Privacy Policy

1. Introduction

ParsleyPDF Team ("we," "our," or "us") operates ParsleyPDF, a mobile application that uses artificial intelligence to help you understand PDF documents. We are based in Ireland and committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Children's Online Privacy Protection Act (COPPA).

This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

2.1 Anonymous Authentication Identifier

When you first open ParsleyPDF, we create an anonymous authentication session using Firebase Authentication. This generates a random user identifier (UID) that is not linked to your name, email, or any personal account. This UID is used solely to authenticate API requests and enforce usage limits.

2.2 Purchase Data

If you subscribe to ParsleyPDF Pro (Monthly or Weekly), your subscription is processed through Apple's In-App Purchase system and managed by RevenueCat, our subscription infrastructure provider. We receive:

• A RevenueCat app user ID (derived from your anonymous UID)
• Subscription status (active, expired, or grace period)
• Subscription tier (free, Pro Weekly, or Pro Monthly)

We do not receive your Apple ID, payment method, billing address, or any financial details. Apple handles all payment processing directly.

2.3 Document Content (Ephemeral Processing Only)

When you use AI features — including chat, document summaries, and quizzes — the text content of your document is sent to our servers for processing by Google's Gemini AI. Before any data is sent, you will be asked to provide explicit consent within the app. You may revoke this consent at any time in Settings. This data is:

• Transmitted over encrypted connections (HTTPS)
• May be temporarily cached on Google's servers to improve performance, then automatically deleted
• Never used for AI model training
• Never permanently stored — cached data expires and is deleted automatically

Along with document content, we send your chat message, recent conversation history (up to 10 messages), and your RevenueCat app user ID (for subscription verification).

2.4 Anti-Abuse Counters

To enforce the daily usage limits described in Section 5.3 and prevent automated abuse, we maintain anti-abuse counters in two separate locations. We disclose both below.

2.4.1 On-device counters (iOS Keychain)

Stored locally on your device and used for in-app display (for example, the "Questions today: N of M" row in Settings):

• PDF import count
• Quiz generation count
• Daily AI query count
• First install date
• Device fingerprint — a SHA-256 hash of your device's Identifier for Vendor (IDFV) combined with your install date. The hash is stored on your device only and is never transmitted to our servers, any third party, or used for any purpose other than detecting app reinstalls that attempt to reset your anti-abuse counters. The raw IDFV itself is never stored. We do not use IDFA, MAC addresses, advertising identifiers, or any other persistent hardware identifier.
• Whether you were ever a Pro subscriber

These on-device counters are encrypted by iOS at rest, persist across app reinstalls, and are not synced to iCloud. They are not transmitted to our servers as a payload field.

2.4.2 Server-side counter (Google Cloud Firestore)

Because an on-device counter can be circumvented by a modified or reinstalled app, we also maintain a server-side counter whose sole purpose is to enforce the daily query cap described in Section 5.3 and the fair-use throttle described in Section 5.3. This counter is keyed on your anonymous RevenueCat app user ID (see Section 2.2) and contains the following fields:

• A numeric count of successful AI requests you have made in your current rolling 24-hour period
• A timestamp marking when your current 24-hour period expires (Unix milliseconds, UTC)
• A list of timestamps of your AI requests made in the past 60 minutes, used solely to apply brief pacing delays to unusually heavy usage (fair-use throttle). Timestamps older than 60 minutes are automatically pruned on every request.
• An internal schema version number (no user data)

The counter contains:

• No name, email, phone number, or other personal identifier
• No document content, chat messages, or AI responses
• No IP address, device fingerprint, or hardware identifier
• No location data
• No record of what you searched, read, asked, or received — only that a request occurred at a given moment

Your 24-hour quota resets automatically 24 hours after your first counted request of each period, giving every user an identical quota worldwide regardless of timezone. The underlying record persists while you continue to use the app. It is not shared with, sold to, or otherwise disclosed to any third party. It is not used for advertising, profiling, analytics, or any purpose other than enforcing the Section 5.3 daily cap and fair-use throttle.

This server-side counter is not considered "tracking" under Apple's App Tracking Transparency framework, because it is not combined with data from any other app, website, or third-party data broker.

2.5 Information We Do NOT Collect

• We do not track you across apps or websites
• We do not collect your name, email, phone number, or physical address
• We do not use advertising identifiers
• We do not use analytics or crash reporting SDKs
• We do not collect location data
• We do not access your contacts, photos, or other device data
• We do not build user profiles or behavioral models from your anti-abuse counter
• We do not retain document content, chat messages, or AI responses on our servers beyond the duration of a single request

3. How We Use Your Information

We do not use your data for advertising, profiling, or automated decision-making.

