| Field | Value |
| Date | October 28, 2026 |
| Prepared for | Charles Cagliostro, President & CEO |
| Product | IDVisor Go. Free iOS and Android age-verification app for the United States. Scans PDF417 barcodes and verifies age offline, keeping the most recent 1,000 scans in an encrypted database on the device, or every scan for IDVisor Go Pro and Max subscribers. Optional camera capture. Paid subscriptions add Fake ID Detection (BCD Lite, BCD+ and DMV Checks), mobile driver’s licence reading, and IDVisor Sync. |
| Built from | IDVisor Go — Payments, Tiers & Signup v1.5, and your answers of 16 September 2026. The assumptions this policy rests on are listed in IDVisor Go — Assumptions and Open Questions, 21 September 2026. |
| Companion documents | TokenWorks Policy and Website Change Plan (item N7 is this document). TokenWorks Mobile App Policy — Answers Needed. |
| Status | Draft. Part 1 lists what is settled and what still blocks publication. Part 3 requires counsel review. |
Part 1 records the decisions the tiers document settles and the ones still open. Part 2 maps the architecture to the two stores’ disclosure rules. Part 3 is the draft policy. Parts 4 and 5 are the declaration sheets. Part 6 covers how subscriptions are sold and the claims the policy must not contradict. Part 7 is the remaining store requirements.
| Question | Answer, from the tiers document or your decision |
| Free tier accounts | No sign-in. The free tier is fully anonymous. Nothing identifying the user leaves the phone. |
| Free tier retention | The most recent 1,000 scans, encrypted on the device, oldest deleted automatically first in first out. Scans are unlimited; storage is the limit. There is no time-based expiry and no trial end date. |
| Storefront | United States only. If the app is ever launched outside the US, the in-app subscribe prompts have to be removed. |
| Where subscriptions are bought | The UMS customer portal at idscanner.com, billed through Zoho Subscriptions. Not App Store or Google Play. Cancellation is in the same place, and there is no cancel flow in the app. |
| Apple route | In-app Subscribe prompts that link out to the UMS portal, relying on the post-Epic United States relaxation in guideline 3.1.1(a), with the companion-app exemption in 3.1.3(f) as the underlying position. |
| Sync retention | Set by the customer, the same as existing IDVisor Sync: 1 to 16 days, 365 days, or the storage limit of the plan. |
| Who can buy | Anyone. The app is freemium and self-service, with a rep involved only above roughly 10 devices or where hardware is involved. |
| Free app and the cloud | The free app never contacts the cloud and does not download or import a banned list. The tiers table says otherwise and needs correcting. |
| Export | The app does not allow data to be downloaded or exported from it at all. |
| Document number | Converted into a one-way hashed string on the way to Sync. The number itself is never held; the hash is what lets the same document be recognised on a later visit. |
| Tagged people | A tagged person stays in Sync for as long as the account owner wants, with an optional expiry date. The owner removes entries, and everything is deleted when the account is cancelled. |
| Entitlement | The app learns a subscription is active from a sign-in to the UMS account. No licence key and no activation code, which is the pattern Apple permits. |
| DMVCheck billing | A count of checks for billing. It does not hold the name of the person checked or the document number. |
| mDL | Reads the same fields as a PDF417 barcode plus the portrait photo. Nothing leaves the phone beyond the handshake with the cardholder’s phone, and no verification service is contacted. Stored on the device under the same storage limit as other scans. |
| Trust Center | The Vanta page at app.vanta.com/tokenworks.com/trust/9rbdkw467i5l72iptbkwo. |
| Apple submission | Submitting to review as built, without putting the companion-app question to Apple first. The fallback if review objects is decided then rather than now. |
| Age rating | 17+ on the App Store and Mature on Google Play. |
| Account deletion | A subscriber can delete the data in Sync at any time. Sync data is deleted 30 days after the subscriber’s last subscription that includes Sync ends (IDVisor Go Pro, IDVisor Go Max or IDVisor Sync). Ending any other subscription deletes nothing. The account stays open with its details so it is ready if the subscriber returns, unless the subscriber asks for it to be deleted. |
The affirmative defence claim and the retention setting
The tiers document sells cloud storage on the basis that it “backs up every scan permanently” and gives the business “documented proof you checked ID if the business is ever accused of serving a minor.” You have confirmed that Sync retention is customer-configurable at 1 to 16 days, 365 days, or the plan storage limit.
