Local Scan · last updated 8 August 2026
Everything happens on your device. Nothing is uploaded. Your photographs, the pages you make from them, and the PDF you save are only ever handled by the browser on the device in front of you.
Everything happens on your device. Nothing is uploaded. Your photographs, the pages you make from them, and the PDF you save are only ever handled by this app, on the device in front of you.
Local Scan runs entirely in your browser. There is no account, no sign-up, and no sync, and there is no back end of ours for your pages to go to. When you take a picture with your camera or choose an image from your device, that image is read into the page's own memory, processed there, and turned into whatever you save there. That includes reading the text off a page: the text recogniser is a piece of software bundled with this app that runs inside your browser, on your device.
Local Scan runs entirely on this device. There is no account, no sign-up, and no sync, and there is no back end of ours for your pages to go to. When you take a picture with your camera or choose an image from your device, that image is read into the app's own memory, processed there, and turned into whatever you save there. That includes reading the text off a page: the text recogniser is a piece of software shipped inside this app that runs on your device.
The browser version of Local Scan has no payment of any kind, so there is no payment provider involved here. Every format, the text ones included, is free in the browser. There is no usage analytics and no ad tracking.
There is one thing you can pay for: Local Scan Pro, which adds the five features that read the words off your pages. Apple handles that purchase, and a service called RevenueCat tells the app whether it has been made — see Payments below for exactly what each of them can see, which is nothing about your documents. There is no usage analytics and no ad tracking.
Local Scan is a website, so it does have to be delivered to you. The static host that serves these files sees the ordinary web-server record of that request — your IP address, your browser, and which file you asked for — for as long as it keeps its logs. That is true of every website you open, and it is the one part of this that is not ours to promise about. It never includes your documents, because your documents never leave the page.
On the web, Local Scan has to be delivered to you, and the host that serves it keeps the ordinary web-server record of that request. This app does not: every file it runs came inside the download from the App Store, so nothing has to be fetched for it to work and there is no request to us to log. The one exception is Pro, and we would rather name it here than let it look hidden: the app asks RevenueCat whether Pro has been bought, once when it starts and again when you buy or restore. That is described in full under Payments. Apple sees what Apple sees about an App Store download; we are not told who you are.
Nothing of yours. Every page here is delivered with a Content Security Policy that says which connections it may open. The app page's connect-src is limited to 'self', so it cannot open a fetch, XHR or WebSocket connection to another server; this page's is 'none', so nothing here may open a connection at all. Either way the browser refuses it. That policy is carried in each page itself, so it governs that page — it is not a claim about every part of the browser, and it does not stop you following an ordinary link.
Nothing of yours. Each of the app's screens carries a Content Security Policy that says which connections it may open. The app screen's connect-src is limited to 'self', so it cannot open a fetch, XHR or WebSocket connection to another server; the Privacy and Help screens carry 'none', so they may not open a connection at all. Either way the web engine iOS runs them in refuses it. That policy is carried in the screen itself, so it governs that screen — it is not a claim about every part of iOS, and it does not stop you following an ordinary link out to Safari.
Being exact about where that policy reaches: the Pro purchase check is the one connection this app makes, and it is made outside those screens, in the app's own native code, so the policy above is not what governs it. We are naming that rather than letting 'self' imply more than it covers. What it carries is described under Payments: a random identifier and the answer to "has Pro been bought" — no photograph, no page, no word read off one.
One part of the app deliberately runs outside that policy, and we would rather say so than let you find out. The text recogniser runs in a background worker, and a worker loaded from a web address carries whatever policy its own delivery sets rather than inheriting the page's. So for that one component the browser is not what holds the line. What holds it instead is the software itself: the recogniser's own files were edited before they were bundled here, so that no address of any other server remains anywhere in them. Where it once could have fallen back to fetching a missing piece from someone else's server, it now stops with an error instead. The rule is in the code that ships, not in a setting that could be changed by accident.
