1. Who we are
MintScan: QR & Barcode Scanner (“MintScan”, “the app”) and this website are provided by Truetech Solutions (SMC-Private) Limited, a company registered in Pakistan. We are responsible for the personal information we collect for the purposes described here.
This policy covers the Android app, this MintScan website, purchase-related processing and support correspondence. Contact info@truetechsol.org with “MintScan privacy request” in the subject. The app package is org.truetechsol.mintscan. No MintScan account is required.
2. Scans, photos and your library
QR codes and barcodes are decoded on your device using a bundled on-device model. Camera frames and the images you choose for scanning or a logo are processed locally; the app does not upload them to our server for decoding.
Your optional local library can contain decoded content, format, timestamps, favourites, titles, notes, collections, tags, styling and an encoded logo. Scan history is enabled by default, but automatic saving of Wi-Fi and contact scans is disabled by default. You can explicitly save those results. Generated codes are saved when you create them.
The local library is stored in the app’s private storage. It is not separately encrypted by MintScan. Password-encrypted backup files are a separate optional Pro feature. Android cloud backup and device-to-device extraction of the app’s private data are disabled by the app’s backup rules.
You control local deletion through Library and Settings. Files you export or share to another location are separate copies and are not removed when you clear the app’s library.
3. App usage analytics and profiles
MintScan uses PostHog, configured for its EU ingestion region, to understand how the app is used. A persistent, pseudonymous installation identifier connects events and a profile for the same app installation. It is not a MintScan login or your name/email address. Clearing app storage or reinstalling can create a new installation identity.
Reported information includes:
- Screen visits, navigation, foreground usage and time spent.
- QR/barcode scan and creation events and cumulative counters; code formats and content categories; camera mode, zoom and torch actions; photo and batch outcomes.
- Feature use, library/search/filter actions, search length and result counts, selection/deletion counts, export/backup outcomes and operation timings.
- Paywall and benefit-prompt activity, plan-load outcomes, purchase attempts/cancellations/completions, restore outcomes, and whether Pro access is confirmed.
- Review/update request outcomes, app settings, app/build version, device manufacturer/model, Android version, language, window dimensions, phone/tablet layout classification and font scale.
We exclude raw scanned or created code contents, scanned URLs, Wi-Fi passwords, contact payloads, search text, titles, notes, image contents, exported files and purchase tokens from our app analytics events. Session replay and automatic deep-link capture are disabled. The SDK’s IP-based geolocation lookup is disabled; network providers still receive the IP address needed to handle a connection.
These profiles support product improvement and feature/purchase-flow analysis. They do not provide us with your Google password, payment-card details or the contents of your scans. See PostHog’s privacy information.
4. Crash reports and technical SDK data
Firebase Crashlytics automatically processes crash traces, technical diagnostic identifiers and device/app information to help us diagnose failures. We add limited app context such as the current screen and Pro status. We do not deliberately add scanned content, Wi-Fi credentials, contact payloads or selected images to crash logs.
Crash reporting is part of the current app and has no in-app opt-out. Google ML Kit and related Google services may also process technical SDK/device, performance and diagnostic information under their own terms. On-device decoding does not mean these technical services make no network connections.
See Firebase’s privacy and security information and ML Kit’s Android data disclosure.
5. Purchases and Pro access
Lifetime Pro is an optional one-time purchase, not a subscription. Google Play processes payment. RevenueCat validates purchases and manages Pro entitlements using an app user identifier, product/purchase information, purchase tokens and technical app/device information needed for that service.
We receive purchase/entitlement status and purchase-flow information, not your full payment-card details or Google account password. Purchase reporting is separate from scan-content processing. Purchase records may need to be retained for entitlement restoration, fraud prevention, accounting or legal obligations even after other data is deleted.
See RevenueCat’s privacy policy and Google’s privacy policy. Your current local price is shown by Google Play in the app before confirmation.
6. Permissions, actions and sharing
The app requests camera access for live scanning. You can use photo scanning without granting camera access. Android’s system photo picker and document chooser grant access to the files you select; the app does not ask for broad access to your photo library or contacts.