A customer who sets 7 days does not have an affirmative defence record beyond 7 days. The sales claim and the product behaviour only line up at the longest setting. This matters in two places: the marketing copy promises something the configuration can switch off, and the privacy policy cannot state a retention period that contradicts either.
What to settle Decide whether Sync for IDVisor Go ships with a longer default or a minimum retention floor where the affirmative-defence claim is made, or soften the claim to say that retention is the customer’s choice and the defence depends on keeping records long enough. The policy in Part 3 currently states retention as the customer’s choice, which is accurate but does not support the marketing line as written.
The free tier and the banned list, now resolved
The tiers table describes free-tier local storage as holding the banned list downloaded from the cloud, while the same table gives the free tier no cloud storage. You have confirmed the free app never contacts the cloud and does not download or import a banned list. The free tier is therefore genuinely offline and anonymous, which is what Part 2 and the Apple declaration rest on. Correct that line in the tiers document so the two do not disagree in front of a reviewer.
Appendix B assumes a sign-in that does not exist on the free tier
Appendix B argues that native checkout has little friction advantage because “the user has already signed in via Entra to use the app, so we hold email and a basic profile no matter which payment path we use.” On the free tier there is no sign-in and no profile. The billing conclusion still holds on its own merits, but that particular supporting sentence is wrong and should be corrected before the document is circulated further.
| Item | What is needed |
| Subscriber account deletion address | The behaviour is settled. What Google Play still needs is the web address where a subscriber makes the request, reachable without the app installed, and a route that closes the account itself and not only its contents, because an empty account still holds a name and an email address. Confirm the UMS portal already does both and give the address. |
| Diagnostics on the stateless endpoint | You may want diagnostic data to improve the service. Diagnostics that record timing, status codes and error counts are fine and do not affect the disclosure. Diagnostics that record the request or response body end the no-retention claim and change both declarations. Make it a deliberate configuration rather than a default. |
| What the DMVCheck billing record holds | Settled. The billing record is a count of checks. It does not identify the person checked and does not hold the document number. |
| Location capture | Settled. The app captures no GPS or IP location. iOS asks for no location permission. On Android the app asks for location permission during mobile driver’s licence reads, because Android requires it for the Bluetooth connection; the OneProof SDK makes the request and the app does not collect location. Section 6 of the policy says so. |
| mDL portrait in Sync | The portrait photograph read from a mobile driver’s licence stays on the device today. Confirm whether it goes to Sync with the rest of the record, because a face image held in the cloud is a different disclosure from one held on a phone. |
| Camera scope | The capture feature photographs the document front, the cardholder, a vehicle, or anything else the user chooses. Constrain it in the interface to named subjects before writing the permission purpose string. Storing a photograph is not biometric collection under the Illinois statute, which excludes photographs; deriving face geometry from one is, and that obligation attaches at collection rather than transmission. Counsel to confirm before any face-matching feature ships. |
| Analytics and crash libraries | The full list for both builds, and what each transmits. This decides whether the free tier can be declared as collecting nothing. Nothing else in the declarations turns on a single fact this much. |
| The stateless endpoint retains nothing | Confirmation that request and response body logging is off at every tier, that Application Insights payload capture is off, that no cache or durable retry holds the request, and what the per-scan billing counter records. Section 5 of the policy states this as fact. |
| Reports portal | Confirm what the reports portal computes. Retention of a tagged person is settled: it is the account owner’s choice, with an optional expiry date, and everything goes when the account is cancelled. |
The free tier of IDVisor Go sits entirely inside those exclusions, provided item 1.3 on libraries comes back clean and the free-tier banned list in item 1.2 is confirmed as local. No account, no sign-in, no transmission, 1,000 scans held encrypted on the device.