You do not have to take any of that on trust. Turn on Airplane Mode, or watch your browser's Network tab, and scan a document: everything still works, and nothing goes out.
You do not have to take any of that on trust. Turn on Airplane Mode and scan a document, text and all: everything still works, and nothing goes out. If you already own Pro, that keeps working offline too — the app remembers that the purchase was confirmed and does not need to ask again to let you in. Buying Pro is the one thing that needs a connection.
One thing does come down from the same place the page itself came from, and it is worth being precise about. The first time the text is read off a page — whether you save a format built from that text or copy the text — the app fetches its text recogniser, about 6 MB of software and one English language model, from its own address, exactly as it fetched the page. That is a download of the app's own files, not an upload of yours: your pages are never part of that request, and after it has happened once your browser keeps the files, so it works offline from then on.
The text recogniser is worth being precise about, because it is large. It is about 13 MB of software and one English language model, and in this app all of it is already on your device — it came inside the download from the App Store, and a good part of the app's size on disk is that recogniser. Nothing is fetched when you first use it, so it works with no connection from the very first scan, and your pages are never part of any request because there is no request.
The outside links on this page and in the app's own footer — the pdf-lib, Tesseract.js and JSZip project sites, Terms, and the Eden Apps site — go to ordinary websites in a new tab, if and when you click them. That is an ordinary link, and nothing about your documents travels with it.
The outside links on this screen and in the app's own footer — the pdf-lib, Tesseract.js and JSZip project sites, Terms, and the Eden Apps site — open ordinary websites outside this app, if and when you tap them. That is an ordinary link, and nothing about your documents travels with it.
Local Scan writes a small amount of data into your browser's own storage on this device:
Local Scan writes a small amount of data into this app's own storage on this device — a private area that belongs to this app alone, which no other app can read:
localscan.theme — whether you chose light, dark, or to follow your system. In local storage.localscan.v1 — your export preferences: the format you last chose, page size, quality, the file name you last used, the last look you applied, and whether you chose picture only or picture plus searchable text. In local storage.keyval-store → ./eng.traineddata — the English recognition model, about 4 MB, in a database the recogniser keeps so it does not have to download itself again. This is one of the app's own files, not anything of yours, and it only appears once the text has been read off a page — whether you saved a format built from that text or copied the text. If you look through your site data and find a few megabytes here, that is what it is.keyval-store → ./eng.traineddata — the English recognition model, about 4 MB, in a database the recogniser keeps so it does not have to unpack itself again. This is one of the app's own files, not anything of yours, and it only appears once the text has been read off a page — whether you saved a format built from that text or copied the text. If you look at what this app is using on disk and find a few extra megabytes, that is what they are.localscan.pro_seen — a date, written only after Apple's answer has confirmed that Pro was bought. It is what lets Pro keep working with no connection, and it is why a bad signal never puts the price back in front of someone who has already paid. It says nothing about you and appears only if you buy Pro.localscan.purchase_attempted and localscan.purchase_attempted_at — a yes/no flag and a date, written when a purchase is started, so that if the app is closed mid-purchase it knows to check again next time rather than losing track of something you paid for. They are cleared once the purchase is confirmed, and they expire on their own after a week if it never was.That is all that is kept. Your captures and the pages you build are never written to storage. They live in the page's memory for as long as the tab is open, and they are gone when you close or reload it — which is why Local Scan asks you to confirm before you leave with pages still open. Nothing about your documents is kept anywhere after that.
That is all that is kept. Your captures are never written to storage, and neither is the document while you are building it. They live in the app's memory for as long as the app is open, and they are gone when you close the app or iOS puts it away.
One thing is written when you save, and we would rather say so. The finished file — the PDF, Word, text, Markdown, image or zip you asked for — is written into this app's own cache area first, because that is how iOS hands a file to the share sheet. Once the sheet has finished with it, the app removes that copy, whether you sent the file somewhere or closed the sheet without choosing. If one is ever left behind — iOS puts the app away mid-share, say — the app looks for stragglers of its own kind the next time it starts and clears those too. While it is there it is the file you chose to make, in a private area no other app can read, and it is the only thing of yours this app writes down.
