Your documents stay on your phone.

Nothing. There is no account to create, nothing to log in to, and no server of ours for anything to be sent to.

The app holds no permission to use the network. On Android it refuses INTERNET in its manifest, so nothing inside it can open a connection — not our code, and not a library's. On iOS it makes no network calls and links nothing that would.

That wording is careful because we got it wrong once. The text-recognition library we first used on Android brought Google's telemetry transport with it, and that transport asked for the internet permission. Nobody chose it, and this page meanwhile said the app had no network connection of any kind — which was true of what we had written and not of what we had shipped. The recognition model now travels inside the app instead, costing a few megabytes and needing nothing from anybody, and the permission is refused outright so that a library added years from now cannot quietly take it either.

A promise you can check is worth more than one you have to believe. An app that holds no network permission cannot send your documents anywhere, whatever its code intends.

Everything: the pages you photograph, the text read from them so you can search, the invoices and receipts you write, your business details and logo, your signature, and your PIN if you set one.

All of it is written into the app's own private storage on the handset and encrypted where it sits. The key is held by the phone's own keystore — the Keychain on iOS, the Android Keystore — and never leaves it.

The camera, to photograph the page you are scanning. Only while you are scanning; there is no background use.

Your photos, and only the single picture you choose through the system picker. Ngumba cannot browse your library.

Face ID or the fingerprint reader, if you turn on unlocking without a PIN. The app never receives your biometrics — the phone answers yes or no.

Sending hands the finished file to another app you choose — WhatsApp, your mail app, a printer. It does not pass through us on the way, and we never see it.

What happens to that file afterwards is governed by whichever app you handed it to, not by this policy.

Ngumba can write a backup file containing your documents, which you then keep wherever you choose. It is an ordinary zip that any computer can open, and it is not encrypted, so that a backup does not depend on this app still existing to be readable. Treat it as you would a folder of the papers themselves.

Automatic cloud backup by the operating system is switched off, deliberately, so that your documents are not copied to a cloud account without your asking.

The optional PIN keeps a borrowed or mislaid phone out of your documents. It is held in the phone's keystore alongside everything else.

It is not protection against somebody with the handset, specialist tools and time. We would rather say that plainly than let you assume otherwise.

Ngumba is a tool for running a business and is not directed at children. Since it collects nothing from anybody, it collects nothing from children either.

Rights to access, correct, export or delete personal data are rights against whoever holds it. We hold none of yours, so there is nothing for us to hand over or erase.

Your own copy is yours: export it with the backup, or remove everything by deleting the app.

If a future version of Ngumba ever sends anything anywhere — for example to share a document between your own devices — this page will say so before that version is released, and the app will ask you first.

Obiverse LLC — admin@obiverse.net