4. Third-Party Services

No third-party service receives your documents for storage or training purposes.

Google, as our AI processing provider, provides the same or equal level of protection for your data as described in this Privacy Policy. Specifically, Google processes your document content through the Gemini API — it may be temporarily cached to improve performance, then automatically deleted. It is never used for model training.

5. Data Storage & Security

5.1 On-Device Storage

Your PDF documents and all associated data (chat history, summaries, quiz results) are stored exclusively on your device using:

• SwiftData — Apple's local database framework, stored in your app's sandboxed container
• iOS File Protection — your data is encrypted at rest using your device passcode

Documents are never uploaded to or stored on our servers.

5.2 Keychain Storage

Anti-abuse counters are stored in the iOS Keychain with kSecAttrAccessibleAfterFirstUnlock protection. This data:

• Is encrypted by iOS
• Is not synced to iCloud Keychain
• Persists across app reinstalls (by design, for anti-abuse)

5.3 Server-Side Security

Our Cloud Functions run on Google Cloud (us-central1 region) with:

• Firebase App Check enforcement (Apple App Attest)
• Tier-aware daily usage caps (20 requests/day free, 50 requests/day Pro Weekly, 100 requests/day Pro Monthly), server-enforced per anonymous RevenueCat subscriber ID via the Firestore counter described in Section 2.4.2, using a rolling 24-hour window. Requests beyond the cap return a resource-exhausted error until enough of your recent requests have aged past 24 hours.
• Fair-use throttling (brief automatic delays for unusually high-volume usage patterns — see Section 4.6 of the Terms of Use for details)
• No server-side database or persistent storage for user content

6. Data Retention

7. Children's Privacy

ParsleyPDF is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. Because we use anonymous authentication with no personal data collection, there is minimal risk. However, if you believe a child under 13 is using the app inappropriately, please contact us and we will take appropriate action.

Our age minimum of 13 complies with:

• COPPA (United States) — 13 years
• GDPR Article 8 (EU) — 13-16 years depending on member state (Ireland: 16 for consent-based processing, but ParsleyPDF relies on legitimate interest and contract performance, not consent)

8. Your Rights

8.1 GDPR Rights (EU/EEA Users)

Under the GDPR, you have the right to:

• Access — request a copy of data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request limited processing of your data
• Data portability — receive your data in a portable format
• Object — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent

Because ParsleyPDF uses anonymous authentication and stores documents only on your device, most data is already under your direct control.

8.2 CCPA Rights (California Users)

Under the CCPA, California residents have the right to:

• Know what personal information is collected and how it is used
• Delete personal information held by businesses
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising CCPA rights

9. Data Deletion

9.1 Deleting Your Documents

Delete individual documents within the app. This permanently removes the document and all associated data (chat history, summary, quiz results) from your device.

9.2 Deleting All Data

Uninstalling ParsleyPDF removes all app data from your device, including:

• All imported PDFs
• All chat conversations, summaries, and quiz results
• All local SwiftData database content

Note: Keychain data (anti-abuse counters) persists after uninstall by iOS design. To remove it, go to iOS Settings > General > Transfer or Reset iPhone > Reset All Settings.

9.3 Anonymous Authentication

Your anonymous Firebase authentication session expires automatically after 90 days of inactivity. No action is required.

9.4 Subscription Data

To cancel your subscription, go to Settings > Apple ID > Subscriptions, or use the link in ParsleyPDF's Settings tab. RevenueCat retains subscription transaction data per their privacy policy and Apple's requirements.

10. International Data Transfers

ParsleyPDF's Cloud Functions and the server-side anti-abuse counter (Cloud Firestore) are hosted on Google Cloud in the us-central1 (Iowa, USA) region. No data we hold leaves this region. When you use AI features, your document content is transmitted to US-based servers for ephemeral processing.

For EU/EEA users, this transfer is governed by:

• Google Cloud's Standard Contractual Clauses (SCCs) and GDPR Data Processing Terms
• The ephemeral nature of processing (no data is stored in the US)

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date at the top of this page
• Displaying a notice within the app for significant changes

Your continued use of ParsleyPDF after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

ParsleyPDF Team
Email: tezaapps@gmail.com

For GDPR-related inquiries, you also have the right to lodge a complaint with your local data protection authority. In Ireland, this is the Data Protection Commission.