Why Your OCR App Is Probably Sending Your Documents to the Cloud (And What to Use Instead)

You take a photo of your passport to extract the text. Maybe it’s for a visa application, or you need the number for an online form. You open an OCR app, point the camera, and the text appears on screen. Done, easy. But here’s the question nobody asks: where did that image just go?

If the app needed an internet connection to work, your passport photo was almost certainly uploaded to a remote server somewhere. It was processed by a machine you don’t control, stored for a duration you can’t verify, and potentially accessible to people you’ll never meet. That’s not hypothetical. That’s how most OCR apps work.

Now think about everything else you scan: bank statements, medical records, tax documents, contracts, IDs, receipts with your credit card number visible. If your OCR app uses cloud processing, all of that data has left your device. You handed it over the moment you tapped “scan.”

How cloud OCR works vs on-device OCR

The difference between these two approaches is not subtle. It’s the difference between your documents staying in your hands and your documents traveling across the internet to a data center you have never seen.

Cloud OCR

When you scan a document with a cloud-based OCR app, here’s what happens behind the scenes:

1. Your phone captures the image and uploads it to the app developer’s server, or more commonly, to a third-party API like Google Cloud Vision, AWS Textract, or Microsoft Azure Computer Vision.
2. The server processes the image using powerful GPU clusters running large neural networks trained on text recognition.
3. The extracted text is sent back to your phone and displayed in the app.

Your scanned image has now traveled across the internet, been processed on hardware owned by a third party, and depending on the service’s data retention policy, might still be sitting on that server. Some APIs retain uploaded images for model training or quality improvement unless you explicitly opt out. You probably did not opt out, because you probably did not know.

On-device OCR

On-device OCR is the opposite. The entire pipeline runs on your phone’s neural engine chip. The image doesn’t have to leave your device to be read: no upload, no server, no third party involved in recognition. Apple’s Vision framework, which powers Live Text and apps built on top of it such as Textora, runs neural networks directly on the A-series or M-series chip in your iPhone or iPad. The result is fast, accurate, and the image stays on the phone.

For a deeper look at the technical difference between traditional and AI-powered OCR engines, see our breakdown of AI OCR vs regular OCR.

Which popular apps use cloud processing

Not every cloud-based OCR app carries the same risk, but here are some worth knowing about.

CamScanner

CamScanner is one of the most downloaded document scanning apps worldwide, with over 100 million installs. It also has a documented security incident in its history. In August 2019, Kaspersky researchers found a Trojan dropper, Necro.n, inside the Android app. Google removed it from the Play Store, and per the same report the developers then stripped the malicious code and the app returned.

That was seven years ago and it was fixed, so it isn’t a reason to avoid the app today on its own. It is a reason to notice the structural difference: CamScanner processes in the cloud by design, which means an incident on their infrastructure is an incident involving your documents. An app that never receives the file doesn’t have that failure mode. That’s an architectural point, not an accusation.

Free OCR apps with hidden cloud dependencies

Many free OCR apps on the App Store use Google Cloud Vision API or similar services under the hood. The app itself is just a camera interface that sends your photos to Google’s servers for text extraction. The developers get a generous free tier from Google, you get “free” OCR, and Google gets your document images flowing through their infrastructure. The app’s privacy label might say “data not collected,” but the third-party API call still happens. When the product is free, your data is often what pays for it.

Adobe Scan

Adobe Scan uses Adobe’s Document Cloud for processing. Adobe has a solid reputation and clear privacy policies, but the fundamental issue remains: your document images leave your device and travel to Adobe’s servers. For a scan of a restaurant menu, that is fine. For a scan of your Social Security card, you should think twice.

If you have been looking into alternatives to mainstream scanners, our guides on Google Lens alternatives focused on privacy and Microsoft Lens alternatives cover more options in detail.

Which apps process everything on your device

The good news is that on-device OCR has gotten remarkably good. Apple’s investment in the Vision framework means you no longer need cloud servers to get accurate text recognition. Here are the strongest options that keep your data local.

Apple Live Text

Built into iOS 15 and later, Live Text uses Apple’s Vision framework to recognize text directly in the Camera app, Photos, Safari, and more. It runs entirely on-device, works offline, and handles printed text with high accuracy. The limitation is that it is a system feature, not a full-featured OCR app. You cannot easily export structured text, batch process multiple documents, or do much beyond basic copy-paste.

For a complete walkthrough of extracting text from images on iPhone, including Live Text, see our image to text iPhone guide.

