Privacy policy

In short

Your documents never leave your device. We have no servers, there are no accounts, no file is ever uploaded and nobody but you can read them. Everything the app does with them — reading them, sorting them, searching inside them, recognising text — happens on the phone.

The only copy that can leave your phone is the system’s own backup — Google’s on Android, iCloud on iPhone — if you have it turned on. The operating system makes it with the phone’s account, not the app; it is explained below.

We have no servers and keep no data about you. What does go online are three third-party components, and we would rather say so up here than bury it in the small print:

• Advertising (Google AdMob), which uses your device’s advertising identifier and an approximate location. In Europe you are asked first; on iPhone, the system asks your permission before that identifier is used. You can change your mind at any time from Settings.
• Updates (Expo): when it opens, the app checks whether a fixed version is available, using a random installation ID that does not say who you are.
• Text recognition for scanned PDFs on Android (Google ML Kit), which sends Google technical diagnostics about its own operation.

None of them receives your documents, their contents or their names. All three are detailed below.

What data is collected

By us: nothing that identifies you

We do not collect, transmit or store outside your device:

• Your documents or their contents
• Your name, email address or any identifying data
• Crash reports or a record of what you do in the app
• Your location

There is no sign-up form because the app has no accounts, and we have no servers of our own. The only thing that reaches an account of ours is a count: Expo tells us how many installations have downloaded each update, counted with that random ID.

By third parties

Advertising is served by Google AdMob, which uses your device’s advertising identifier, technical data, data about your interaction with the ads themselves and an approximate location derived from your IP address — not GPS. The update check sends Expo the random installation ID, the platform and the installed version. On Android, the text recognition library also sends technical diagnostics about its own use.

What matters: neither AdMob, nor Expo, nor any other library receives your documents, their contents, their names or the categories the app assigns them. The ads you see bear no relation to what you keep here.

What the app does with your PDFs

When you add a document, PDF Inbox makes a copy in its own private folder. The original file is never modified or deleted. On that copy, and only inside your device, it:

• Reads the PDF’s text layer so you can search its contents.
• If the PDF is a scanned image, recognises its text with the device’s own engine: Vision on iPhone and iPad, ML Kit with the model bundled into the app on Android. Neither the image nor the recognised text is sent to any server.
• Sorts the document by comparing its text against a dictionary bundled with the app. No external artificial intelligence service is involved.
• Detects data such as the amount, the date, the tax ID, the IBAN, policy or contract numbers and number plates using patterns, to show them on the document’s page.

Your phone’s own backups

Android and iOS back up app data on their own, using the account the phone is set up with, and PDF Inbox does not block it. So, if you have the system backup turned on, it may include the app’s library: its copies of your PDFs and what it has extracted from them.

• Android: Google’s backup is stored in your Google account, encrypted with your phone’s lock-screen PIN, pattern or password, so not even Google can read it. It does not appear as files in Google Drive and is only used to restore the app on a phone with your account. Android skips it if the app’s data takes up more than 25 MB.
• iPhone: the iCloud backup is stored encrypted in your Apple account. With iCloud Advanced Data Protection turned on, not even Apple can read it.

PDF Inbox does not make it and we never receive it: the operating system handles it with your account. You can turn it off in your phone’s settings (on Android, usually Settings → Google → Backup; on iPhone, in the iCloud settings, where you can also exclude just this app).

Third parties

The app integrates no crash reporting, no social networks and no analytics of its own. There are no accounts and we build no profile of you.

Google AdMob — advertising

• Your documents, your images and the recognised text are NOT sent anywhere.
• AdMob uses the advertising identifier, technical device data, an approximate location from your IP and data about how you interact with the ads themselves.
• If you are in the European Economic Area, a consent form appears before anything is shown. You may refuse personalised advertising: you will still see ads, but not based on your profile.
• On iPhone, the system also asks whether you allow tracking before the ads can use the advertising identifier. If you do not, that identifier is not used.
• You can change your mind at any time in Settings → Privacy → “Change my preferences”. Withdrawing consent is as easy as giving it.

Google ML Kit — text recognition, Android only

• Recognition happens entirely on your phone, offline, using the model bundled inside the app.
• That library does send Google technical diagnostics about its own use: which functions ran, how long they took, whether they failed and with what code, along with device data. It is a feature of Google’s library, not ours, and it cannot be switched off without giving up text recognition.
• We tell you because we would rather you knew than found out: we spotted it ourselves while reviewing the permissions declared by our own compiled package.
• This does not happen on iPhone or iPad: there the engine is Vision, it ships with the operating system and sends nothing.

Both Google components are governed by Google’s privacy policy.

Expo — updates

• So that fixes arrive without reinstalling, the app checks Expo’s update service for a new version when it opens.
• That request carries a random installation ID — generated on your device, unrelated to your name or to the advertising identifier, and replaced if you reinstall the app — plus the platform and the installed version.
• With it, Expo shows us how many installations have received each update. No document, and nothing about your documents, is sent.

It is governed by Expo’s privacy policy. The app’s other libraries work entirely on the device.

International transfers

Google and Expo are United States companies, so the data described under “Third parties” — never your documents — may be processed outside the European Economic Area.

Both state that they participate in the EU-U.S. Data Privacy Framework, with its UK Extension and the Swiss-U.S. framework, which the European Commission recognises as ensuring an adequate level of protection. Where needed, they also rely on the standard contractual clauses approved by the Commission. They explain it on their own pages: Google and Expo.

Permissions

Android — all files access

Optional and requested in the moment, never at install time. It serves one purpose: finding the PDFs you already have on the phone and copying them into the library. No other file types are read and nothing found leaves the device. If you decline, you can still add documents with the system picker.

Android — internet and network state

Used by the advertising, the update check and the diagnostics described above. The app never uploads your files or queries any service with them, and it works the same in airplane mode: offline there are no ads and no updates, and everything else carries on as usual.

Android — advertising identifier

Declared by the Google AdMob SDK to serve ads. You can reset or delete it in Android’s settings.

iOS — file access

iOS asks for permission only when you pick a file or a folder with the system picker. Access is limited to what you chose.

Children

The app is not directed at children under 13 and does not knowingly collect data from them. Advertising is configured to show general audience content only.

Your rights

Since we keep no data about you on any server, there is nothing we could rectify, export or erase on your behalf: everything is on your device and you control it. Uninstalling the app deletes the entire library. What Google (advertising and diagnostics) and Expo (updates) process is governed by their own policies, linked above. From your device you can change your advertising consent in Settings → Privacy, and reset or disable the advertising identifier — or refuse tracking on iPhone — in the system settings.

Contact

Any questions about this policy: info@pdfinbox.app.