI questions or transaction evidence. This Analytics flow does not collect GPS, IDFA or IDFV.

Withdrawing Analytics consent stops collection and resets local buffered Analytics data and its instance identifier; it does not guarantee deletion of events already sent. Google's retention follows the Analytics property's settings and Google's policies. Contact support about data requests; see https://firebase.google.com/support/privacy and https://policies.google.com/privacy. AI and Analytics consent are independent. Document charts continue to run on-device with Analytics off. Release 1.1 does not request or show test advertisements; production advertising remains disabled.

8. Support and changes

TinyWorld receives your email address and information you send to provide support. Do not send private documents, passwords, API keys or card details. Request deletion of correspondence at [email protected]. OCR/AI can be wrong: check originals. The app is not medical, legal or financial advice.

Updated 8 October 2026. This page changes when data handling changes. The website has a separate privacy policy.

9. Contact and Apple services

[email protected]

Apple’s privacy policy