JustPDF privacy policy.

1. Controller and scope

Johanna Hoppe, Baccumer str.19, 49808 Lingen, Germany. Email: justpdf-support@whitoutcookies.dedyn.io. This notice covers the JustPDF app and this website. HoppeDev is the name of the independent app collection.

2. Local documents, search and preferences

Import creates a local copy of a PDF or Markdown file in the app container. Link from Files instead stores a reference, source path and access bookmark so the app can open a file at its original location. That location may be a cloud provider. The selected provider’s processing is separate from the developer’s local library.

Local library data includes document names and identifiers, file sizes and page counts, creation/import dates, folders, tags, pins and reading positions/times. PDF creation and editing process your text and document content on the device; editable documents also have local text-source files. Search extracts text from PDF pages or Markdown and can use Apple Vision OCR on pages with little embedded text. Titles and recognized page text are stored in a local SQLite full-text index. The app’s search code does not upload that index to the developer.

Reader settings, onboarding answers and onboarding/paywall state are stored locally. Onboarding answers can personalize the introduction and purchase presentation. The import counter and a hash involving the device’s identifier for vendor are used locally to check the free import allowance. These library-integrity values are not attached to the app’s purchase or bug-report payloads.

These operations provide the reading, search, organization and editing functions you choose. The developer does not receive documents through ordinary local reading. App-owned document copies and search files use iOS data protection; this is distinct from additional per-document encryption by the app. Device backups, explicitly enabled sync, sharing and export can create copies outside the app container.

3. Library lock, biometrics and failed-attempt erasure

The optional library lock stores a salted PBKDF2 backup-code hash in the device Keychain, not the plaintext code. Apple LocalAuthentication performs Face ID or Touch ID checks; JustPDF receives an authentication result, not biometric templates. Lock settings and failed-attempt state are local.

The lock is an access control, not a guarantee that every file, external original or cloud copy is protected by your app code. If you explicitly enable erase after failed attempts, the current implementation triggers library erasure after 11 incorrect attempts. It also attempts to clear the app’s iCloud library snapshot and cloud document payloads when available, including existing cloud data. This is destructive and can affect other devices; a network or storage error may prevent completion. It does not erase external originals, previously shared copies or device backups. Keychain credentials may survive an app uninstall under normal iOS behavior.

4. Optional iCloud library sync

Sync is off by default and requires Pro. When enabled, selected PDF and Markdown files and associated library metadata are written to Apple’s iCloud infrastructure using your Apple Account. The whole library, pinned documents or selected folders can be chosen. Selected readable linked files are also copied into the app’s cloud container. Metadata includes names, identifiers, folders, tags, pins, file sizes/page counts, import dates and reading state. Sync snapshots may retain deletion identifiers and timestamps to propagate deletions.

The app’s explicit sync format does not include the local full-text index or editable text-source files. Device-level backups are separate and may still include app data. There is no developer-hosted document cloud.

Current iCloud payloads use AES-GCM with a key derived from a fixed application identifier. This is not user-specific end-to-end encryption. Disabling sync does not automatically erase existing cloud copies. Removing a library record or reducing sync scope does not guarantee deletion of older cloud payload files, snapshots or backups. See Apple’s privacy policy and the iCloud storage guide.

5. Apple and RevenueCat purchase processing

Apple processes payments. JustPDF uses RevenueCat, Inc. for product retrieval, purchase validation and Pro entitlement restoration. When configured, the SDK initializes at launch and can contact servers before a purchase is made. It uses an automatically generated app user identifier and processes purchase/receipt and entitlement information, device/platform and SDK information, and technical connection data. Purchase events and last-seen information may support purchase history and sales statistics in the RevenueCat dashboard. An anonymous app identifier is not the same as no personal data.

The app’s purchase calls do not attach PDFs, Markdown contents, search texts, library tags or backup codes. The developer’s app code does not collect payment-card details. Necessary purchase and restoration processing supports contractual performance under Art. 6(1)(b) GDPR; technical security and fraud prevention support the legitimate interest in secure service operation under Art. 6(1)(f). Purchase statistics are separate from document content and require a lawful basis for their actual use.

RevenueCat states that it processes end-user data on the app provider’s behalf under the applicable customer agreement and Data Processing Addendum. Its privacy policy provides additional provider information and describes U.S. hosting. Contact the controller for questions about your JustPDF purchase data.

6. Voluntary reports and email correspondence

A bug report is sent only when you confirm submission in the app. It contains the summary and details you enter, an optional email address, app version, build number, iOS version, device model, document count and submission time. A Netlify function forwards it to a Discord webhook. The report is not a direct private message to the developer; the providers and people with access to the receiving Discord channel can receive its contents. PDFs, Markdown files and search-index text are not automatically attached. Do not enter confidential document contents or passwords in the report.