Section 4.1 of the Policy and Website Change Plan records the underlying system architecture, including the two Barcode Detective services and the route DMVCheck takes through Acupixel to the AAMVA DLDV service. IDVisor Go uses the stateless fake ID check only. The stateful service at idsentry.com is a configuration option on AgeVisor, IDVisor Smart and IDentiFake and is not reachable from the app.
| State | What leaves the device | Apple | Google Play |
| Demo Mode, free | Nothing. Age verification and the 1,000-scan encrypted store are entirely on the phone. No account exists. | Not collected. Nothing to disclose for this state. | Not collected and not shared. |
| Fake ID Detection — BCD Lite and BCD+ | The barcode goes to the stateless IDSentry2 service on TokenWorks’ own Azure account, is evaluated in memory, returns good, bad or unrecognized, and is not retained. No third party is involved: TokenWorks licenses the rules from ID Sentry, Inc. and the component makes no callbacks. | Ephemeral. Not collected, subject to the logging confirmation in item 1.3. | Ephemeral. Not collected and not shared, subject to the same confirmation. |
| Fake ID Detection — DMV Checks | Identification fields go to Acupixel, which queries the AAMVA DLDV service and returns field-by-field validity. Neither retains the data. TokenWorks keeps a count of checks for billing, which does not identify the person checked. | The lookup is ephemeral. The billing count holds no data about the person checked. | Declare the billing record. Answer the sharing question yes for the Acupixel leg. |
| mDL reading | Nothing beyond the handshake with the cardholder’s phone. The app reads the same fields as a barcode plus the portrait photograph, contacts no verification service, and stores the result on the device under the same storage limit as other scans. | Not collected, on the same basis as the free tier. Confirm whether the portrait goes to Sync. | Not collected and not shared, subject to the same confirmation. |
| IDVisor Sync | Scan records, captured images, banned-list entries and visit history go to a per-customer encrypted database on Azure operated by TokenWorks. Retention is the customer’s setting. The reports portal computes male and female ratio, postcode and visitor-velocity reports from this data. | Collected. Not shared, because TokenWorks is the developer. | Collected, not shared. Mark optional. |
Both declarations describe the app, not the tier. A free user’s data never leaves the phone, but IDVisor Go as published is capable of the collection in the Sync state, and that is what gets declared. The app cannot carry Apple’s “Data Not Collected” label while Sync and subscriber accounts exist inside it.
Apple provides an exception for optional data, and it does not fit. It requires that the collection be infrequent, that it not be part of the primary functionality, and that the user affirmatively choose to provide the data on each occasion. Sync runs on every scan and is enabled once as a setting. What narrows the declaration is the ephemeral rule, not that exception, which is why the logging confirmation matters: it is the difference between declaring the full contents of a scanned licence and declaring only what a customer deliberately sends to Sync.
Google’s form has a required-or-optional field for each data type, so the Play listing can show that the collection happens only for subscribers. Apple’s label has no equivalent. The mitigation on Apple is to keep the purposes narrow, mark the data as not used for tracking, and let the policy carry the explanation.
Draft for counsel review. Written to satisfy the App Store requirement that a policy identify what is collected and how, confirm that third parties provide equal protection, and state retention and deletion practices and how a user withdraws consent. Bracketed items still need filling. Revised 28 October 2026 to match the IDVisor Go Product Addendum v4 and the development team’s answers of 15, 16 and 22 October 2026. Parts 1, 2, 6 and 7 are working notes and have been corrected only where they conflicted with the policy.
Last Updated: [DATE]
This policy covers IDVisor Go, the TokenWorks age-verification app for iPhone, iPad and Android. Our general privacy practices, including our websites and our business relationships, are described in the TokenWorks Privacy Policy at tokenworks.com/privacy-policy/. Where we act as a processor for a business client, our obligations are set out in our Data Processing Addendum.
The free app sends no scan data and no personal information anywhere. It reads the barcode on an identification document, works out whether the person is old enough, and writes the result to your own device. It needs no account and no sign-in. It keeps your most recent 1,000 scans and deletes the oldest automatically as new ones arrive. With an IDVisor Go Pro or Max plan there is no limit on the number of scans kept. We do not receive that data, we cannot read it, and we cannot delete it for you. Section 8 describes the two technical requests the free app does make.
Paid subscriptions change this, and only for the features you turn on. Fake ID Detection sends the barcode to a checking service. DMV Checks compare the document against state records. IDVisor Sync stores your scans in a cloud database that we operate for you. Each is described below.
The app is used in two ways, and the difference matters for your rights.
If your identification document was scanned by someone using IDVisor Go and you want to know what happened to that data, contact the business or person who scanned it. They hold it. In the free app we never received it, so we cannot look it up, produce it, or delete it. Where we do hold data for a business client through Sync, we will assist that client in responding to you.
When you scan an identification document, the app reads the PDF417 barcode and stores the fields it contains. Depending on the document, those fields may include name, address, date of birth, document number, expiration date, issuing jurisdiction, height, weight, eye colour and similar attributes printed on the document.
