Privacy policy

Effective 20 October 2026 · Version 2026-10-20.1

luluScanner is operated by Wong Kwok Shing, an individual. Contact: support@lulunaka.com.

What stays on your device

Scanned images, documents, on-device OCR text, edits and exported files are stored locally. There is currently no automatic cloud document library or cross-device document sync. Backups you export remain wherever you choose to save or share them. Removing an account does not erase these local files, exported copies or your backups.

Accounts and security

If you register or sign in, Firebase Authentication processes your account ID, email address, linked sign-in providers, profile details supplied by those providers (such as a display name or profile photo URL), and authentication credentials/tokens. Google or Apple processes its own sign-in flow; we do not receive your Google or Apple password. Apple may provide a private relay email. Firebase App Check and its platform attestation providers process technical app/device and network information to protect the service. Firebase processes account and service data on infrastructure that may be outside your country; our Firestore database and callable functions are configured in Hong Kong.

Optional AI processing

AI is not currently open to normal app users. When enabled, an explicit AI request sends the selected OCR text to our Firebase backend and then OpenRouter and its selected model provider to produce suggestions. Do not include sensitive information you do not want those providers to process. Images are not uploaded by the current text organization/classification flow. Experimental image services have separate consent and are not generally enabled. Providers can have their own retention and international processing practices; we do not promise zero retention or training exclusion for an unverified route.

The backend stores request results for up to 24 hours for retrieval/retries, then scheduled cleanup removes them; cleanup can be delayed by failures. AI points, request status and security limits are associated with your account. Results saved to your local documents remain until you remove them. AI upload consent is separate from accepting the terms.

Subscriptions and advertising

RevenueCat is being configured in a Test Store; real subscriptions are not yet available. When enabled, RevenueCat receives an anonymous app identifier or your Firebase account ID, purchase/receipt and entitlement information to verify access, restore purchases and share access after sign-in. Apple or Google handles store payment information; we do not receive your full payment card details. Signing into the same member account can share subscription access, but does not sync documents.

Ads are currently disabled. Before AdMob is enabled, the app will request applicable ad privacy choices separately and this policy and store disclosures will be updated. Accepting these terms is not advertising consent.

Retention and deletion

Account information is kept while your account remains active. You can request deletion in the app or through our account deletion page. After identity verification, the backend queues deletion of your Firebase account, member data and cloud AI records. Scheduled cleanup retries failures. Subscription service records are handled when that service is connected; contact us about any remaining billing records.

To prevent repeated free-trial claims, a hashed email claim and deletion receipt may remain for 90 days after deletion. Subscription webhook deduplication records expire after 30 days. Transaction identifiers and shared point-budget records may be retained for billing integrity and fraud prevention; deletion does not cancel store subscriptions or remove records held independently by Apple, Google or other providers. Necessary legal/security records and support correspondence may be retained while needed for those purposes.

Terms and AI consent records

For identified members, the backend records the accepted terms version and server time until account deletion. Each explicitly authorized AI request records its purpose, consent version, server time, request identifier and a content fingerprint under that member account; the separate consent receipt contains no document text. Receipts are scheduled for deletion after 30 days; cleanup may be delayed by failures. Account deletion also removes these records. In Account > Privacy and consent you can view the current terms record and withdraw earlier AI upload authorizations that have not started. Already started transfers cannot be recalled. Each later upload requires fresh explicit consent. Device-only acceptance before sign-in is not automatically attributed to a member.

Your choices

You can use local scanning without an account, choose what to upload or share, unlink access through your provider, delete local documents/backups yourself and request access, correction or deletion of account data by email. We verify requests to protect your account. Do not send passwords, verification codes or full card details. We do not sell your documents or account data. We may disclose data when required by law or to protect the service.

Service providers include Firebase/Google, RevenueCat, and, for enabled AI requests, OpenRouter and the selected model provider. Their policies also apply to their processing.

Changes and contact

We will update the effective date when this policy changes and provide an in-app notice for material changes. For privacy questions or requests, contact Wong Kwok Shing at support@lulunaka.com.