VeraScan Privacy Policy

1. On-device scanning

Camera frames, selected/shared photos and local QR/address analysis are processed on your device. VeraScan does not automatically upload QR content, images or scan history to our server. Temporary app copies used for photo processing are cleaned up after processing. Codes never open automatically: you choose external actions, saving or copying. You may select a photo if camera permission is denied. We do not request location, read-contacts or call-log permissions.

2. Google ML Kit

QR recognition uses Google ML Kit. Images and recognized content are not sent to Google for recognition. The SDK may send technical device/app information, API usage and performance/diagnostic metrics to Google. Local image analysis and SDK technical telemetry are separate.

3. Optional online checks

Online checking is optional. Only the single address you choose and explicitly confirm is sent to our Google Cloud service and Google Web Risk. It may include the domain, path and query; the fragment after # is excluded. Addresses can contain personal data or private tokens. Use local analysis if you do not want transmission. Sent requests cannot be recalled. Absence from a threat list does not guarantee safety.

4. Authentication, access and rewards

Online features use a random installation credential and Google Play Integrity. There is no account registration or email login. Our server processes keyed hashes of installation/request/address fingerprints, authentication state/times, access expiry and internal usage/reservations, reward intent/event hashes and replay-prevention state. These are pseudonymous, not necessarily anonymous. Our database does not store original lookup URLs or images as scan history. New versions grant six hours after server verification of a Google-signed reward. After 30 external lookup attempts, another ad adds 30 attempts while keeping the original end time. Attempts that fail after dispatch may count. Legacy credit balances remain separate.

5. Optional rewarded ads and age protection

VeraScan is intended for general users aged 13 or older, not as an app specifically for children. In versions with age protection, the first time you choose a rewarded ad, you select Under 13, 13–17, 18 or older, or Prefer not to answer. We do not ask for a date of birth or exact age. The selected group is saved in this device’s app settings and can be changed in Settings → Ad age settings.

If you select Under 13 or Prefer not to answer, or make no selection, the app does not start new ad-consent or ad requests to prepare an ad. Local scanning and any valid online pass already granted remain available. For ages 13–17, we apply age protection that restricts personalized ads. For adults, applicable regional ad privacy choices are checked. All permitted ad requests use a maximum ad content rating of G.

We do not send the original age-group selection or a date of birth to yeodarim’s server. When preparing an ad, however, the app sends age-protection signals derived from your selection to Google UMP and Google Mobile Ads. These signals may tell Google whether protective treatment for a minor is required; this does not mean that no age-related information leaves the device. The maximum ad content rating is also sent to Google Mobile Ads.

When ads are allowed by the age setting and you choose an ad, Google UMP checks applicable privacy choices before AdMob prepares the rewarded ad. Google Mobile Ads may collect/share IP addresses (which may estimate approximate location), app/ad interactions, diagnostics and device/account identifiers such as advertising ID and app set ID for advertising, measurement and fraud prevention. Processing restrictions depend on age protection and consent choices. Manage the advertising ID in Android settings and available consent choices through ad privacy options. QR content and lookup URLs are not ad-request parameters. Local analysis is free and unlimited without ads. Completing a test ad may differ from receiving an operating access reward.

6. Retention and automatic deletion

The ad age group is a device-local app setting, not a server record. Selecting another group replaces it. Clearing the app’s data in Android or uninstalling the app removes it, and the setting is excluded from app backups. Google’s handling of protection signals already transmitted is governed separately by the retention information below.

Authentication, request, temporary usage and support-code link records receive a deletion deadline 30 days after their last write. Time-pass state expires 30 days after the later of pass expiry or last write. Reward transaction/replay receipts and shared daily/monthly cost or authentication counters receive a 90-day deadline after their last write. Firestore TTL deletes asynchronously after the deadline, typically within 24 hours rather than instantly. Existing records receive future deadlines using these periods. Legacy credit balances and minimal installation state preventing repeated initial grants are retained while the service is provided and are excluded from automatic TTL. A zero balance does not immediately erase this minimal state. The operator removes it on a verified deletion request or when the relevant service ends. Shared aggregate budgets are not reset by individual erasure requests. Standard Cloud Logging retention is 30 days; mandatory Google Cloud audit logs are retained for 400 days. Support email/content is deleted within 30 days after resolution unless a legal retention obligation applies.

7. Access, deletion and other requests

In app settings, open Privacy · deletion requests and Get support code. This sends app authentication data without QR content. Keep the code before uninstalling and email it with your request to yeodarim.co@gmail.com. After minimal verification connecting the request to the installation, we handle access, deletion or restriction requests and report the outcome. Stop online use while the request is processed. Your name/email alone may not identify an installation, and uninstalling does not erase server records. Unlinked legacy anti-abuse receipts expire on the schedule above. Never send passwords, authentication tokens or QR content. Data you copied/saved to other apps and data independently processed by Google are managed through those services.

8. Providers, regions and international processing

Our online request service and installation state use Google Cloud Run/Firestore in Seoul, South Korea. Google Web Risk, Play Integrity, ML Kit, AdMob and UMP are provided by Google LLC and the applicable contracting Google entities, and may process data in the United States and other countries where Google operates. Data/purposes are the addresses, authentication, technical metrics, ad/consent data and age-protection signals described above. Transfers occur over networks when the applicable feature/SDK operates and use HTTPS/TLS. Google’s own retention follows its service terms and retention policies; our Firestore TTL does not erase Google’s independent records. You may avoid online checks/ads and revoke camera permission in Android settings. Stop using or uninstall the app to stop further app/SDK processing.

9. Operator and contact

Operator: yeodarim. Service: VeraScan – QR Reader. Website: https://yeodarim.com. Privacy/access/correction/deletion/restriction/consent withdrawal: yeodarim.co@gmail.com. Server access is limited to necessary permissions; the device stores installation credentials encrypted. We update this page and its date when practices change, and provide a separate notice/consent before changes that require it.