If you use the camera feature, the app also stores the images you capture. These may include the front of the document, the cardholder, a vehicle, or other subjects you choose to photograph. You are responsible for what you photograph and for having the right to do so.
The app also keeps a count of how many times the same document has been scanned, so the person at the door can see whether someone is a repeat visitor, and a local list of people the business has chosen to flag.
Scan records are written to a database on the device that the app encrypts. Photographs, including the portrait read from a mobile driver’s licence, are stored as image files in the app’s private storage. The app does not encrypt the image files itself; the device’s operating system encrypts them and keeps other apps from reading them. The app never saves anything to your photo library. On Android, the app’s data is excluded from device backups. None of this is transmitted to TokenWorks unless you turn on one of the subscriptions described in Section 6.
On the free app, IDVisor Go keeps your most recent 1,000 scans. Scanning is unlimited; storage is what is limited. Once the app is holding 1,000 scans, each new scan deletes the oldest one. With an IDVisor Go Pro or Max plan, the app sets no limit on the number of scans kept on your device. By default nothing expires by date, but you can set the app to delete records older than a period you choose, from one week to one year.
Because older scans roll off, anything that depends on history becomes unreliable over time on the free app. The repeat-visit count only reflects visits still held on the device, and a flagged person drops off the local list once their scan ages out. A paid Sync subscription is what makes that history reliable.
You can delete records older than a chosen period, or delete all records at once, from the Data Settings screen. Deleting records in the app removes them, with their photos, tags and statistics, from your device only; if you use Sync, the copy in Sync is not affected. The app does not let you download or export the data it holds. Uninstalling the app deletes its database and every record in it, and that cannot be reversed.
Age verification and local storage work with no network connection. Where you have a Sync subscription and the connection drops, the app holds new scans on the device and sends them when the connection returns. Fake ID Detection, DMV Checks and Sync all need a working connection at the time of the scan.
None of these is on by default. Each is bought at idscanner.com, not inside the app, and each can be cancelled in the same place.
Fake ID Detection.
When enabled, the app sends the scanned barcode, together with an identifier for your device, to a checking service that TokenWorks operates on its own Microsoft Azure account in the United States. The service examines how the barcode is formatted and which fields it contains in order to identify likely forgeries. It holds the data in memory only for as long as the check takes, returns a result of good, bad or unrecognized, and stores nothing. We do not keep the scanned data and cannot retrieve it afterwards. The detection rules are licensed from ID Sentry, Inc., but ID Sentry does not receive your data and the service makes no connection to them. The subscription comes in two levels, which differ in how much of the document the check examines and how many forgeries it detects.
DMV Checks are included with this subscription. When one runs, identification fields are sent through Acupixel to the AAMVA Driver License Data Verification service, which compares them against records held by the issuing jurisdiction and returns only whether each field matches. Neither Acupixel nor AAMVA retains the data. We record how many checks you have used so that we can bill you for them. That record does not include the name of the person checked or the document number.
Before DMV Checks will run, you must check a box in the app confirming that you have the permission you need from the people whose documents you scan. We record that confirmation, with its date and time, against your account, and the app does not ask again on each use. If you are a business, your agreement with us requires you to give those people notice.
Mobile driver’s licence reading.
A mobile driver’s licence is read directly from the cardholder’s own phone. The app reads the same fields it would read from a printed document’s barcode, together with the portrait photograph held on the licence. Nothing is sent to us or to anyone else in order to read it; the only communication is the direct exchange between the two phones. No verification service is contacted. The result is stored on your device in the same encrypted database and under the same storage limit as any other scan. On Android, the read uses a Bluetooth connection, and Android requires the app to ask for location permission before it can use Bluetooth. The app uses that permission only for the Bluetooth connection and does not collect or record your location.
IDVisor Sync.
When enabled, the app sends scan records, any images you captured, the portrait read from a mobile driver’s licence, your flagged-person list and your visit history to a database that we operate on Microsoft Azure in the United States. Customers share one database, and each customer’s records are kept separate from every other customer’s. The database is encrypted at rest and the data is encrypted in transit. The document number is converted into a one-way hashed string before it is stored, so the number itself is not stored as text. The hash is what lets the app recognise the same document on a later visit, which is how the repeat-visit count and the flagged-person list work. A photograph of a document, if one was taken, shows the document number and the portrait printed on it.
