Privacy Policy

Last updated: October 28, 2026

Setout Labs, LLC ("we", "us") operates the ClearFax application for iOS and Android and this website (the "Service"). This Privacy Policy explains what data we handle, why, who we share it with, and the choices you have. In plain terms: your documents are yours. We never sell your data and we never use it to target ads.

We align this Policy with the Apple App Store Review Guidelines (including Guideline 5.1) and the Google Play Developer Program Policies (including the User Data policy). By using ClearFax, you agree to the practices described here. If you do not agree, please discontinue use of the Service.

No account, no sign-in

ClearFax has no accounts. There is nothing to register, no password, no profile, and no email address collected in order to use the app. We do not ask for your name or create an account identity. When product analytics is enabled, the app uses a random, persistent installation identifier so events from one installation can be understood together. If Apple or Google Play authorizes a purchase, we may link that identifier to the authorization and related fax-job outcomes. This identifier is pseudonymous, but it is linked to an installation and is not anonymous data.

Data we handle

We handle the data needed to transmit a fax, hand back a receipt, and improve the app.

The pages you send

You can scan pages with the camera or import files you already have. On iOS, camera access is optional: the app asks for it only when you scan, and you can build a fax entirely from imported files without ever granting it. On Android, ClearFax does not request camera permission: scanning uses Google's document scanner, which runs in Google Play services on your device and hands ClearFax only the finished page images. ClearFax does not read your photo library. Imports go through the system document picker, which hands us only the files you pick. On Android, you can also share PDFs and images to ClearFax from another app; only the files you share are added to your fax. Your pages stay on your device except as part of a send: when you send, the selected pages are assembled into a PDF packet with a cover sheet and uploaded to our server so it can be transmitted.

The destination number and cover sheet details

We handle the fax number you enter, which is needed to transmit the fax, and the recipient name if you pick one from your contacts, which is printed on the cover sheet. The system contact picker hands us only the contact you choose; ClearFax never reads your contact list.

Job records

We store a record of each send: its status, page count, timestamps, the destination number, a fingerprint (hash) of the document packet, the name of our fax provider and its identifier for the job, a log of the status updates for the send, and a support code you can quote to us. This is what produces your receipt.

Crash and error diagnostics

ClearFax reports crashes and errors to Sentry so we can fix them. Those reports include technical context such as device model, operating system version, app version, and stack traces, along with a random installation identifier that Sentry generates on your device. Sentry also receives app session data (when a session starts and ends and whether it crashed) and performance traces that time app activity. This identifier is separate from the analytics identifier and is not anonymous: it links reports from the same installation. Reports never include the contents of your pages: ClearFax attaches no screenshots and no view hierarchy to a crash report. A file name or a file path can appear in the technical context of an error.

When product analytics is enabled, ClearFax uses Mixpanel for limited product analytics. It receives events such as launches, screens viewed, checkout and bounded purchase outcomes, transmission outcomes, and receipt views, along with a persistent installation identifier and technical device and app information such as device model, operating system, app version, mobile carrier, and network type. Mixpanel does not receive fax contents, file names, fax or phone numbers, recipient names, email addresses, raw transaction details, provider identifiers, or support credentials. Our operational backend still handles the information needed to send a fax and maintain its receipt. Mixpanel is configured not to derive location from IP addresses.

Purchases

Sends are one-time in-app purchases processed by Apple on iOS and by Google Play on Android. Apple shares a transaction identifier and the product you bought so we can authorize one successful transmission. On Android, the app sends us the Google Play purchase token and the product you bought; our server verifies the token with Google Play, then completes the purchase with Google Play. We store the transaction identifier or purchase token, the product, its price, and whether it was a test purchase. We never receive your payment card details. For product analytics, we record a bounded purchase outcome, product tier, and observed or verified price and currency where available. These values do not state Setout Labs, LLC's revenue or proceeds.

Apple Ads attribution

On iOS, when product analytics is enabled, ClearFax may use Apple's AdServices framework to learn whether an installation was attributed to an Apple Ads campaign. We send the raw AdServices token to our server to exchange it with Apple, and send only normalized attribution results to Mixpanel. We include campaign details only when Apple reports an attribution. We do not access the advertising identifier, request App Tracking Transparency permission for this feature, show ads, or use this data to follow you across other companies' apps or websites. The Android app does not use Apple Ads attribution and does not access the Android advertising ID.

Support

When you email support, we receive what you send us, including any attachments and the address you write from, so we can respond.

We do not intentionally collect precise location, contacts, or other sensitive data unless you include it in something you choose to send us.