Opening a decoded link or map, searching a product barcode, adding a contact/calendar event, sending an email/SMS, dialling a number, copying content, or sharing/exporting data transfers the selected content to the relevant app or service. Those are user-initiated actions subject to that service’s policies. MintScan does not automatically open scanned websites.
A QR code you create can reveal whatever information it encodes to anyone able to scan it. Treat Wi-Fi passwords, contact details and exported libraries accordingly. Backup files are encrypted with the password you choose; we do not keep a recovery password.
7. This website and email support
This website provides product information and illustrative, preset demonstrations. It does not access your camera, decode your uploaded files or receive your app library. There are no advertising scripts, website analytics SDKs or tracking cookies in the website code. An animation preference may be stored in your browser’s session storage until the tab/session is closed.
The website is hosted on Vercel, with domain/DNS services associated with Cloudflare. Hosting/network providers process technical request data such as IP address, requested URL, browser headers, timestamps and security/diagnostic information needed to deliver and protect the website. This is distinct from the app’s PostHog analytics. See Vercel’s privacy policy and Cloudflare’s privacy policy.
Support links open your email application. We receive only the information you send, such as your email address, message, any attachments and optional technical/support identifiers. In-app Feedback pre-fills editable app/device details and installation support IDs to help with troubleshooting or privacy requests. You can review or remove them before sending. Nothing is emailed automatically.
8. Purposes and service providers
We use the information described above to provide the requested functionality, maintain Pro access, respond to support/privacy requests, improve usability and reliability, understand feature use, prevent abuse and meet applicable legal obligations. We do not sell personal information or use it for third-party advertising.
Information is processed by service providers used for analytics, diagnostics, purchase management, website delivery, email and related security. Providers may act in different roles for their own platform services. We may also disclose information when legally required, to protect rights/security, or as part of a lawful business transfer with appropriate safeguards.
Depending on your location and the processing involved, relevant legal bases may include providing a requested service/contract, legitimate interests where permitted, legal obligations, and consent where required. This policy does not remove rights or consent requirements provided by applicable law.
9. Retention, security and international processing
Local app data remains until you delete it, clear app storage or uninstall, subject to Android’s storage behaviour. Exported/shared files remain wherever you saved or sent them. Service-side analytics, diagnostic, purchase, hosting and support information is retained as needed for the purposes above, applicable provider/project retention settings, resolving requests/disputes and legal obligations. We do not promise that clearing local history instantly erases separate service-side records.
We use app-private storage, HTTPS connections for configured services, restricted access and password encryption for backup files. No storage or transmission method is guaranteed to be completely secure. The ordinary local database is not separately encrypted by the app.
Service providers may process information in countries other than yours. PostHog EU ingestion does not mean every other service or support record stays in the EU. Applicable contractual and provider safeguards apply to international processing.
10. Your choices and data requests
You can deny camera permission, choose individual files, disable local history, control automatic saving of sensitive codes, delete selected library records, clear the library, or clear app storage/uninstall. These controls affect local data and do not disable mandatory app analytics/crash reporting or cancel/refund a purchase.
Depending on your location, you may have rights to access, correct, delete, restrict or object to certain processing, portability, withdrawal of consent where it is the basis used, or a complaint to an appropriate authority. Contact support to exercise applicable rights. We may need reasonable information to locate the correct pseudonymous records and verify a request; we may be unable to identify records without it.
The app’s Settings → Privacy → Support IDs screen provides analytics and purchase installation IDs you can choose to copy or include in an email. Never send passwords or raw QR contents just to identify your installation. Some diagnostic records may need additional approximate date/version/device information to locate them.
See Data requests for local deletion steps and an email template. Some records may be retained where required for purchases, legal obligations, security or the protection of rights.
11. Children and changes
MintScan is a general-purpose utility and is not directed at children under 13 or below the age at which local law requires parental permission. We do not knowingly request children’s personal information. Contact us if you believe a child has provided information that should be addressed.
We may update this policy when the app, website or legal requirements change. The updated policy will be posted here with a revised date. Material changes will be communicated as required by applicable law. Contact info@truetechsol.org if you have questions.