Reports and email are used to answer requests and diagnose problems, based on Art. 6(1)(b) GDPR for contractual support or Art. 6(1)(f) for other correspondence and the legitimate interest in resolving reported issues. Report text is needed to process the report; an email address is voluntary, and without it an individual reply may not be possible. You can use the support email instead of the in-app report. Email is handled by the controller’s email service provider, which also processes delivery and connection information.

Reports and correspondence are retained while needed to investigate, respond and handle any related claims or statutory duties. Providers may retain technical logs or backups separately. For their own service processing, see Discord’s privacy policy and Netlify’s privacy statement.

7. Website hosting and external links

Netlify hosts this static website. Requests involve connection data such as IP address, request time, requested URL, browser information, referring page where transmitted and response status. Secure and stable delivery is a legitimate interest under Art. 6(1)(f) GDPR. This website embeds no analytics or advertising scripts, third-party fonts or non-essential cookies. Images and fonts are served from this site; no browser-language redirect or stored language preference is used.

Following an external link, including App Store or a link in a document opened in the app, sends a request to the linked provider. Its privacy practices then apply. The website does not embed the App Store as a tracking widget. Netlify’s general policy describes its own controller activities; customer hosting processing is also subject to its applicable Data Processing Agreement.

8. Recipients, transfers and retention criteria

Recipients include Apple for purchases and optional iCloud; RevenueCat, Inc. for purchase management; Netlify for hosting and report delivery; Discord for submitted reports; and the email service provider for correspondence. Additional file providers and sharing recipients are involved when you choose them. Their actual contract roles and processing depend on the service and account arrangement.

Data may be processed outside the EU/EEA, including in the United States. Provider documents describe mechanisms such as standard contractual clauses or applicable adequacy decisions. The safeguard applicable to a particular service must be established under the actual provider agreement; publication of this notice alone does not create one. You may request information and a copy of applicable safeguards from the controller.

Local documents, source files, preferences and indexes remain according to your app/device actions. Cloud copies, deletion markers and device backups follow the corresponding service and storage settings. Purchase information is retained as required for validation, restoration and applicable legal duties. Support retention depends on handling the request and related claims; technical logs depend on service and security requirements. No unverified fixed provider retention period is promised.

9. Your rights and automated purchase checks

Where the GDPR applies, you may request access, rectification, erasure, restriction and portability where applicable. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it for the future without affecting the lawfulness of earlier processing. Contact justpdf-support@whitoutcookies.dedyn.io. You may complain to a competent authority, including the Lower Saxony data protection authority.

Pro access is checked automatically using purchase entitlement information. A missing or unrecognized entitlement can restrict paid features. Use Restore Purchases or contact support if a valid purchase is not recognized. This is separate from local document search and OCR. The developer cannot access every local file or third-party copy on your behalf; those are managed on the device or with the relevant provider.

10. Practical privacy and deletion choices

• Use Import for local copies; Link from Files may use an external or cloud source.
• Leave iCloud sync off to avoid the app’s optional library upload. Switching it off does not remove copies already uploaded.
• Deleting a document removes its app-owned copy and schedules removal from the local index; linked originals are not deleted. Ordinary deletion is not a promise of forensic erasure of SQLite pages, cloud payloads or backups.
• Keep important originals separately. Reader export and encrypted transfer require Pro; restoring Pro does not recover deleted files.
• For purchase or support data, contact the controller. Do not send full PDFs or payment-card details to make an erasure request.

Providing purchase information is necessary to validate paid access; without it a purchase or restoration may not be verifiable. Bug reporting and iCloud sync are optional and are not required to read an imported local document. Local app preferences and Keychain entries are distinct from website cookies.

11. Sharing and encrypted transfer files

Pro export can share a normal PDF through the iOS share sheet without adding an app-level transfer password. The separate encrypted-transfer feature creates a .justpdf archive containing PDF data, document names and creation dates. Its current format uses AES-GCM and a key derived with PBKDF2 from an 8-digit transfer code and random salt. Legacy transfers use a 6-digit code. Code protection is separate from the library lock and iCloud format; a short numeric code is not an unlimited-strength security guarantee.

Anyone with the transfer file and correct code can decrypt it. Send the code through a different channel and store exported files carefully. Temporary transfer files are removed when the view cleans them up or the app clears its temporary transfer directory on a later launch; copies already sent to another app, person or storage provider remain outside JustPDF’s control. Imported transfer documents are stored as normal local PDF copies.