Textora

Textora uses the same Apple Vision framework for text recognition, so the photo is not uploaded to read it, and recognition works in airplane mode. Where it goes further is in what happens after extraction: multi-page scanning, a searchable library of everything you have scanned, searchable PDF export (a text layer under the scanned image), Word, TXT and Markdown export, and a one-tap save of the scanned PDF to Files.

Textora also offers cloud AI features such as Smart Knowledge Cards, cloud translation and document chat. These are off unless you turn them on. When they are on, only the recognised text is sent, never the photo, and sensitive values such as card numbers, IBANs, emails, phone numbers and passport or ID numbers are masked on the phone before anything is sent, then masked again on the server. With cloud AI off, you still get the full recognised text. No account is needed to start scanning.

Scanner Pro

Readdle’s Scanner Pro does most of its OCR processing on-device. It is a solid scanner app with good document management features. Worth noting that some of its more advanced features may involve cloud processing, so check the specific feature’s privacy details if that matters to you.

How to check if your current OCR app is sending data to the cloud

You do not need to be a security researcher to figure this out. Here are four practical methods anyone can use.

1. The airplane mode test

This is the simplest and most reliable check. Turn on airplane mode on your iPhone, then try scanning a document with your OCR app. If text recognition still works perfectly, the app is processing on-device. If it fails, shows a loading spinner that never resolves, or suddenly cannot recognize any text, your documents have been going to the cloud every single time you used it.

Try it right now with whatever OCR app you currently use. The result might surprise you.

2. Check App Store privacy labels

Go to the app’s page in the App Store and scroll down to the “App Privacy” section. Look for categories like “Data Linked to You” or “Data Used to Track You.” If you see “Photos or Videos” or “User Content” listed under data collected, that is a strong signal the app is uploading your content. Privacy labels are self-reported by developers and not always perfectly accurate, but they are a useful starting point.

3. Read the privacy policy

Nobody enjoys reading privacy policies. But for an app that handles photos of your most sensitive documents, it is worth five minutes. Search the document for these terms: “cloud processing,” “server-side,” “third-party services,” “data retention,” “Google Cloud,” “AWS,” “Azure,” and “uploaded.” If any of these appear in connection with how your documents are processed, the app uses cloud OCR.

4. Monitor network activity

For the more technically inclined, you can use a network monitoring tool like Charles Proxy or a DNS-level tracker to see exactly what servers the app contacts when you scan a document. If you see API calls to vision.googleapis.com, textract.amazonaws.com, or similar endpoints during a scan, you have a definitive answer.

Why this matters more than you think

You might be thinking: “I have nothing to hide.” That is not really the point. The issue is not about secrecy. It is about control. Sensitive personal information, once uploaded to a server, is outside your hands. Servers get breached. Companies change their privacy policies. Acquisitions happen. Data that was “not sold to third parties” under one ownership can be reclassified under new ownership.

The 2019 CamScanner incident was not about a privacy policy change. It was actual malware, embedded in an app with over 100 million downloads. The next incident might not involve malware at all. It might just be a quiet data breach at a cloud OCR provider that exposes millions of document images: passports, driver’s licenses, bank statements, medical records. Without anyone knowing for months.

When on-device processing is this capable, there is simply no good reason to accept the risk with sensitive documents. Cloud OCR made sense in 2015 when phone processors could not handle neural network inference in real time. That era is over. Apple’s Neural Engine can run complex Vision framework models with speed and accuracy that matches or approaches cloud solutions for standard printed text. The privacy trade-off is no longer justified by a meaningful accuracy advantage.

For complex layouts, handwriting, or specialized document types, cloud AI can still add value. But the right approach is to use on-device OCR as the default and only involve cloud processing when you consciously choose it — with sensitive data redacted before anything leaves your phone. That is the model that respects both your needs and your privacy.

Take control of your document privacy

Your OCR app handles some of the most sensitive images on your phone. It deserves the same scrutiny you give your banking app or your password manager. Most people never think about where their scanned documents go, and most OCR apps take advantage of that by quietly routing everything through cloud servers.

Start with the airplane mode test on your current app. If it fails, you know what is happening. Apple Live Text covers quick copy-paste from a single image, but it keeps no history and won’t turn a stack of pages into one searchable PDF. For that, plus batch scanning and structured cards, Textora reads the text on your iPhone, keeps cloud AI off unless you turn it on, and never sends the photo.

I build Textora. Facts about other products above are taken from their own pages and published reports; email support@textora.app if something has changed.