Effective date: October 23, 2026
This policy covers the Android app Ellipse Converter (package
app.ellipse.converter), published by Ellipse. Questions:
ellipseapps@gmail.com.
Effective 23 October 2026. Applies to the Android app app.ellipse.converter
published by Ellipse. The hosted copy is
https://ellipseapps.pages.dev/converter/privacy/; keep both in step.
Files you pick are read through the access Android grants for that selection. The app keeps a private copy of a source only while a conversion needs it, and finished results stay in the app's private storage until you share, export or delete them. Your original files are never modified, unless you choose Replace original for a result and confirm it; the result is then written over that file. Settings, saved recipes and the remembered export folder are stored only on your device and are excluded from Android backups.
A finished file you delete waits in Recently deleted, in the same private storage, for 30 days, and is then deleted for good; you can bring it back or delete it sooner. Back up library writes your finished files, folders, tags, scan drafts, recipes and settings into one file, saved wherever you choose in the system's file picker. The app does not upload it anywhere; if you choose a cloud drive, that service stores it under its own terms. Your saved signature goes into the backup only if you tick Include my saved signature.
The scanner uses the camera only while you scan, and only after you allow it; you can decline and import pictures instead. Page edges, text, tables, business cards and codes are found and read on the device by models bundled with the app, and no picture or recognized text is sent anywhere. A scan in progress stays in the app's private storage, so it survives closing the app, until you save it or discard the draft. Remove background also runs on the device with a bundled model. Read aloud speaks recognized text through the text-to-speech engine installed on your device, using only voices that work without a network connection.
The app reports how it is used to Ellipse through Google Analytics for Firebase, so that we can see which tools people use and which conversions fail. It sends events such as a tool's screen being opened, a conversion starting, finishing, failing or being cancelled, a finished file being shared, saved or printed, and whether a library backup or restore worked and how many files it held. These carry fixed descriptions only: the tool, the kind of file (for example "video" or "document", worked out from its extension), the output format, how long the conversion took in broad bands, how many files were in the run, and a failure code. When a conversion fails, or a picked file can't be opened or previewed, the event also says, in broad terms, what the file was (for example "H.264" or "HEVC", and a picture height band such as "1080p") and what kind of encoder was used (the phone's hardware encoder or a software one). They also cover the Pro screen and checkout steps, whether an ad loaded, and the outcome of the ad consent form; whether the scanner was allowed to use the camera, how long the camera took to be ready and whether it failed; what became of files picked for a tool (for example that they were not the kind it takes); and, when a tool's screen is left without running it, what was in the way, as the screen said it. They never include a file, a file name, a folder, text you typed or the app recognized, page contents or pictures.
Google Analytics also collects, automatically: an app-instance identifier, the Firebase installation ID, the advertising ID where the device allows it, the device model, Android version, language, approximate location derived from the IP address, and when the app is opened and used. If you subscribe, the app records whether Pro is active and which plan was chosen, and Google Play reports completed purchases to Analytics. Google processes this data for Ellipse under Google's terms, and keeps event data for Ellipse for up to 14 months. Analytics is not used on Google's automated test devices.
When the app crashes or stops responding (on Android 11 and later), Firebase Crashlytics sends Ellipse a report: the error's type and the place in the app's code where it happened, the app version, device model, Android version, free memory and storage, whether the app was in the foreground, a random installation identifier, and fixed facts the app records for this purpose (the screen shown, the tool last opened, whether a conversion was running and on which engine, the device's temperature state and available memory). File names, folders, addresses and e-mail addresses are removed from error messages before they are sent. For a crash in native code the report includes a snapshot of the crashing code's memory, which Google uses only to work out where the crash happened. If the app was closed in the middle of a conversion (by Android for lack of memory or for another reason, from Recents or Settings, or by an update), the app reports that fact on its next start, with the failure report for the conversion it stopped. Crashlytics keeps reports for 90 days.
