Privacy Policy
Effective June 7, 202601Information We Collect
Account information: When you create an account, we store your email address and a hashed password. We do not have access to your plain-text password.
Subscription information: If you subscribe to Pro, our payment processor (Creem) collects payment details. We store your subscription status and expiration date, but never your full credit card number.
Usage data: We collect anonymized analytics including page views, feature usage, and scan counts. This data helps us improve the Service.
02What We Do NOT Collect
Barcode data: Your barcode records are stored locally in your browser. ScanSheet's servers do not store the contents of your scans. (Optional: Pro users may back up to their own Google Drive — see the third-party services section. Those backups live in your Drive, not ours.)
Camera data: Camera access is used only for barcode scanning and happens entirely on your device. No video or images are transmitted to our servers.
03How We Use Information
- To provide and maintain the Service
- To authenticate users and manage subscriptions
- To analyze usage patterns and improve the product
- To communicate important updates (service changes, billing notices)
04Data Storage and Security
Account data is stored in a SQLite database on our server. We use industry-standard practices including password hashing (bcrypt), HTTPS encryption, and CSRF protection. However, no method of electronic storage is 100% secure.
05Third-Party Services
Creem: Our payment processor. When you subscribe to Pro, you are subject to Creem's Terms and Privacy Policy.
Google Fonts: We load fonts from Google Fonts for UI rendering. Google may collect usage data per their privacy policy.
Google Drive (BYOC backup, optional, Pro only): If you choose to enable cloud backup, ScanSheet will initiate an OAuth connection to your own Google Drive. Uploaded files are sent browser → Google (PUT to a session URI); they are never stored on or proxied through our servers. We retain only the encrypted OAuth refresh_token needed to start future upload sessions, plus a small audit log (timestamps, byte counts, status codes — never file contents). You can disconnect at any time from the Cloud backup panel; your Drive files remain yours and are not deleted. We use the drive.file scope, which only grants access to files this app creates, not the rest of your Drive. See Google's Privacy Policy.
06Cookies
We use a single HttpOnly session cookie for authentication. This cookie is essential for the Service to function and does not track you across sites. No third-party tracking cookies are used.
07Data Breach Notification
In the event of a personal data breach affecting your account information, we will notify you via email within 72 hours of becoming aware of the breach, in accordance with applicable data protection laws. We will also notify our payment processor (Creem) and relevant supervisory authorities as required by law. The notification will describe the nature of the breach, the categories of data affected, and the measures taken to mitigate the impact.
08Data Retention
Account data is retained until you request deletion. Barcode data in your browser's local storage persists until you clear it or your browser clears it. Sync sessions expire after 1 hour.
09Your Rights
You may: (a) access and update your account information; (b) request deletion of your account and associated data; (c) export your barcode data at any time; (d) unsubscribe from Pro at any time.
10Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect information from children under 13.
11International Data Transfers
Your data may be processed on servers located outside your country of residence. By using the Service, you consent to such transfers.
12Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of material changes via email or through the Service.
13Contact
For privacy-related inquiries, contact us at support@skycang.com. We aim to respond to all inquiries within 2 business days.