Privacy Policy for Proofara Receive

Publication route: https://www.schukai.com/en/privacy/proofara
Updated: 1 November 2026
App: Proofara Receive
Android package ID: com.schukai.proofara

1. Scope

This privacy policy describes processing of personal data by the Android app Proofara Receive, optional end-to-end encrypted Proofara Sync, deliberately submitted support reports, optional Google Play purchase verification and the optional Nucleus connection.

Proofara Receive documents business goods receipts and discrepancies such as damage, shortages or incorrect deliveries. The app can be used on a single device without a Proofara account or Proofara Sync.

2. Controller and privacy contact

schukai
Eichenstraße 26
82290 Landsberied
Germany

Send privacy inquiries to hey@schukai.com. Full provider details are in the imprint.

An organization using Proofara Receive for goods receiving is normally the controller for the business and personal data it enters. This includes employee data and information about suppliers, carriers and their contacts. Where schukai processes data on the organization's behalf for a purchased Sync service, the contractual privacy documents and a data processing agreement concluded before that processing apply.

3. Data processed locally

Depending on use, the app processes locally:

organization, location, employee and role data;
delivery, transport, package and product references;
supplier, carrier and contact details;
photographs of deliveries, packaging, labels and documents;
discrepancies, free text, decisions and confirmations;
timestamps, audit events and technical states;
completion and driver acknowledgements, including signatures.

These data reside in private app storage. Original media and business data are stored encrypted. The optional device PIN protects access to the local session. Android system backup and automatic device transfer are disabled for Proofara Receive.

The organization determines the purposes, scope, legal basis and retention of its operational records. Employees receive the relevant information from their organization.

4. Camera, files and exports

The camera is used only after an Android permission request. Photographs are taken only when a capture is initiated. Existing images and recovery files can be imported using the Android file picker.

Reports, evidence packages and encrypted recovery files are exported only after a deliberate action. The person using the device chooses the destination app or storage location. Outside protected app storage, further processing follows the rules of the chosen recipient or service.

4a. Explicitly confirmed delivery through an organization connector

Where an organization connector is configured, authorized users can expressly confirm a delivery. The app shows the recipient, subject, selected content and delivery server. The job contains the message and, if selected deliberately, one PDF; original photographs are not added automatically. The job is encrypted for the intended connector and transmitted over HTTPS. The connector can decrypt the addressed contents and pass them to the configured mail service or designated status endpoint. The organization determines recipients and service providers; their rules govern further storage and processing. This is not Team synchronization that prevents the recipient from reading the contents.

The local outbox and customer-side queue retain retry and status records. Technical acceptance proves neither delivery to the recipient nor business acceptance of goods. A missing or interrupted delivery does not silently switch to a different recipient. The organization governs retention and erasure of connector, mail and status data.

5. Barcode and text recognition with Google ML Kit

Proofara Receive uses Google ML Kit for barcode and text recognition. According to the ML Kit privacy information, images, text and recognition results are processed on the device and are not sent to Google servers.

However, ML Kit libraries send technical metrics about API performance and use to Google. The ML Kit data disclosure lists the following:

manufacturer, model, operating system, build and available ML hardware accelerators;
package name and app version;
for the bundled features used in Proofara, a per-installation identifier not intended to uniquely identify a person or physical device;
performance metrics such as latency;
API configuration such as image format and resolution;
input and output sizes without their contents;
feature and SDK versions, event types and error codes.

Google identifies diagnostics, measurement, maintenance and improvement of the APIs and detection of misuse as purposes. Google states that transmission uses HTTPS encryption. Proofara does not receive these ML Kit metrics and does not use them for its own product analytics or advertising.

The recipient is Google. For people in the European Economic Area, Google generally identifies Google Ireland Limited as the responsible company. Google may process data outside the EEA. See the Google Privacy Policy and Google's international data transfer information.

schukai relies on Article 6(1)(f) GDPR for incorporating technical ML Kit metrics. The legitimate interest is effective, maintainable on-device recognition protected against abuse. The balancing assessment takes account in particular of the technical scope, the absence of recognition-content transmission and the availability of manual entry.

6. Optional end-to-end encrypted Sync

Without activation, local operation sends no cases to a Proofara service. This statement concerns Proofara services; the ML Kit metrics in section 5 are separate.

After deliberate activation, an organization can configure managed Sync. Business content, original media, names, references, free text and signatures are end-to-end encrypted on the device before transmission. The Proofara Relay and outer transport do not hold decryption keys for those contents.

For technical operation, the Relay processes pseudonymous organization, device, stream and event identifiers, technical timestamps, object sizes, ciphertext hashes, signature-verification data and access and quota information. These metadata are necessary for device access, synchronization, integrity checks and operation. Transmission is encrypted.

6a. Google Play Billing and local unlocking

In local and Team modes, the app uses Google Play Billing to query offers and existing purchases. Confirmed purchases are checked again at startup and when returning to the app. This Billing client does not start in Nucleus mode. Google processes payment under its own terms. Proofara receives no credit-card or bank details.