When a conversion, a preview, opening a picked file or the scanner's camera fails, the app also sends Ellipse a failure report through Crashlytics, so that we can find out why a tool failed on your phone. A camera failure report says only whether the camera could not start or could not take a picture, with the type, code and message of the error the camera library gave (with the details below removed). The others carry fixed facts only:
It also includes up to 40 lines from the conversion engine's own log that say what went wrong. The engine's other lines, which can hold a file's titles, artists, comments or places, are left out. File names, folders, addresses, quoted words and any letters outside plain English characters are removed from the lines that are kept. Like crash reports, failure reports are only sent while Settings → Privacy → Send crash reports is on.
On the next start after a crash or a freeze, or after the app was closed in the middle of a conversion, the app also tells Google Analytics that it happened, with the kind of exit, the screen shown and whether a conversion was running, and nothing more.
The app also saves a copy of the report, with the same details removed, on your device and offers it to you once. It leaves the device only if you choose to send it from your own email app, where you can read and change it first.
Settings → Privacy → Send crash reports is on by default. Turning it off stops Crashlytics collecting crash and failure reports, deletes reports it has not yet sent, and stops the app saving reports or telling Analytics about crashes.
Google Play Billing and Google's bundled text-recognition library (ML Kit) send Google their own usage and diagnostics logs, such as which library features were used and how long they took, through the same Google service that delivers crash reports. They do not include your files, pictures or recognized text. Google uses them under its own privacy policy.
The free version shows one banner under the main screens and an occasional full-screen ad after a conversion has been queued, never before your first conversion has finished. When ads are requested or shown, Google automatically collects and shares with its partners the IP address (from which an approximate location may be derived), app interactions such as ad impressions and taps, diagnostics, and device identifiers including the Android advertising ID and app set ID. Google uses this for advertising, analytics and fraud prevention under Google's privacy policy. Ellipse receives only aggregated advertising reports.
Where the law requires it (EEA, UK, Switzerland, certain US states) the app shows a consent form before requesting ads, and Settings → Ad privacy options reopens it. You can reset or delete your advertising ID in Android settings. Subscribing to Pro removes the ads entirely; the app makes no ad requests while Pro is active, including during a tester grant.
Pro is a monthly or yearly auto-renewing subscription bought through Google Play. Google handles payment and holds your purchase history; Ellipse does not receive payment-card, bank or address details. The app asks Google Play whether this account has an active subscription and remembers the answer on the device; it sends purchase data to no Ellipse server of its own. Google Analytics records that a purchase was made (the plan and price), as described above. Manage or cancel from the Pro screen or the Google Play subscription centre.
If you install the app from Google Play, Google may also report crashes and app-not- responding events to Ellipse through the Play Console under Google's own privacy policy. Those reports do not include your files.
After you have finished a few conversions, the app may ask Google Play to show its review card, and Settings has a link to the app's Google Play page. Any rating or review you write goes to Google Play under Google's privacy policy; the app is not told whether you rated it or what you wrote. The app counts only how many conversions finished, on the device, to decide when to ask.
When you have just installed the app from Google Play, the app asks Google Play on your device where the install came from (Play's install referrer), only to tell whether VR Player, Ellipse's other app, suggested it; if it did, the first start opens the video tools. Only that yes or no is kept, on the device, and it is not sent anywhere.
Send feedback writes a message in your own email app, addressed to Ellipse, which you can read, change or discard before sending. Nothing is sent by the app itself. If you leave Include app and phone details on, the message ends with the app version, the Android version, the phone model and the language, exactly as shown on screen first. No file or file name is added.
Everything the app stores is on your device and is removed when you delete results, clear the app's data or uninstall. Ellipse holds no account or file of yours. The usage statistics and crash reports described above are held by Google for Ellipse and expire after the periods given there. They are tied to random identifiers rather than to you, so Ellipse cannot pick out one person's data; clearing the app's data or reinstalling it gives the app new identifiers (the advertising ID is reset in Android settings). The app is not directed at children and is not intended for users under the age required for ad-supported apps in their region. Changes are published at the same address with a new effective date. Contact: ellipseapps@gmail.com.