How we use it

To assemble your pages into a packet and transmit them to the number you entered.
To report the transmission status and produce your receipt.
To process and verify one-time purchases through Apple or Google Play.
When product analytics is enabled, to understand app use, purchase outcomes, and transmission outcomes.
When product analytics is enabled, to measure whether Apple Ads campaigns lead to authorized purchases and successful transmissions.
To keep the Service secure, diagnose failures, and provide support.
To comply with law and enforce our Terms.

Who we share it with

We do not sell or rent your data. The providers relevant to app operation and analytics are:

Supabase, which hosts our file storage, database, and edge functions; holds the packet and job record while a send is in progress; and may hold the analytics installation identifier and normalized Apple Ads attribution linked to an authorization and fax job.
Telnyx, our fax provider, which receives the document packet and destination fax number to transmit the fax. Your document leaves our infrastructure to reach the fax network.
Sentry, which receives crash and error diagnostics, session data, and performance traces.
Mixpanel, which receives the limited product analytics described above.
Vercel, which hosts this website and provides Vercel Web Analytics for it: aggregated page-view statistics (page, referrer, campaign parameters, country, device type and browser). It uses no cookies and stores no personal information.
Apple, which processes App Store purchases and supplies Apple Ads attribution through AdServices when available.
Google, which processes Google Play purchases and verifies them for our server, and whose Google Play services provide the Android document scanner.

We may disclose information to comply with law, protect our rights, prevent harm, or in connection with a corporate transaction such as a merger or acquisition.

Legal bases (EEA/UK)

If you are in the EEA or UK, we process personal data under these bases:

Contract: to transmit the fax you asked us to send and to give you a receipt.
Legitimate interests: to keep ClearFax secure and working, where those interests are not overridden by your rights.
Legitimate interests: to run the limited product analytics and Apple Ads measurement described above, so we can see whether sends succeed and improve the app. You can object to this processing at any time by contacting us.
Legal obligations: to meet accounting, tax, and regulatory requirements.

Retention

The document packet is deleted from our server as soon as the fax reaches a final status, and within 7 days at the latest. A packet you uploaded but never sent is deleted within 24 hours.

To put the fax on the network, our fax provider also holds a copy of the packet. We upload that copy with a 1-hour expiry. Any records the provider keeps about the fax itself follow its own schedule, which we do not control and cannot shorten.

Your receipt PDF is saved to your device at the end of a send, so it is yours to keep. Our copy of it is deleted after 7 days.

Status messages our fax provider sends us about a fax, which include the fax numbers involved, are deleted after 7 days.

Mixpanel's standard retention for events is currently 2 years from the event date. This applies to Mixpanel events only; it does not automatically delete copies held in our backend.

Our backend retains authorization, job, and attribution records indefinitely unless we delete them in response to a support request or when applicable obligations require it. Job records include status, page count, timestamps, the destination number, a fingerprint (hash) of the document packet, the name of our fax provider and its identifier for the job, the log of status updates for the send, and the support code. They hold no pages and no copy of the packet.

International transfers

We store and process data in the United States and other countries where our providers operate. When personal data is transferred internationally, we rely on safeguards such as Standard Contractual Clauses where required. By using ClearFax, you understand that your data may be transferred to jurisdictions with different data-protection rules than your home country.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or port personal data we hold about you, or to object to or restrict certain processing. Because ClearFax has no accounts, we cannot look up your data by email alone. Email support@clearfax.app with your request. A support code, if you have one, helps us locate the send and its purchase record. A support code cannot locate analytics or crash reports, which are keyed to random installation identifiers the app does not show you. Your receipt PDF lives on your device, where we cannot reach it. We do not sell or share personal data for cross-context behavioral advertising, and we do not discriminate against you for exercising these rights.

Children

ClearFax is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data. If we learn we have, we will delete it. Parents or guardians who believe a child has provided data should contact us.

Security

We use safeguards including encryption in transit, access controls, and monitoring to protect your data. No system is perfectly secure. Note also that fax rides the public telephone network, which is outside our control, and that a fax arrives at whatever machine or service answers the number you entered. Check the number before you send.

Changes

We may update this Policy as the product evolves. For material changes we will give notice in the app before they take effect, and we will revise the date above. Continuing to use ClearFax after changes take effect means you accept the revised Policy.

Governing law

This Policy is governed by the laws of the State of Delaware, United States, except where mandatory local data-protection law applies.

Contact

Setout Labs, LLC is the controller of your personal data. Email support@clearfax.app with any questions or requests. If you have unresolved privacy concerns, you may also contact your local data protection authority.