Your documents are saved on your phone
DocIt has no account system and no server that stores documents. When you scan or import a document, it is saved inside the app’s private storage on your phone. We never receive a copy, so we can’t read it, lose it or hand it to anyone.
Every file is encrypted
Each document, and the small preview DocIt makes of it, is encrypted with AES-256-GCM before it is written to storage. The encryption key is created on your phone the first time you use DocIt and is kept in Android’s secure keystore, not in the app’s files.
When you open a document, DocIt decrypts it in memory to show it. Temporary plain copies, made while scanning, importing or sharing, are deleted after the save and every time the app starts.
Lock the app
You can lock DocIt with your fingerprint, face or phone PIN. Someone holding your unlocked phone still has to get past the lock to open your documents.
Reading happens on the phone
Scanning uses Google’s document scanner, and reading uses Google’s on-device text recognition (ML Kit). Both run on your phone. The text of your documents is not uploaded to read it.
ML Kit does send Google some technical information to help Google improve it: your phone model, Android version, the app’s version, a random install ID, how long a scan took and any error codes. It does not send your images or the text in them. Google explains this here.
Optional: backup to your own Google Drive
If you sign in with Google and turn on backup, DocIt copies your already-encrypted files into a “DocIt Backup” folder in your Google Drive. It also saves an encrypted copy of your document list and the encryption key there, so a new phone signed in to the same Google account can restore everything.
This means anyone who gets into your Google account could restore your documents. Protect that account with 2-step verification. DocIt can only see the files it created in your Drive, nothing else.
Coming later: email reminders through your calendar
Email reminders through your own Google Calendar are coming later. Today DocIt reminds you with notifications on your phone, 30, 7 and 1 day before a date, with no sign-in needed.
What DocIt doesn’t do yet
- Document details you see in lists (names, types, ID numbers, dates) are kept in the app’s private database. Android keeps other apps out of it, but DocIt doesn’t add its own encryption to it yet. The documents themselves are always encrypted.
- If your phone is unlocked and DocIt has no app lock, anyone holding it can open DocIt. Turn on the app lock.
We say “encrypted on this phone”, never “military grade” or “end-to-end”, because that is what DocIt does.
Found a problem?
Write to hello@docit.one. Security reports get a reply within two working days.
Related guides: Where to keep your important documents on your phone · How DocIt compares with Google Drive, Adobe Scan and Files by Google on privacy