Privacy policy

Effective 9 October 2026 · Applies to the Latte PDF app, the Latte Scanner app and this website

1. Who we are

Latte PDF is made by Devicery, LLC, trading as Latte ("we", "us"), 9921 Carmel Mountain Rd #2, San Diego, CA 92128, USA. We are the controller of the personal information described here. Contact us at support@latteapps.com.

2. Your documents

Everything you open in Latte PDF stays on your computer. Editing, text recognition on scanned pages (using Apple's on-device Vision framework on macOS), font matching and saving all run locally. We have no copy of, and no access to, your files, their contents, their names or how you use them.

3. The app and the internet

Latte PDF never connects to the internet on its own. Nothing is sent when it starts. It has no background connections, no automatic updates, no analytics, no crash reporting and no advertising. It goes online only when you click one of these buttons:

• Activate sends your licence key, your email address and an anonymous computer identifier (a one-way code the app makes from this computer's hardware ID; the hardware ID itself is never sent), so our licence server can check the key and count your computers against your plan. The server sends back a signed licence file. From then on your licence is checked on your computer, with no connection needed.
• Deactivate this computer sends the same three things, so the server can free this computer's place on your plan.
• Show my invite code, Check again and the reward buttons in Help › Invite Friends send your licence key and your email address, so our licence server can find your licence's invite code and tell you how many friends bought with it. Taking the reward licence also sends the email address you type for it. No computer identifier is sent.
• Check for updates and Install ask our update server whether a newer version exists and, only if you confirm, download it. They send no licence key, email address, computer identifier, usage data or document content.
• Download in Make Form › Add language asks our update server for one language pack (a font for form answers in Chinese, Japanese or Korean) by its name. It sends nothing else: no licence key, email address, computer identifier, usage data or document content. The app checks the pack against the size and fingerprint built into it, and keeps it on your computer, so forms in that language then work offline.

None of these requests contain your documents or anything about them. Our licence and update server is run on our behalf by a hosting provider. Request logging on our server is turned off, and it never logs email addresses, licence keys or IP addresses. So keys can't be guessed, our hosting provider's rate limiter uses your IP address only briefly to count requests whose licence key and email address don't match. After repeated ones from one IP address (for IPv6, its network prefix), our server refuses these requests from that address for up to a minute, for everyone using it, even with a key that matches; for that minute it keeps a one-way code made from the address with a secret key, never the address itself. Otherwise, a request whose key and email match is counted against that licence, not your IP address. As with any internet request, our hosting and network provider may process your IP address to deliver and protect the service.

If you never click these buttons, Latte PDF never connects to the internet at all. If you email us a problem report, it contains only what you decide to include.

4. When you buy a licence

Orders are processed by Lemon Squeezy, LLC, which acts as the merchant of record and handles payment, sales tax and VAT, and invoicing. Lemon Squeezy collects your name, email address, billing country, postal code where required, and payment details under its own privacy policy. We receive your name, email address, country, order number, plan and licence key. We never see your full card number.

When you activate the app, our licence server stores your licence key, your email address and the anonymous identifier of each computer you activate, so it can count your computers against your plan. Deactivating a computer deletes its identifier.

Invite codes. Every licence comes with a personal invite code (and Latte Scanner gives one to anyone who asks). Our licence server keeps the code, the licence it belongs to (or, for a code from Latte Scanner, a one-way hash of the secret the app keeps), a random number friends' App Store purchases carry, and for each friend who bought with it a one-way hash of the order or App Store transaction, its date and any refund, so it can count friends and give rewards. It keeps no name, contact, device identifier or IP address with a code, and never tells you who bought: Latte Scanner shows only how many, and for each the day the purchase reached our server and which app (with only a friend or two, you may well guess who). Each code is also a discount in Lemon Squeezy, so our server sends Lemon Squeezy the code, its discount, its end date and how many uses it has left; Apple tells our server about purchases made with a code, and refunds of them. A reward licence is made for the email address typed for it, like any licence. For a code from Latte Scanner, that address is typed on our website's claim page, never in the app: the app shows a claim code, of which we keep only a one-way hash, until it is used, replaced or ended (30 days after it was made).

Latte Scanner Pro sales. Apple tells our server about each Latte Scanner Pro purchase in the App Store, and each refund. Besides what invite and creator codes need (above), our server keeps only a count of them for each day, at Pro's list price, so we can see how sales go: never your Apple account, your device or anything else about you.

Retired friend codes. Before invite codes, orders were to come with single-use friend codes; none are given now. Our licence server keeps any that were made, with the licence each came with and the order that used one, as a record and to stop misuse, and asks Lemon Squeezy to delete those not used (it sends Lemon Squeezy only the code).

