Offline by design: how ScanCrypt keeps documents off the cloud

Most document scanners are cloud apps wearing a camera button. The photo you take of a contract is uploaded, processed on someone else’s servers, stored under someone else’s retention policy, and rented back to you as a subscription. ScanCrypt was built as the opposite bet: every document tool runs on the phone, and the simplest proof is what I call the airplane-mode test — switch the network off, and scanning, OCR, editing and encryption all work exactly the same.

What “on-device” actually requires

Saying “offline-first” is marketing; building it is an architecture constraint that touches every feature decision:

• OCR on the phone. Text recognition uses on-device models rather than a cloud vision API. That costs accuracy headroom on exotic scripts, and it is worth it: the contract you scanned never exists anywhere but your storage.
• Rendering and editing in native code. The PDF engine — page composition, annotation flattening, form filling, compression — is local. Server-side conversion would be easier to maintain and is exactly the data leak the app exists to avoid.
• Encryption as a default, not a feature flag. AES password protection, a biometric-locked vault, permanent redaction. If the device is lost, the vault is noise without the key.

The part most apps hide

Honesty cuts both ways, so the Play listing spells out what the free tier does send: AdMob ads (with the advertising ID), Firebase crash reports and optional anonymous analytics, and Remote Config for feature flags. That is the complete list — and none of it ever includes document content. Analytics can be switched off in Settings. Writing that list down publicly is uncomfortable, which is roughly why it is worth doing: a privacy claim you can’t falsify is just a slogan.

What this costs, honestly

On-device processing means heavier APK size, more careful memory management on older phones, and no “we fixed the model server-side overnight” escape hatch. Every improvement ships as an app update. For a document tool, that trade is correct: the cloud’s convenience accrues mostly to the vendor, while the risk accrues entirely to you.