CamScanner

Is CamScanner safe?

CamScanner is safe enough for everyday scans such as receipts and notes, but think twice before you sync passports, bank statements or medical records to it. INTSIG, the Chinese company behind it, holds ISO certificates for security and privacy management and stores EU users' data in Ireland and US users' data in the US. Against that sit an ad-tracking business model, an Android version that shipped malware through an ad library in 2019, and a ban in India since 2020.

We score it 52/100, below cloud storage apps such as Google Drive (70) and Dropbox (63), which hold the same kind of files without ad tracking.

The 2019 malware

In August 2019 Kaspersky researchers looked at CamScanner after users complained in Google Play reviews. They found an advertising library carrying a Trojan dropper, which Kaspersky detects as Trojan-Dropper.AndroidOS.Necro.n. It could download and run further code from remote servers, which, Kaspersky wrote, its owners could use to show intrusive ads or sign victims up for paid subscriptions. The app had more than 100 million installs at the time, and Google removed it from the Play Store.

CamScanner blamed a third-party ad SDK, said it had no evidence that documents leaked, and said the iPhone version was not affected. It removed its ad SDKs, including those from Google and Facebook, for a time and returned to Google Play in September 2019, Xataka Android reported. Ads are back in the free app today, and the case shows why an ad-funded document scanner is a weaker choice for sensitive paperwork.

INTSIG does pay outside researchers. Its own security response centre, ISRC, lists CamScanner as a core product and rewards valid reports with points worth up to about ¥5,000 (roughly $700) for a critical flaw. The rules are published only in Chinese.

What CamScanner collects

Apple's label lists identifiers and usage data as used to track you across other companies' apps. It lists device IDs and usage for third-party advertising, and email, phone number and photos for app functions, all as "not linked to you". That is hard to square with an app where your documents and contact details sit in a named account, and with a policy that says CamScanner shares advertising IDs and a hashed email address with ad partners, including Google.

The policy, updated in July 2026, also covers device data such as IP address, carrier and Android ID, location if you allow it, and anything you type into its AI question feature, kept until you delete it. Documents you sync stay on its servers until you delete them or the account. US users can opt out of personalised ads, and others can change their cookie settings.

India's ban and the US order

On 29 June 2020 India's IT ministry blocked 59 apps, CamScanner among them, under section 69A of the Information Technology Act. Its notice cited complaints that apps were "stealing and surreptitiously transmitting users' data" to servers outside India. We found no sign that it has been lifted. Under our rules, a national ban that cites the app's data handling counts as an order, which is why regulatory record sits at 57.

In January 2021 an outgoing US executive order named CamScanner among eight Chinese apps whose transactions would be banned. It never took effect: a new order revoked it in June 2021. We treat it as context and deduct only a little for it.

Broken links and fine print

When we checked in October 2026, the privacy policy linked from CamScanner's App Store listing and the one linked from its Google Play listing both returned the error "404 Route Not Found". The current policy and terms are on open.camscanner.com, linked from the company website. A store listing that points to a dead page makes it harder for users to check what they agree to.

The terms are otherwise fairly plain. CamScanner does not claim ownership of your documents and takes a licence only as far as needed to provide the service. Subscriptions renew until you cancel, and fees are non-refundable, including unused time. In the US App Store a week of Premium costs $9.99, the same as a month, so check which plan you tap.

How to use CamScanner more safely

1. Keep identity and financial documents out of cloud sync, or use a scanner from a service you already trust.
2. Deny the tracking prompt on an iPhone, and turn off the advertising ID on Android.
3. Install only from the App Store or Google Play, and keep the app updated.
4. Delete synced documents you no longer need, since they stay until you remove them.
5. Choose the monthly or annual plan, not the weekly one at the same price as a month.

How we scored it

Scams and harmful content (68) is CamScanner's strongest factor: there are no strangers to deal with, only ads. Regulatory record (57) reflects India's ban. Security (55) balances ISO certification and a paid bug bounty against the 2019 malware, transparency and control (48) loses points for broken policy links and deletion by email, and privacy (42) is the weakest because of ad tracking and a label that understates what is linked to you.