Every paid Personal order also comes with a code for Latte Scanner Pro at no cost, once it is in the App Store. Our licence server stores which code went to which licence, so it can resend it. You redeem the code with Apple, and Apple doesn't tell us whether or when it was redeemed.

If you use Reset my licence on our website, your browser sends the email address and licence key you enter to our licence server. If they match a licence, the server deletes the identifiers of every computer on it, keeps a note of the reset (the licence, the time and how many computers were freed, so it can limit resets to 3 in 30 days) and emails the result to the purchase address. It does not store your IP address; our hosting provider's rate limiter uses it only briefly to count attempts. Find my key sends only the email address you enter (its rate limiter, too, uses your IP address only briefly). Add computers sends the email address, licence key and number of computers you enter, so the server can check it is your Office licence and make a checkout for them; nothing about it is kept until you pay.

If you join a waitlist on our website (to hear when checkout opens, or when Latte Scanner, our scanner for iPhone and iPad, is in the App Store), we keep the email address you enter, which list you joined and when. We use it only to send that one announcement, and delete it once it has gone out.

5. When you contact us

If you email us, we keep your message, your email address and any details you send so we can help you and keep a record of our support.

6. This website

This website sets no cookies and uses no advertising, social media or third-party tracking scripts. To learn which pages and links bring people to Latte PDF and how many of them buy, the site keeps anonymous daily counts. When a page loads, when you click a Buy or Download button, when the pricing section comes into view, and when you leave a page you scrolled down, your browser sends our server a short note, and the server adds 1 to a total for that day.

The note says only: which page or button it was, whether you arrived from another website (a reload, the Back button or coming back from checkout doesn't count as arriving), that website's name (for example "google.com") or the campaign labels in the link (utm_source, utm_medium, utm_campaign), whether your screen is phone, tablet or computer sized, and, if you scrolled, roughly how far down the page you got (a quarter, half, three quarters or all of it). Our server adds your country, worked out from your connection, and whether the connection comes from a data-centre network rather than a home or mobile one (to tell people from automated traffic; the network itself is not kept). When you arrive on the site (rather than moving between its pages), it also adds 1 to separate daily counts for your region and city, as our hosting and network provider estimates them from your connection, with that city's approximate position on a map (to about 10 km), and for your operating system (for example Windows or Mac), your browser's family (for example Firefox) and the first language your browser asks for (for example German); a click on Download adds 1 to a count for your operating system. Each of these is counted on its own: never together with each other, the page, the website you came from or your screen size. Your IP address, your browser's full details (its user agent and language settings), the full address of the page you came from and any identifier are never stored; our hosting provider's rate limiter uses your IP address only briefly to count these notes, so one connection can't flood the totals. Nothing is saved in your browser for this: no cookie and no local or session storage, so we cannot recognise you on your next visit or follow you across websites.

When you click Buy, the same source label (for example "google.com") is added to the checkout link, so that a completed purchase can be counted under the website that led to it. It is not linked to your name or email in our statistics.

If you open a friend's link (one with ?code=… in it), the code is part of the page address, so it reaches this website like any address does. The website does not store it or count it in its statistics, and the page adds it only to the checkout link you click. For an invite code or a creator's code, the invite page (/invite), and the pricing section once checkout is open, also ask our licence server once whether the code works; the server keeps no record of the question, and its rate limiter uses your IP address only briefly to count attempts. Buying Office, or buying with a Latte Scanner Pro owner's code, asks our licence server to make the checkout at its price: the browser sends the plan, the number of computers, that code if you entered one, and the site or campaign you came from; the server keeps nothing about it until you pay, when the order uses the code up.

Affiliate links lead to Lemon Squeezy's own pages, where Lemon Squeezy tracks them under its privacy policy, which may include a cookie in your browser on its pages. This website does not track affiliate visits. If you apply to our affiliate program, Lemon Squeezy shares your name, email address, website and application note with us so we can review it; our licence server reads them from Lemon Squeezy and may email them to our own support mailbox, and keeps only Lemon Squeezy's id for your membership, its status and dates.

If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted at all. The Latte PDF app never sends statistics of any kind, and never sends anything about your documents.

Our hosting and network provider may process your IP address and standard request details (date and time, page requested and browser type) to deliver the website and protect it from attacks. It keeps any such records for no longer than 30 days. If you pick light or dark mode, that choice is stored in your own browser and never sent to us.

7. Why we use your information

8. Who we share it with

We share personal information only with service providers who help us run Latte PDF, and only as much as they need: Lemon Squeezy (payments, as merchant of record), and our providers of hosting, networking and email delivery (for the website, the licence and update server, and the emails that deliver licence keys). Each is bound by a data processing agreement. If you would like to know which providers we use, email us. We may also disclose information if the law requires it. We do not sell personal information and we do not share it for targeted advertising.