Clearing your browser's site data for Local Scan removes the entries above. Since your documents were never stored in the first place, there was never anything of yours to lose.
Deleting the app removes the entries above along with it, including any cached copy of a file you saved, and iOS deletes this app's storage with the app. Since your captures were never stored in the first place, there was never anything of yours to lose.
If you choose to use the camera, your browser asks your permission first, and Local Scan only ever sees the frames while the camera is on. Turning the camera off, or closing the tab, stops the camera immediately. Frames are captured to the page's memory and go nowhere else. Local Scan never requests a microphone.
If you choose to use the camera, iOS asks your permission first, and you can withdraw it at any time in Settings › Local Scan › Camera. Local Scan only ever sees the frames while the camera is on. Turning the camera off, or leaving the app, stops the camera immediately. Frames are captured to the app's memory and go nowhere else. Local Scan never requests a microphone, and never asks for your whole photo library — only the pictures you choose yourself when you import, and only those.
Local Scan installs a service worker so it keeps working with no internet connection at all. That service worker only ever caches Local Scan's own files — the page, its styles, its scripts, and the bundled libraries, including the text recogniser once you have used it. It never touches your documents.
Scanning needs no connection at any point. Every file the app runs — the screens, the styles, the scripts, the bundled libraries and the whole text recogniser — is already on your device, installed with the app. Nothing has to be downloaded, so there is no offline cache of app files to build. The one thing the recogniser keeps is the recognition model named above. Buying or restoring Pro is the one part that needs to be online, and once Pro is confirmed it works offline like everything else.
There is nothing to buy in the browser — every format here is free, the text ones included. Pro exists in the iPhone and iPad app, where it is sold through Apple's In-App Purchase: a one-time $12.99 purchase, not a subscription. No purchase happens on this site, so no payment provider is involved in what you are reading now. The rest of this section describes what happens in the app.
Local Scan Pro is a one-time $12.99 purchase — not a subscription. You pay once and you are not charged again. The App Store shows the price in your own currency, and the exact amount, before you confirm anything.
Apple handles the payment. It goes through the App Store, with the Apple Account you already use. We never see, handle or store your card, and we are never told your name or your email address. What comes back to us from Apple is a sales total — how many, not who.
What RevenueCat sees. RevenueCat is the service that answers one question for the app: has Pro been bought here? To do that it holds a random identifier it generated for this installation. That identifier is not your Apple Account, not your name, and not tied to anything you scan — your photographs, the pages you build and every word read off them stay on your device and are never part of that exchange. It is never used for marketing, never sold, and never shared. RevenueCat's own handling is set out in its Privacy Policy.
Getting Pro back. The purchase belongs to your Apple Account, so it returns on any device signed in with it — choose one of the text formats and tap Restore purchases. There is no code to keep, nothing to type, and no account of ours to sign in to.
Refunds are Apple's. Everything bought through the App Store is refunded by Apple rather than by us, Pro included. Ask at reportaproblem.apple.com, signed in with the Apple Account that made the purchase.
Local Scan uses three open-source libraries: pdf-lib to assemble a PDF, Tesseract.js to read the text off a page, and JSZip to assemble a Word document. All three are bundled into this app and served from the same place as everything else, and every file each of them loads comes from this app's own address. Tesseract.js normally knows how to fetch its own missing pieces from a public CDN; that ability was edited out of the copy bundled here, so no other server's address remains in it and it can no longer reach for one. Neither of the other two contacts any server at all. Their licences are reproduced in THIRD-PARTY-LICENSES.txt.
Local Scan itself collects nothing from anyone, of any age. There is no account to make, nothing to fill in, and no way for the app to learn anything about who is using it.
If this policy changes, the date at the top changes with it. If a future version of Local Scan ever adds something that does use the network, that will be described here plainly and before it ships.
Questions are welcome at support@edenapps.app.