Who we are
DocIt is made by DocIt, a sole proprietorship owned by Sandeep Harikumar Nair, Mumbai, India (“we”). Contact: hello@docit.one.
This policy covers the DocIt Android app and this website.
What stays on your phone
Everything you put into DocIt is stored on your phone only:
- Documents you scan or import, and their previews (encrypted with AES-256).
- Details DocIt reads or you type: names, document types, ID numbers, dates, amounts.
- Your answers in the Cover tab and the people you add.
- Your settings, profile name and photo.
We do not receive any of this. We have no server that stores it.
What leaves your phone, and when
| When | What | Goes to |
|---|---|---|
| Always, while scanning or reading | Technical data from Google ML Kit: phone model, Android version, app version, a random install ID, timing and error codes. Never your images or text. | |
| You share a document | That document | The app or person you choose |
| You sign in with Google (optional) | Google tells DocIt your name, email and photo. They are kept on your phone. | Your phone |
| You turn on backup (optional) | Encrypted documents, an encrypted list of them, and the encryption key | Your own Google Drive |
| You tap a call or official link | Nothing from DocIt; your phone opens the dialler or the website | That service |
Backup data goes to your Google account, which you control. DocIt can only see the files it created in your Drive. Email reminders through Google Calendar are coming later; this policy will be updated before they arrive.
If we add a feature that sends documents or their contents off your phone, such as a cloud assistant, it will be optional, will say what it sends and to whom, and will only run after you agree. We will update this policy first.
Google user data
Signing in with Google is optional. DocIt works fully without it.
- What we access: when you sign in, your name, email address and profile photo (Google's basic profile). If you turn on backup, access to Google Drive limited to the files DocIt creates (the
drive.filepermission). DocIt cannot see, open or change any other file in your Drive. - How we use it: your name, email and photo are shown in the app so you know which account is connected. Drive access is used only to save your backup into a "DocIt Backup" folder in your own Drive and to restore it onto a phone you sign in on.
- How it is stored: your name, email and photo stay on your phone. The backup folder holds your documents and a list of them, both encrypted on your phone with AES-256 before upload, a small file list, and the key that unlocks them. The key is stored in your own Drive next to the encrypted files, so anyone who gets into your Google account could restore your documents. Keep that account secure with 2-step verification. We do not have a server and never receive a copy.
- Sharing: we do not share, sell or transfer Google user data to anyone, and we do not use it for advertising or to train AI or machine learning models. No person at DocIt can read it.
- Removing it: turn off backup in the You tab, delete the "DocIt Backup" folder in Google Drive, and remove DocIt's access at myaccount.google.com/permissions.
DocIt's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Permissions the app asks for
- Camera: to scan documents.
- Notifications: for reminders, if you turn them on.
- Fingerprint or face: to unlock the app, if you turn on the lock.
Photos and files are picked through Android’s own picker, so DocIt only sees the items you choose.
What we don’t do
- No ads, and no advertising or analytics code of our own.
- We don’t sell, rent or share personal data.
- We don’t build profiles about you.
This website
docit.one uses no cookies. We count page visits with Vercel Web Analytics, which sets no cookies and does not identify you; it records the page, the referring site, and your country and device type. Our hosting provider also keeps standard server logs (such as IP address and pages requested) for security, for a short time.
Your choices and rights
Because your data is on your phone, you control it directly: edit or delete any document in the app, turn off backup or reminders, or uninstall the app to remove everything stored on the phone. How to delete all your data.
You can write to us to ask about your data or make a complaint. Under data protection laws such as the EU and UK GDPR and India’s Digital Personal Data Protection Act, 2023, you have rights to information, correction, deletion and to complain. Since we hold no personal data about you on our side, most requests are answered by the steps above, and we will confirm that in writing.
If you live outside India
DocIt works the same way in every country: your documents stay on your phone, and we run no server that receives them. This section adds what the privacy laws of other countries ask us to tell you.
- Who is responsible: DocIt, a sole proprietorship owned by Sandeep Harikumar Nair, Mumbai, India. For the small amount of personal data we handle ourselves (emails you send us, and this website’s visit counts and server logs), we decide how it is used and are responsible for it (the “controller” under UK and Swiss law). Contact: hello@docit.one.
- Data protection contact: for any privacy question or request, including under Singapore’s Personal Data Protection Act, write to our data protection contact at hello@docit.one. We reply within 7 days.
- What we handle, and why: your email address and message, only to reply to you and keep a record of your request; website visit counts and server logs, to keep the site secure and see which pages are read. Where the law asks for a legal basis, we rely on our legitimate interest in answering you and running a safe website, and on your request itself. Google ML Kit diagnostics in the app are described in the table above.
- Categories (California and other US states): in the last 12 months we have handled identifiers (a random install ID through Google ML Kit, an IP address in server logs, and your email if you write to us), device information (phone model and Android version), and website activity (pages visited). We do not collect sensitive personal information about you on our side.
- No selling or sharing: we do not sell or share personal information, including for cross-context behavioural advertising, and we have not done so in the last 12 months. There is nothing to opt out of.
- How long we keep it: emails for as long as needed to deal with your request and any follow-up; server logs for a short time set by our hosting provider.
- Other countries: Google (for ML Kit, sign-in and Drive) and our website and email providers may process data in India, the United States and other countries where they operate.
- Your rights: depending on where you live, you can ask to know what we hold about you, get a copy, correct it, delete it, or object to how we use it, and you won’t be treated differently for asking. Someone you authorise can ask for you. Email hello@docit.one. We may need to confirm the request is from you, and we will answer within the time your local law sets.
- Complaints: please write to us first. You can also complain to the data protection authority where you live, for example the Information Commissioner’s Office in the UK (ico.org.uk), the Federal Data Protection and Information Commissioner in Switzerland (edoeb.admin.ch), the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Australian Information Commissioner (oaic.gov.au), the Personal Data Protection Commission in Singapore (pdpc.gov.sg), the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), or the data protection authority in the UAE, Saudi Arabia or Qatar.
Children
DocIt is for adults (18 and over) managing their own and their family’s documents, as set out in our terms. It is not meant for children, in any country, and we don’t knowingly allow anyone under 18 to use it. It is not directed to children under 13, and we don’t knowingly collect personal information from them (as the US Children’s Online Privacy Protection Act requires). If you think a child has sent us personal data, email us and we will delete it.
Changes
If this policy changes, we will update the date above and, for important changes, tell you in the app.
Contact and grievances
Email hello@docit.one. We reply within 7 days.