9. How long we keep it

• Order records: 7 years, as tax law requires.
• Licence records (your email, your licence key, stored encrypted, the identifiers of your activated computers, a record of resets, your invite code with the hashed records of friends who bought with it, and any retired friend codes with the order that used one, so we can resend your key and code, count your computers and give rewards): for as long as you own the licence.
• Website statistics: kept as anonymous daily totals, which contain no personal information. Visits by city are kept as daily totals too.
• Invite codes, the purchases counted for them and the rewards given: for as long as the code can be used, or, for a licence's code, as long as you own the licence. Ask us and we delete your code and its counts. A Latte PDF code for a Latte Scanner Pro owner, with the hash of that purchase: kept so the same purchase can't get a second code; ask us and we delete it once the code has ended.
• Latte Scanner codes: with the licence they went to, for as long as you own it.
• Waitlist addresses: until the announcement you asked for has been sent, then deleted.
• Support emails: 3 years after the conversation ends.
• Request records kept by our hosting provider: no longer than 30 days.

10. Your rights

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, or send it to you in a portable format. You can also object to how we use it. If you are in the EU, the UK or a similar jurisdiction, you have these rights under the GDPR or UK GDPR and can complain to your local data protection authority. If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing under the CCPA; we don't sell or share, so there is nothing to opt out of. We will never treat you differently for using your rights.

To make a request, email support@latteapps.com. We reply within 30 days. If we turn down your request, you can ask us to reconsider by replying to our answer.

11. International transfers

Our service providers may process information outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

12. Children

Latte PDF is not directed at children under 13 (or under 16 in the EU), and we don't knowingly collect their personal information. If you think a child has sent us information, contact us and we'll delete it.

13. Security

We protect the little information we hold with encryption in transit, restricted access and reputable providers. Because your documents never reach us, they can't be exposed by a breach of our systems.

14. Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll email licence holders before it takes effect.

15. {scanName} for iPhone and iPad

Latte Scanner is our document scanner for iPhone and iPad, coming to the App Store. This section describes how the app works; the rest of this policy covers it too where it applies.