You choose how long Sync keeps your data, from the retention settings available in your plan. We keep it for the period you set and no longer, except where the law requires otherwise. If you are relying on these records to show that you checked identification, choose a retention period long enough to cover the period you need. Your Sync data is deleted 30 days after your last subscription that includes Sync ends, including when a renewal payment fails. The subscriptions that include Sync are IDVisor Go Pro, IDVisor Go Max and IDVisor Sync. While any one of them is active, your Sync data is kept.
Sync also gives you a reports portal. The reports are calculated from your own scan records and cover the ratio of male to female visitors, the postcodes visitors come from, and how visitor numbers change over time. The reports are yours; we do not use them for our own purposes and we do not combine your data with any other customer’s.
The app lets a business flag a person so that staff are warned if the same document is presented again. With a Sync subscription that list is shared across every device on the account and kept until the business removes the entry. The app also warns staff when the same document is presented twice in quick succession by different people.
A business decides who goes on its list and for how long. We do not create these lists, we do not share them between customers, and we do not use them for any purpose of our own. If you believe you have been flagged and want to know why or ask to be removed, contact the business that scanned your document. We will assist that business in responding to you.
The free app requires no account. You do not sign in, and we do not know who you are. When the app starts, it asks our server for the current price list; that request contains no information about you or your scans, and we do not record your device’s IP address from it. The app does not record your location. On Android, the barcode-reading component supplied by Google (ML Kit) sends Google diagnostic information about how the component is performing; it does not send your scans or images. If you subscribe, you sign in to your account through Microsoft’s sign-in service, and the app uses that sign-in to work out which features you are entitled to.
If you subscribe, you create an account at idscanner.com and we collect the information needed to set it up and bill it: your first and last name, email address, company name and telephone number. You may also add your organisation’s time zone and its locations, with a description and a time zone for each location. Payments are handled by our payment processors: Zoho Subscriptions for subscriptions and Stripe for DMV Checks. We keep invoices and payment records for seven years for tax and accounting purposes.
The app contains no analytics, advertising or crash-reporting software of our own, and it sends us no usage data. The diagnostics that Google’s ML Kit sends on Android are described above.
The third parties described in Section 6 are contractually required to provide the same or an equivalent level of protection for this data as this policy describes, and to use it only for the purpose for which it was sent. A current list of the service providers we use is published on our Trust Center at app.vanta.com/tokenworks.com/trust/9rbdkw467i5l72iptbkwo.
You cancel a subscription at idscanner.com. Your Sync data is kept while you have at least one subscription that includes Sync (IDVisor Go Pro, IDVisor Go Max or IDVisor Sync). When the last of them ends, we delete your Sync data 30 days later. Ending any other subscription does not delete any data. You can export your scans and reports from the Sync portal at any time, including during those 30 days. The export does not include document numbers. In the Sync portal you can also view stored photographs and save them one at a time to your computer. A photograph you save is your responsibility. Sync data that has been deleted cannot be recovered.
You can delete the data held in Sync at any time from the Sync portal. Your subscription account is an idscanner.com account. To delete it, choose Delete account in the app’s Settings, which opens our account deletion page at idscanner.com/delete-account, or write to privacy@tokenworks.com from the email address on your account. We will email you to confirm the request comes from you, then delete the account and confirm when it is done. When a subscription ends, your account stays open with its details, so that it is ready if you come back; you can ask us to close it altogether instead. None of this affects the data stored on your own device, which you remove from within the app or by uninstalling it.
The app is rated 17+ on the App Store and Mature on Google Play. It is not directed to children and is not intended for use by anyone under 17. It is a tool for checking other people’s identification documents at a door or a point of sale. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us at privacy@tokenworks.com.
You can withdraw your consent to any of the optional services at any time by cancelling the subscription, which stops any further transmission. Depending on where you live you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you. Those rights, the appeal process, and the state-specific and EEA, Swiss and UK disclosures are set out in the TokenWorks Privacy Policy at tokenworks.com/privacy-policy/ and apply to the app as well. To exercise a right, contact privacy@tokenworks.com or 1-914-704-3100.
We can only act on data we actually hold. For data stored on a device, the person who controls that device controls the data.
We maintain administrative, technical and physical safeguards for the data we hold, including encryption in transit and at rest. Data stored on your device is protected by the device’s own security, so keeping the device locked, updated and under your control is an important part of protecting it. No method of transmission or storage is completely secure.
