1. Who we are
Snaparo is published by Diomo Enterprise S.R.L., trading as Diomo (“Diomo”, “we”, “us”), a company registered in Romania under CUI 45514206 and Trade Register number J40/1066/2022, VAT number RO45514206, with its registered office at Strada Învingătorilor, Nr. 9-11, Et. 2, Ap. 27, București, Sector 3, Romania.
For the personal data described in this policy, we are the controller within the meaning of Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”). You can reach us at contact@diomo.app. We have not appointed a data protection officer, because our activities do not require one; every privacy question goes to the same address.
2. Scope
This policy applies to the Snaparo app for Android (the “App”) and to the website at diomo.app (the “Website”). It does not apply to services run by others that you use together with the App, such as Google Play, a cloud storage service, an email app or any app you share a document with. Those services handle data under their own privacy policies.
3. Your content stays on your device
The App is designed so that what you create in it never reaches us. In this policy, “Your Content” means everything you create or keep in the App, including the images of pages you scan or import and the PDF files made from them; the text recognised from them, the search index built from that text and the web addresses, email addresses and phone numbers found in it; folders, tags, bookmarks, reminders and their notes; the signatures you draw; the documents in the vault; and your settings.
Your Content is stored in the App’s private storage on your device, which other apps cannot read. We operate no server that receives it and have no means of accessing it. We do not collect, view, analyse, sell or share Your Content.
Android’s backup to your Google account is switched off for the App, so that feature does not copy Your Content to Google’s servers. When you move to a new phone by cable or by direct transfer, Android may copy the App’s data from your old phone straight to the new one, without passing through a server.
Uninstalling the App, or clearing its storage, permanently deletes Your Content from the device. We cannot recover it.
4. When your content leaves your device
Your Content leaves your device only when you send it somewhere, for example when you share, print or export a document; send a month’s documents to your accountant; save a backup or set up automatic backups; attach a Snaparo document from another app through Android’s file browser; or open a web link found on a page.
Each time, you choose where it goes. The recipient, such as a cloud storage service, an email app, a print service or the person you send it to, handles it under its own terms and privacy policy, and we are not responsible for what it does with it. Through Android’s file browser, other apps receive only the documents you pick. They cannot reach documents in the vault or in Recently deleted, and they receive nothing while the App lock is on.
5. Backups
A backup is a single file that the App writes to a location you choose: your device, a memory card, or a cloud storage app installed on your device, such as Google Drive. If you choose a cloud storage app, that app uploads the file under its own terms. We never receive a copy.
You can protect a backup with a password. The App then encrypts the file on your device (AES-256) before writing it, and only that password can open it. We do not know the password and cannot recover it, or the backup, if it is lost.
6. Data processed when the app goes online
Scanning, text recognition, search, and translation into a language you have already downloaded all work without an internet connection. The App connects to the internet only for the purposes below. None of these connections carries Your Content.
6.1 Checking and restoring Premium
When the App starts with a connection available, and when you buy or restore Premium, it asks RevenueCat, Inc. (United States), the service we use to manage purchases, whether your installation has Premium.
- Data
- A random identifier created for your installation of the App, which is not linked to your name, email address or Google account; the purchase details Google Play gives the App, such as the product, the time of purchase, the price and currency and the purchase token; and the technical details that come with any internet request: App version, Android version, device model, language and region settings, and IP address.
- Purpose
- To provide Premium on your device, to restore it on other devices, and to prevent fraudulent purchases.
- Legal basis
- The performance of our contract with you (Article 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).
- Recipient
- RevenueCat, which processes this data on our behalf and on our instructions, as our processor (Article 28 GDPR). See RevenueCat’s privacy policy.
6.2 The scanner and text recognition
The document scanner, text recognition and language identification are provided by Google Play services, software from Google that is already on most Android phones. When the App first needs one of these features, Google Play services downloads it. Images and text are processed on your device and are not sent to Google.
To keep these features working, Google may collect technical information about them, such as the device model, the Android version, the App’s name and version, an identifier for the installation, and performance and error data. Google handles this information under its own terms and privacy policy.
6.3 Translation languages
When you download a language for translation, its language model is downloaded from Google’s servers, which receive the technical details of the download request, such as your IP address. Translation then runs on your device. The technical information described in section 6.2 may also be collected for this feature.
6.4 Extra text recognition languages
When you add a language for reading text in another alphabet, its language data is downloaded from the files of the open source Tesseract project, hosted on GitHub (GitHub, Inc., United States). GitHub receives the technical details of the download request, such as your IP address, under its own privacy statement.
6.5 Links you open
A web link you open from a scanned page, or a link to this policy opened from the App, opens in your web browser, under the terms of the browser and of the website you visit.
The App makes no other connections. With the device in airplane mode, everything you have already downloaded keeps working.