• Your scans stay on your device. Finding the page, straightening and cleaning it, reading its text (with Apple's on-device Vision framework) and making the PDF all happen on your iPhone or iPad. The app keeps your scans in its own storage, which your device encrypts while it is locked. We have no copy of, and no access to, your scans, their text or their names.
• Apart from invites and the Latte PDF code, the app goes online only to Apple. It has no account, no analytics, no advertising, no crash reporting of its own and no tracking. It reaches the App Store when you tap Unlock, Restore purchase or Redeem a code, and when its Latte Scanner Pro page opens it asks the App Store for the price. If you choose Kept in your iCloud, it syncs your scans with your own private iCloud database; everything is locked by the app before it goes, with a key kept in your iCloud Keychain, so Apple stores only locked data and we have no access to it. Automatic backup to a folder you pick is covered below: that folder's own app may upload the locked file. So is Automatic export, whose unlocked copies a folder's app may upload, and Open in Safari, which hands a link read from a QR code to Safari only when you tap it. Separately, your device's App Store service keeps your purchases up to date with Apple on its own, as it does for every app; the app reads the result on your device.
• Invites and the Latte PDF code, only when you tap. Invite friends, entering a friend's code (Have a friend's code?, or Discount code on the Latte Scanner Pro page) and the Latte PDF code's button in Settings › Latte PDF are the only parts of the app that talk to us, and only to our licence server, only when you tap, with fixed contents. Get my invite code sends nothing about you; the server makes a random code and a secret, which the app keeps in your iCloud Keychain so they follow you to a new device. Check my invites sends the code and its secret, and the answer is how many friends bought with it, the day each purchase reached our server and which app (never who), and your rewards; Get my free code sends the same to take the free Latte Scanner Pro reward. When you apply a friend's code, only that code is sent; if you then buy Latte Scanner Pro at the friend price, Apple's purchase carries a random number made for that code, and Apple tells our server about that purchase (and any refund), so the friend who gave the code gets it counted without your app sending anything more. Asking for the Latte PDF code a Latte Scanner Pro purchase comes with sends Apple's signed record of that purchase. Taking the reward licence sends the code and its secret, and the answer is a claim code the app shows: you enter it with an email address on our website (latteapps.com/claim), never in the app. None of these requests contain your scans, their text, your expenses, names, contacts, locations or a device identifier. Our licence server doesn't store your IP address. So codes can't be guessed, its rate limiter uses it only briefly to count requests: Get my invite code and applying a friend's code always, Check my invites and the reward buttons only when the code and secret don't match (when they match, the request is counted against that invite). After repeated ones that don't match from one IP address (for IPv6, its network prefix), the server refuses those requests from that address for up to a minute, for everyone using it, even with a code and secret that match; for that minute it keeps a one-way code made from the address with a secret key, never the address itself.
• Purchases are handled by Apple. The unlock is an in-app purchase in the App Store. Apple processes it under its own privacy policy and tells the app only whether your Apple Account owns the unlock, which the app checks on your device. Apple does not give us your name, email address or payment details.
• Where your scans are kept is your choice. Before your first scan, the app asks what should happen to them if you lose your device: kept in your iCloud (synced and locked, as above), only in your device's own backup (iCloud Backup or your computer), or kept only on the device and left out of every backup. You can change this in Settings at any time. Your device's own iCloud backup is stored by Apple under your Apple Account and is end-to-end encrypted only if you turn on Advanced Data Protection. We never have access to any of it.
• Backup files are locked. A backup file you make, or the automatic backup the app writes to a folder you pick (such as iCloud Drive or Dropbox), is encrypted on your device. It opens with a key kept in your iCloud Keychain (Face ID or Touch ID, in the app on an iPhone or iPad with iCloud Keychain turned on) or with your recovery key, which the app shows you once and does not keep. We never see either key and cannot open your backups. The service that holds the folder stores only the locked file.
• A scan leaves your device only when you send it, or in the backup you chose. Sharing (AirDrop, Mail, Messages), saving to Files or another location, Export everything and Automatic export send your scans only where you choose. Backups go only where you chose, always locked.
• Locks. You can lock the app, lock a scan, move scans to the Private folder, and lock or hide folders. A locked or private scan is encrypted on your device with a key of its own, opened with Face ID, your device passcode or a private passcode you choose. Your device checks your face or passcode; the app never sees your face data or passcode, and a private passcode is never stored, only used to lock a copy of the key.
• What the app keeps on the device: your scans and their recognised text, your folders and settings, and with Latte Scanner Pro your expenses, categories, the names of people you split with, trips, your budget, your reminders and your mileage log. Receipts are read on the device. All of it goes only into the backup you chose. None of it is sent to us.
• Mileage, only while a trip runs. With Latte Scanner Pro, if you tap Start trip, the app uses your location while that trip runs, to measure its miles, and stops when you stop it. It keeps where the trip started and ended (rounded to about 100 m), the miles and your purpose, never the route. Place names come from places you saved on your device; the app does not look up addresses online.
• Reporting a problem. If you choose Report a problem, the app shows you what it would send and opens a draft email in Mail, which you read and send yourself. It includes only what you leave ticked (your message, a screenshot you pick and can blur, your app and system versions, and an error log of codes and numbers), never your scans, their words, your expenses or your locations.
• Codes, business cards and passports, read on your device. QR codes and barcodes are read on your iPhone or iPad, and nothing is kept of them. The app never opens a link by itself and loads no preview; Open in Safari hands the address to Safari when you tap it, and from then the website sees the visit as any visit from Safari. A business card goes into Contacts only when you tap Done in Apple's contact sheet; from there Contacts syncs it as your own settings say (for example to iCloud). A passport's or ID card's details are read on your device and kept only inside the scan; reminders hold the kind and the date, never the number.
• Automatic export writes unlocked copies. If you turn on Automatic export, the app writes a searchable PDF of each scan into a folder you pick, while the app is open: your scans in the library, hidden folders' too. Locked and Private scans are written only if you turn on Include locked scans and tap Export now, and then as unlocked copies. Those copies are not locked: anyone who can open the folder can read them, and if the folder belongs to an app such as iCloud Drive or Dropbox, that app may upload them under its own terms. Turning it off stops the writing; the files already there stay until you delete them.
• Only if you ask. Reminders are local notifications set on your device; the app asks permission the first time you set one. Picking a friend from Contacts copies only the name you pick, and it stays on your device. Adding a contact from a code or a business card, or an event from a code, goes through Apple's own sheets, so the app needs no access to your contacts or calendars. If you turn on receipt suggestions from screenshots, the app looks at your recent screenshots on the device, with the Photos access you allow, and brings nothing in until you tap.
• Apple's own reports. If you have chosen, in your device's settings, to share analytics with app developers, Apple may give us crash reports and usage totals that don't identify you. Otherwise we receive nothing.

On its App Store page, Latte Scanner will declare only what invites and the Latte PDF code need: Identifiers (your invite code) and Purchases (the purchases counted for a code, and the Latte Scanner Pro purchase sent for the Latte PDF code), not linked to you and not used for tracking. No email address: the reward licence is claimed on our website. Nothing from your scans is ever collected.

16. Contact

Devicery, LLC
9921 Carmel Mountain Rd #2, San Diego, CA 92128, USA
support@latteapps.com