We will update this policy as the app changes and will revise the date at the top. If a change materially affects how data leaving your device is handled, we will tell you in the app before the change takes effect.
TokenWorks, Inc., 1 Stone Place, Suite 303, Bronxville, NY 10708. privacy@tokenworks.com. 1-914-704-3100.
Answers to file in App Store Connect. They rest on the development team’s answers of 14 October 2026: the free tier sends no scan data or personal information, the app has no analytics or crash reporting of its own, and the barcode check retains nothing. Nothing is declared for Demo Mode, because no scan data leaves the device, and nothing is declared for the Fake ID Detection barcode check, because it is ephemeral.
| Apple data type | Collected | Linked | Tracking | Purpose and trigger |
| Contact Info — Name, Physical Address | Yes | Yes | No | App Functionality. The subscriber’s name on the account, and the scanned name and address where Sync is enabled. The barcode check and DMV Checks keep nothing. |
| Contact Info — Email Address, Phone Number | Yes | Yes | No | App Functionality. Subscriber account creation and support. Not collected on the free tier. |
| Other Data — document number, date of birth and other identification document fields | Yes | Yes | No | App Functionality. Sync only. The barcode check and the DMV lookup are ephemeral and are not declared. |
| User Content — Photos or Videos | Yes | Yes | No | App Functionality. Camera photographs and mobile driver’s licence portraits, where Sync is enabled. |
| Sensitive Info | No | n/a | No | Not declared. Photographs, including the mobile driver’s licence portrait sent to Sync, are declared under User Content — Photos. The app derives no biometric data from them (MSA §4.8). Counsel to confirm. |
| Purchases — Purchase History | Yes | Yes | No | App Functionality. Subscription and payment records held by Zoho Subscriptions and Stripe. |
| Identifiers — User ID | Yes | Yes | No | App Functionality. Subscriber account identifier. No identifier exists on the free tier. |
| Identifiers — Device ID | Yes | Yes | No | App Functionality. Device entitlement under the subscription. |
| Usage Data — Product Interaction | Yes | Yes | No | App Functionality. Visit counts and the reports portal are computed from the customer’s own scan records in Sync. |
| Location | No | n/a | No | Postcode in the reports portal comes from the scanned document, not from the device. iOS asks for no location permission. On Android the app asks for it only because Android requires it for the Bluetooth connection used to read a mobile driver’s licence, and location is not collected. |
| Diagnostics | No | n/a | No | The iOS build contains no crash-reporting or analytics library. |
| Everything else | No | n/a | No | Health, Financial Info beyond purchases, Contacts, Browsing History, Search History, Surroundings, Body. |
Do not file until Counsel has confirmed that stored photographs are not biometric data, and Marco has updated the Sync consent screen to say that photographs and portraits leave the device when Sync is on.
Answers to file in Play Console. Google asks separately whether each type is collected, whether it is shared, and whether it is required or optional. Use the optional flag on every row that only applies to subscribers. The sharing column takes the conservative answer on the Acupixel leg of DMV Checks.
| Google data type | Collected | Shared | Optional | Purpose and note |
| Personal info — Name | Yes | See note | Optional | Subscriber’s name on the account, and the scanned name where Sync is enabled. Sharing turns on the Acupixel question for DMV Checks. The barcode check involves no third party and retains nothing. |
| Personal info — Address | Yes | See note | Optional | Same as above. |
| Personal info — Email address and Phone number | Yes | No | Optional | Subscriber account management only. |
| Personal info — User IDs | Yes | No | Optional | Subscriber account management only. |
| Personal info — Other info | Yes | See note | Optional | Date of birth, document number and other document fields, where Sync is enabled. The DMV lookup passes through Acupixel to AAMVA and neither retains. |
| Photos and videos — Photos | Yes | No | Optional | Camera photographs and mobile driver’s licence portraits, where Sync is enabled. |
| Financial info — Purchase history | Yes | No | Optional | Subscription records. |
| App activity — Other actions | Yes | No | Optional | Visit counts, flagged-person entries and the reports portal, all computed from the customer’s own scan records in Sync. |
| Device or other IDs | Yes | No | Required for subscribers | Device entitlement under the subscription. |
| App info and performance | Yes | [No] | Required | Android only. Google ML Kit sends diagnostics about the barcode-reading component to Google. It cannot be switched off and does not send images or barcode contents (Jaidon, 15 October 2026). Confirm the sharing answer against Google’s ML Kit data disclosure. |
| Location, Health and fitness, Messages, Files and docs, Calendar, Contacts, Web browsing | No | No | — | The Android location permission is used only for the Bluetooth connection during mobile driver’s licence reads. Location is not collected. |
Security practices section:
This part is not privacy. It is here because the policy in Part 3 describes where subscriptions are bought and cancelled, and those sentences have to match what the app actually does and what the stores allow.
