Every scanner says it “saves your scans”. Almost none say where. That one omission decides whether the file shows up in Files by Google, whether another app can read it, and whether it survives an uninstall.
On Android there are two real answers, and they are not a setting you can switch inside the app.
What are the two places an Android app can save a file?
App-private storage. The app’s own directory, inside its private data area. No file manager can browse it, no other app can read it, and Android removes it when the app is uninstalled. It is the easiest place to write and the most protected place to keep a file.
Shared storage. A public folder such as Documents, Downloads or Pictures, or a media-store collection. Any app with the right access can read it, file managers show it, USB transfer sees it, and cloud backup may copy it. It is the easiest place to find a file and the least private place to keep one.
A scanner picks one. Some let you choose; many do not say which they chose. The tell is simple: if the PDF appears in Files by Google, it is in shared storage.
Why do scanners choose a private vault?
Because it makes a promise easier. If documents never enter shared storage, the app can say that no other app can read them, that there is no folder to accidentally sync, and that nothing is exposed by a file manager. It also avoids Android’s storage permissions entirely — an app that only writes inside its own directory needs no shared-storage access at all.
The cost is that the file is not really yours in the way a file in Documents is. You cannot copy it with a cable without opening the app, you cannot back it up by backing up a folder, and an uninstall can take it with it.
How does ScanLocker store documents?
ScanLocker uses the private vault. Scans go into a ScanLocker folder inside the app’s documents directory, with default subfolders for Receipts, IDs and Business Cards. The Android manifest declares no shared-storage permission, and the app has no account and no cloud sync.
Three consequences follow, and they are worth saying plainly:
- You will not find the PDF in Files by Google. It is not in the media store, so no file manager can list it. That is the design, not a bug.
- Getting a copy out means an explicit action. Share, export or print hands the file to the system share sheet. Once it leaves, it is a normal file wherever you sent it — and its privacy is now that destination’s problem.
- An uninstall normally removes the vault. Android’s auto-backup may restore some app data, but you should not plan around it. If the documents matter, make a copy before you uninstall, reset or change phones.
What is the backup story if there is no cloud?
A private vault needs a portable copy, or it is a hostage situation. ScanLocker’s answer is a local backup file: an encrypted .scanlocker-backup created in temporary storage and handed to the system share sheet. The encryption is AES-256-GCM with a key derived from your password, and the app does not upload the file anywhere.
Where it goes is your decision — an SD card, a laptop, a cloud drive you already use. That last one is worth being precise about: if you choose to send the backup to Drive, that is your upload, not the app’s, and the file is encrypted before it leaves. The app has no Drive integration and no server of its own.
How can you tell which kind of scanner you have?
Three tests, in order of speed:
- Scan a page, then open Files by Google and look in Documents. If it is there, the scanner uses shared storage. If it is not, it is private.
- Check the app’s permissions. A scanner with no storage permission cannot be writing to a public folder.
MANAGE_EXTERNAL_STORAGE,READ_EXTERNAL_STORAGEorWRITE_EXTERNAL_STORAGEin the listing is a hint, though modern apps can use the media store without them. - Look for an export or share action. A private-vault app has to have one, because it is the only way out. A public-folder app may not bother.
None of this makes one design wrong. A public folder is better if you treat scans as ordinary files and back them up yourself. A private vault is better if you treat them as sensitive and would rather they were not browsable. The mistake is assuming you got one when you got the other.
If the document is sensitive, the storage question is only half of it: how to password-protect a PDF on Android covers the encryption side, and what “no page limit” actually means covers the limits that listings usually hide. If you are still choosing the scanner, the Android document scanner comparison covers which apps encrypt locally and which upload first.