For purchase verification, the app sends the Play purchase token, product identifier, random organization and device identifiers, public device signing key and signed device proof over HTTPS to a separate entitlement service. During purchase, Google receives a pseudonymous account identifier derived from the random organization identifier. The service verifies the purchase with Google and acknowledges it; pending payments do not unlock access.

The purchase token is stored encrypted on the server. A token digest prevents conflicting associations. Licence association and verification status remain separate from evidence files. Processing serves contract performance, restoration and abuse prevention on the legal bases in section 8. Confirmed local unlocking can be used offline. A refund or revocation is reflected after a successful new online check. Uninstalling does not automatically erase the server-side purchase association; use the privacy contact for inquiries.

6a.1. Team subscriptions and durable purchase association

For an expressly initiated Team purchase, the app additionally supplies Google with a pseudonymous profile identifier derived from the purchase intent. Verification processes the plan, base plan, term, payment and subscription status, organization and device association and purchase and notification identifiers. Names, goods receipts, photographs and signatures do not become part of Google purchase verification.

The separate entitlement service retains purchase tokens encrypted so it can verify renewal, restoration and revocation even without the purchasing device being open. A durable token-digest association prevents conflicting use for a different organization. These data remain separate from evidence files. Cancelling in Google Play stops automatic renewal but erases neither local cases nor server-side purchase associations. Request access to or erasure of these associations through hey@schukai.com; a valid request is distinct from cancelling a subscription. Statutorily required records and residual data necessary for abuse prevention are retained only for those purposes.

6b. Optional Nucleus connection

Before connecting, the Android app shows the Nucleus recipient and storage location. A QR code, comparison code and confirmation in the Nucleus browser establish a locally protected personal session for the active tenant. A signed, device-bound capture authorization remains valid for seven days after online confirmation. A network outage does not change the recipient.

Reports, original photographs, separate annotations, versioned manifests and the documented goods-receipt data are transmitted over HTTPS to the confirmed Nucleus storage. Nucleus receives readable contents, which may include names, notes, delivery details, signatures and optional location information. Authorized Nucleus users can read them. This mode creates no additional copy in the Proofara Team Relay.

The organization is responsible for purposes, permissions, retention and erasure of these records under its Nucleus operational and privacy agreements. Disconnecting removes local access but retains files and outstanding transfers for their original recipient. It does not erase records already stored in Nucleus.

Proofara Receive does not send support reports automatically. Transmission begins only after a person enters a short-lived support code, checks the preview and expressly consents to the one-time transmission.

The report contains the entered support message and the app, operating-system, device, language, network and pseudonymous operational categories shown in the preview. Structured technical fields contain no cases, delivery references, names, photographs, signatures, keys, tokens, IP addresses or file paths. However, the free-text message can contain information entered by the user. Please enter no real secrets or unnecessary personal or case data. Independently of report contents, establishing an HTTPS connection technically exposes the IP address.

The report is encrypted on the device for the support service. It is erased within 14 days. The person using the device can erase it earlier with the deletion secret displayed only locally. The legal basis is Article 6(1)(a) GDPR where transmission relies on consent; otherwise, within the organizational relationship, Article 6(1)(b) or (f) GDPR applies. Consent can be withdrawn with future effect.

8. Purposes and recipients

schukai processes readable technical data only as necessary for unlocking, Sync operation, access protection, quotas, support, security and troubleshooting. Depending on the operational and contractual relationship, the legal bases are Article 6(1)(b) and (f) GDPR. The legitimate interest is secure and accountable operation of the offered features.

Recipients may include hosting and infrastructure providers engaged under contract. They receive only data necessary for their tasks. Business contents in Proofara Team Sync remain end-to-end encrypted. This is not a promise for contents deliberately disclosed in readable form to Nucleus, export recipients or the intended connector. Section 5 describes Google ML Kit separately; section 4 covers deliberately chosen export recipients.

9. Storage, erasure and recovery

Local data remain on the device until removed in the app, app data are cleared through Android or the app is uninstalled. Uninstalling does not erase previously exported files. Because Android system backup and automatic device transfer are disabled, the organization must securely retain its encrypted recovery packages and test restoration itself.

Retention of synchronized cases follows the organization's settings, agreements and statutory duties. A legal hold can prevent erasure. Technical operational data are stored only as long as necessary for their purposes, contractual or statutory duties. The specific support-report period is in section 7.

10. Rights and complaints

Subject to statutory conditions, rights include access, rectification, erasure, restriction of processing, portability and objection. Consent can be withdrawn at any time with future effect. You may also complain to a data protection supervisory authority.

During local operation, schukai receives no business contents and cannot associate them with a person or provide them. This statement applies to local operation; when Nucleus storage is deliberately selected, section 6b and the organization's permissions apply. Requests about operational case data should therefore first be directed to the organization. Questions about Proofara services and ML Kit disclosures can be sent to the privacy contact above.

11. Changes

This policy is updated before new data flows enter production. These include new analytics, diagnostic, push or advertising SDKs, additional permissions, server-readable business contents, user accounts or additional synchronization services. The date at the top identifies the published version.