Privacy policy

CIEscan reads identity documents in two different ways.

Over NFC the app reads the data stored on the chip and checks whether the document is genuine. That covers the Italian electronic identity card (CIE 3.0) and passports under ICAO 9303.

The Italian driving licence has no chip. It is read from a photograph, and no authenticity check is possible in that case.

What data the app processes

For the identity card and the passport, only the data held on the chip of the document presented to the phone:

• given names and surname, date of birth, place of birth, sex, nationality
• document number, dates of issue and expiry, issuing authority
• residential address and codice fiscale (Italian tax number)
• the photograph, if the full read mode is chosen

Which of these are actually present is up to the document. A passport usually carries no residential address and no codice fiscale; place of birth, issuing authority and date of issue may be absent.

The fingerprints a passport may hold on its chip are not read by the app.

For the driving licence, the details printed on the front of the card:

• given names and surname, date and place of birth
• dates of issue and expiry, issuing authority
• document number and licence categories

No photograph is taken from it.

What every read from a chip requires

The chip releases nothing until it is opened with a key printed on the document itself, either typed in or photographed off the document:

• Identity card: the CAN, the six-digit number on the front.
• Passport: passport number, date of birth and date of expiry from the data page.

Without the document in hand the app can read nothing. The key is not retained, with one exception: the CAN is stored alongside the record so the same card is recognised again. For a passport it is not, because there the key consists of personal data.

When the key is photographed

Instead of typing the key, it can be read off the document: on the identity card the six digits at the bottom right of the front, on a passport the two lines at the bottom of the data page. For this:

• The photograph is taken with the system camera app, not with a camera of this app's own. That is why CIEscan still requires no camera permission.
• The photograph goes into a cache folder of its own, which is emptied before every capture and deleted right after the evaluation. The app puts no copy in the gallery and keeps no image. What the system camera app does on its own part is outside this app's control — as with any photograph taken by hand.
• The text recognition runs on the device. The model for it is contained in the app; nothing is downloaded and nothing is transmitted. The app has no internet permission and technically cannot.
• Only the access key is taken from the recognised text. Everything else that might have been legible in the image is discarded.

Typing remains fully possible. Nobody has to photograph anything.

When the driving licence is photographed

The Italian driving licence has no chip, no machine-readable zone and no barcode. Here the photograph is not the way to a key but the source itself. The same handling as above applies to the capture: the system camera app, a cache folder of its own that is emptied before every capture and deleted right after the evaluation, text recognition on the device, no transmission.

Two differences matter:

• More than a key is taken. The fields listed above are taken from the recognised text. Everything else that might have been legible in the image is discarded.
• There is no authenticity check. Without a chip there is no way to establish whether the card is genuine. A record read this way therefore carries no seal of authenticity but an explicit caveat — in the app and in every report produced from it. The details are read off, not confirmed. A misreading is possible and does not announce itself; the fields are to be checked before saving.

Where the data stays

Data that has been read stays on the device only. It is encrypted with a key held in the Android keystore, which cannot leave the device.

30 days after being read it is deleted automatically. Before that it can be deleted in the app at any time.

No transmission

The app holds no internet permission. It is technically incapable of transmitting anything, to the developer or to anyone else. It contains no analytics, no advertising and no tracking. The authenticity check also runs entirely offline against certificates shipped inside the app; no directory and no revocation list is contacted.

When data leaves the app

Only when the user explicitly exports it, and only to the application they pick at that moment.

• Sharing, copying to the clipboard and the JSON form never contain the photograph.
• Sending the readable form by email does include the photograph: embedded in the HTML body and attached as a file. For the attachment the image is briefly written to a cache folder belonging to the app, which is emptied completely before every send.

Where such a message ends up, and what the chosen mail application does with it afterwards, is outside this app's control.

Permissions

The app requires only the NFC permission, needed to read the card. It requests no access to location, contacts, camera, microphone, storage or telephony — not even for photographing, because the system camera app does that.

Controller

Christian Auer tissax@gmx.net

Rights of the data subject

Because the data never leaves the device and is not accessible to the developer, access, correction or erasure can only be carried out by the person operating the device. Erasure happens in the app, or automatically after 30 days.

Responsibility for the lawfulness of an identity check, and for the handling of the data gathered in the course of it, rests with the organisation using the app.

Changes

This policy describes the position as of 2 September 2026 and applies from version 1.9. It will be updated if the behaviour of the app changes.