Last updated 30 September 2026
Scanibio is a lab inventory app. You put a QR sticker on a tube, a box, a cage or a slide, and scanning it opens that record.
This page says what the app stores, why it stores it, and who else can see it. It is written to be read rather than to be legally impressive, and it describes what the app actually does today.
Scanibio does not contain any advertising, analytics or tracking software. Nothing you record is sold, shared for advertising, or used to build a profile of you. There is no third-party analytics SDK in the app — not a reduced one, none at all.
Scanibio is built and run by an individual — a researcher based in Hyderabad, India — not a company, with help from a colleague. It is free while in testing with a small number of labs. Paid plans are planned; if they arrive you will be told inside the app, and the terms for any paid feature will be shown before you pay for it.
For anything about your data — a request to see, correct, export or delete it, or a complaint about how it is handled — write to scanibio.app@gmail.com. This is also the grievance contact for the purposes of India's Digital Personal Data Protection Act, 2023.
Where your data is kept: Scanibio's database and files are hosted in India (a Mumbai data centre). If you use Scanibio from outside India, your information is handled there — see If you are outside India below.
Your email address and your name, so you can sign in and so your colleagues can see who recorded what. Your password is never stored in a form anyone can read — it is hashed by our authentication provider, and it is not visible to the developer.
Everything you type into the app: samples, vials, boxes, plates, cultures, reagents, animals, slides, machine bookings, notes, checklists and reminders — along with any photos or files you attach. This is the point of the app; it is stored so it is there when you scan the sticker.
When something is added, used, edited or removed, Scanibio records what changed, when, and who did it. This is what makes a shared lab record trustworthy — without it, nobody can tell who took the last vial.
Messages you send to other people in the app, including any pictures, files or voice notes attached to them, are stored so they can be delivered and read later. They are not end-to-end encrypted.
If you turn notifications on, the app stores a notification address for that device (a token issued by Google). It identifies a device, not you, and it is used only to deliver notifications from Scanibio. Signing out removes it.
Like any website or app, connections carry an IP address and basic device information, handled by the services listed below in the ordinary course of serving the app. Scanibio does not log these itself for its own purposes.
When something goes wrong in the app — it crashes, or a save does not go through — the app sends a short error report: which part of the app was open, the error message, the technical trace, the type of device or browser, and which version of the app was running. It is linked to your account so repeated problems can be counted per person. It does not include what you typed or the contents of your records. Error reports are stored with the rest of Scanibio's data, cannot be read from inside the app by anybody, and are used only to find and fix problems.
| Permission | What it is for |
|---|---|
| Camera | Scanning QR stickers, and photographing samples when you choose to. The camera view is not recorded. An image is only stored if you attach it to a record. |
| Microphone | Dictation — speaking instead of typing into a note. Only while you are holding the dictate button. See the note below about where speech goes. |
| Photos | Choosing an existing picture to attach to a record. Scanibio can only see the images you pick. |
| Notifications | Telling you about a message or a reminder that is due. |
About dictation, said plainly: Scanibio does not do speech recognition itself. It hands the audio to the speech service built into your device or browser — on Android that is normally Google's, and on a computer it is your browser's. That means your speech may be sent to that provider and is subject to their privacy policy, not this one. If you would rather that did not happen, do not use dictation; every field it fills can be typed.
Scanibio uses a small number of services to run. They process data on its behalf and are not permitted to use it for their own purposes.
| Service | What it does |
|---|---|
| Supabase | Stores the database, your account and your uploaded files. |
| Expo and Google Firebase Cloud Messaging | Deliver notifications to your phone. The sender's name and a short preview of the message pass through them. |
| Resend | Sends account emails — confirming an address, resetting a password. |
| Netlify | Hosts the website at scanibio.com. |
| Your device or browser's speech service | Turns dictated speech into text. See above. |
Your records are private by default. Nobody else can see them unless you decide otherwise. Three things can change that, and all three are your choice:
Every one of these rules is enforced by the database itself, not just by the app's screens.
No system is perfect, and this is said without dressing it up: Scanibio is a small project, and you should not store anything in it that would be seriously harmful if it were exposed.
What you record is kept until you delete it. You can delete individual records at any time.
You can close your account from inside the app — your profile page, at the bottom. Doing so removes your account and the records belonging to it.
Two things survive, and they are worth knowing before you press it:
If you would rather ask than do it yourself, email scanibio.app@gmail.com.
You can see everything Scanibio holds about you inside the app — it is your own records. You can correct it, export it (records export to a spreadsheet), and delete it. Under India's Digital Personal Data Protection Act you also have the right to access your data, to correction and erasure, to nominate someone to act for you, and to complain to the grievance contact above and, if unresolved, to the Data Protection Board of India. If a law elsewhere gives you a formal right to access or erasure, write to the address above and it will be honoured.
Scanibio stores data in India, so using it from another country means your information is transferred to and held in India. If you are in the UK, EU or EEA, that transfer is made under the standard data-protection clauses offered by the services listed above (Supabase and the others), which contractually require your data to be protected to the standard you are used to. You keep all your rights under the UK GDPR / GDPR — access, correction, erasure, portability and objection — by writing to the address above. If you would rather your data not be held in India, please do not create an account.
Scanibio is a tool for laboratory work and is not directed at children. It is for people aged 18 and over, and accounts are not knowingly created for anyone younger. When you create an account you confirm that you are at least 18.
If what the app does changes, this page changes with it, and the date at the top moves. Anything that materially changes what is collected or who sees it will be said in the app as well, not only here.