Appendix B is candid about this and the policy should not be more confident than it is. Its assessment is that Sync is a textbook match for the exemption and low risk, that Fake ID Detection is defensible but a reviewer could argue its value is consumed in the app, and that “the real risk is presentation, not the model” — naming the in-app upsell prompts as “the single thing most likely to break the exemption.”
There is a second point in Appendix B worth holding onto. Its own legal reference notes that guideline 3.1.1 still requires an app to keep in-app purchase available alongside any external link, and that anything sold externally must also be purchasable through in-app purchase. That requirement sits with the link-out route in 3.1.1(a). The companion-app route in 3.1.3(f) is the one that drops in-app purchase entirely, and it is the route whose conditions the Subscribe prompts put under strain. Relying on 3.1.1(a) for the prompts while relying on 3.1.3(f) to avoid in-app purchase is the combination to put in front of counsel, because each rule on its own is clear and the overlap is not.
Decision taken You have decided to submit to review as built rather than put the question to Apple first, and to settle the fallback if review objects. Recorded here so the position is on the record rather than assumed. The cost if review does object is a rebuild of the purchase flow and a resubmission, which Appendix B of the tiers document estimates at about two weeks. What remains is settling exactly what the Subscribe prompts display, because a button that links out asks less of the exemption than a full price table.
| Requirement | What it means here | Owner |
| Privacy policy URL | Both stores require a live URL in the listing, and Apple also requires the policy to be reachable from inside the app. Publish Part 3 at its own address and link it from the app settings screen. | Danny, Jaidon |
| Pointer from the main policy | Add a line to the TokenWorks Privacy Policy pointing at the app policy so the two are visibly connected. | Danny |
| Apple privacy manifest | The app needs a PrivacyInfo.xcprivacy file declaring collected data types and the reasons for any required-reason APIs. Every third-party library in the build needs its own. This is a build artifact, not a document. | Jaidon |
| Purpose strings | The camera permission prompt must describe clearly and completely what the images are used for. Write it against the constrained feature scope, not a free-form camera. | Jaidon |
| In-app account deletion | Required by Apple wherever an app supports account creation. The free tier creates no account, but subscribers do, so it is required. | Jaidon |
| Web deletion page | Required by Google Play. Must load without error, identify the app or TokenWorks as listed, and work without the app installed. | Danny |
| Downgrade export and delete confirmation | No longer needed. Section 11 of the policy no longer describes a warning or confirmation screen. Sync data can be exported from the Sync portal at any time, including during the 30 days before it is deleted. | Jaidon |
| Consent for the optional services | Apple requires explicit permission before data is transmitted to a third party. Show the confirmation that the customer has its patrons’ permission at the point the subscription is switched on, and record it. Decided 28 October 2026: a checkbox in the app. DMV Checks does not run until it is checked, and the confirmation is saved with its date and time on the customer’s account. Still required where the processing is ephemeral. | Jaidon |
| Age rating | Set a rating that excludes children, consistent with Section 12 of the policy. | Jaidon |
| Acupixel equal-protection term | Section 10 of the policy states that third parties provide equal protection, which Apple requires. Acupixel is the only third party in the app data path. The agreement with them has to carry that term, and a SaaS licensing negotiation is already open where it can be added. | Charles, counsel |
| Trust Center contents | The policy now points readers at the Vanta Trust Center for the list of service providers. Check that the list published there actually names Acupixel and Microsoft Azure. | Opher, Charles |
| Subprocessor list entries | Add Acupixel to the subprocessor list. ID Sentry does not belong on it for the app path, since it licenses the rules and receives no data. | Charles, Opher |
| Retention schedule alignment | The retention in Section 4 and Section 6 must match what the app and Sync actually offer, and what DPA Schedule 3 says. Items D2 and S6 in the change plan cover the schedule. | Charles, Jaidon |