BingoFlow

Organize bingo cards. With BingoFlow: - Create random cards - Scan printed cards, recognized on-device first - Enter or edit cards by hand - Track cards and called numbers - Patterns: Any Line, Four Corners, X, Blackout, or house rules No signup is required; core card storage and gameplay stay on your device. Every Scan starts locally. “Allow Cloud Help” permits checks of all 24 numbers before review, now and on future scans; “No thanks” keeps marked local review until changed in Settings. Camera/ad consent or completion and Pro never grant Cloud permission. Free users may choose a rewarded ad or continue locally. Only a server-verified reward funds Cloud; server-verified Pro subscribers bypass ads. Unverified subscribers stay ad-free and local. Offline, ad failure, delayed verification, or service failure keeps local review available. BingoFlow Pro (monthly or yearly): no banner ad, ad-free Cloud Help; auto-renews until cancelled. Privacy: https://bingoflow.app/privacy Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Cloud assistance sends a metadata-stripped crop of the frozen scan frame through BingoFlow/Cloudflare to OpenAI. It contains the five number rows and printed BINGO header and may include background visible inside the scan frame. Pixels outside the frame and original photo metadata are not sent. BingoFlow does not persist Cloud-assistance images or response card values. OpenAI API data is not used to train models by default. Default abuse-monitoring logs may retain content for up to 30 days, or longer when required by law or to prevent harm. Flagged image inputs may be retained for manual child-safety review even under stricter retention controls. Help improve scanning is separately disclosed, optional, and off by default. When fully available, BingoFlow asks after camera access succeeds, before the scanner opens. “Share reviewed scans” requires an affirmative tap. The equal “No thanks” choice never affects scanning, local review, Cloud assistance, or manual entry and prevents another prompt for the current disclosure; Settings allows later opt-in or withdrawal. If configuration is incomplete, no prompt appears and nothing is collected or shared. Cloud permission alone never enables training. After separate contribution consent, an eligible reviewed and saved local or Cloud-assisted outcome may contribute 24 sanitized 112x112 grayscale number-cell crops and disclosed scan metadata to private quarantine. For a Cloud-assisted outcome, OpenAI fallback predictions are stripped; only local predictions and reviewed final labels remain, and two independent adjudications must agree or the sample stays quarantined. During upload, the private service receives the Cloudflare-provided IP address, keyed-hashes it for abuse prevention, security, deletion, status, and audit, and does not retain the raw IP address. Two separately gated OpenAI lanes: ordinary disagreement or verification may send 1–24 selected 112x112 grayscale crops, row/column and local/corrected candidate values, review kind/prompt version, and an opaque review ID. Verified-unreadable review sends each reviewer exactly one candidate-free crop, prompt version, and opaque review ID; no coordinates or number candidates; and asks readability only. Neither sends the full card, unselected crops, raw identifiers, or pseudonymous hashes. Accepted contribution crop/label data is retained for no more than 30 days. Some pseudonymous security, provenance, audit, replay, quota, abuse-control, and withdrawal-fence hashes and records may remain indefinitely; they contain no crops, labels, card values, or raw identifiers and are not training data. Withdrawal stops capture, purges known-unsent data, and requests deletion. Deletion cannot retroactively remove a sample's influence from a model already trained and released.