7. Purchases and payments
Premium is sold through Google Play. Google processes your payment as an independent controller, under its own terms and privacy policy. We do not receive your payment card details or your billing address.
Google gives us transaction records for each sale, which may include an order number, the product, the date, the price and currency, and the country, region or postal code of the purchase. We use them for accounting, tax, refunds and support. Legal basis: compliance with our legal obligations under Romanian accounting and tax law (Article 6(1)(c) GDPR) and the performance of our contract with you (Article 6(1)(b) GDPR).
8. When you write to us
If you email us, we receive your email address, your name if you include it, and your message. We use them only to answer you and deal with your request. If you write from Send feedback in the app, the email also carries a line with the app’s version, the Android version, the phone model and the app’s language, to help us look into a problem; you see that line in the email and can delete it before sending. Legal basis: steps taken at your request and our legitimate interest in answering the people who write to us (Article 6(1)(b) and (f) GDPR). Messages to contact@diomo.app are forwarded by Cloudflare and kept in our email account with Google, and our replies are sent through Resend, Inc. (United States).
9. This website
The Website sets no cookies, runs no analytics and loads nothing from third parties. It is hosted by Cloudflare, Inc., which processes the technical data needed to deliver the pages and protect them from attacks, such as IP addresses and request details, under its own privacy policy. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR). We may see the overall traffic statistics that Cloudflare shows every website owner, such as the number of requests, which do not identify individual visitors.
10. Who receives personal data
We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles. The only recipients are those described above: RevenueCat, as our processor; Google, for Google Play, Google Play services and its translation models, under its own terms; GitHub, for language data; Cloudflare, for the Website and for forwarding email; Google and Resend, for our email; and, where the law requires it, public authorities, our accountants and our legal advisers.
We do not sell or share personal information, as those terms are used in United States state privacy laws.
11. Transfers outside the European Economic Area
RevenueCat, Cloudflare, GitHub and Resend are based in the United States, and Google may process data outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for recipients certified under it, or on the standard contractual clauses approved by the European Commission.
12. How long we keep data
- Purchase records with RevenueCat: for as long as your Premium can be restored, and deleted earlier if you ask us, unless we must keep them for a legal reason.
- Google Play transaction records: for the periods required by Romanian accounting and tax law.
- Emails: for as long as needed to deal with your request and any follow up, and no longer than three years, unless the law requires otherwise.
- Website request data: for the short periods Cloudflare applies to deliver and protect the site.
13. Security
Your Content is protected by your device’s security and by Android’s separation between apps. The vault opens only with your fingerprint, face or screen lock, and the App lock can protect the whole App. Every connection the App makes is encrypted (HTTPS).
Because Your Content is on your device, its safety also depends on you: protect the device with a screen lock, keep backups, and keep backup passwords safe. No system is completely secure, and we cannot guarantee the security of devices or services we do not control.
14. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable form, and to object to processing based on our legitimate interests. We make no decisions about you based solely on automated processing.
Your Content is on your device, so you can view, change, export and delete it in the App at any time. We hold no data that names you. To exercise your rights over the data we or our processor hold, such as your purchase records, write to contact@diomo.app. Because those records are not linked to your name, please include your Google Play order number so we can find them. We may ask for information to confirm the request comes from you. We reply within one month, which the law allows us to extend by two further months for complex requests.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or where you believe the problem happened. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, dataprotection.ro.
15. Children
The App is a general productivity tool and is not directed at children. It does not ask for anyone’s age or identity, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, for example by email, write to us and we will delete it.
16. Device permissions
The App does not have access to your camera, photos, files, contacts or location. The scanner runs inside Google Play services, and files come into the App only when you pick them in Android’s file picker. The App uses these permissions:
- Notifications: to show reminders and the progress of backups. Android asks you before the App can show them, and the App works without them.
- Fingerprint and face unlock: for the App lock and the vault. Your biometric data stays with Android; the App only learns whether it matched.
- Internet and network state: for the connections in section 6, and so automatic backups can wait for Wi-Fi.
- Run at startup: to put reminders and automatic backups back on schedule after the device restarts.
- Foreground service and keep awake: so a long backup or restore can finish with the screen off, with a notification while it runs.
- Google Play billing: to buy Premium.
17. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle personal data, and in particular if the App would start collecting data it does not collect today, we will tell you in the App before the change takes effect.
18. Language
This policy is published in English and in Romanian, with the same content. If the two versions ever differ, the version in the language of your country of residence applies where the law requires it, and the English version applies otherwise.
19. Contact
Diomo Enterprise S.R.L.Strada Învingătorilor, Nr. 9-11, Et. 2, Ap. 27, București, Sector 3, Romania
CUI 45514206, Reg. Com. J40/1066/2022, VAT RO45514206
contact@diomo.app