GLOBAL PRIVACY POLICY (GDPR, KVKK & CCPA/CPRA)

Last updated: October 2026

1. Who We Are and What This Covers

This Privacy Policy explains how Core PDF Converter (the “Application”) handles information. The Application is published by an independent developer (“we”, “us”); our contact e-mail address is at the end of this text. It follows the EU General Data Protection Regulation (GDPR) and the UK GDPR, the Turkish Personal Data Protection Law No. 6698 (KVKK), the California Consumer Privacy Act as amended (CCPA/CPRA) and the privacy laws of other US states. In short: your documents stay on your device, we run no servers and no accounts, and the little information that reaches us outside the Application is listed under “Purchases” and “Contacting Us”.

2. No Data Collection

Core PDF Converter does not collect, transmit or store personal data on any server. It has no user accounts, contains no advertising, analytics or tracking software, and does not hold the Android INTERNET permission, so the operating system itself prevents the Application from sending your documents, images, text, file names or any other data over the network. We use no cookies or advertising identifiers, and we do not sell or share personal data.

3. On-Device Processing, Security and Your Responsibility

All conversion, compression, merging, splitting, watermarking and text recognition (OCR) run on your device. Temporary working copies are kept in the Application’s private storage, protected with a key held in the Android Keystore where the device supports it, and are deleted when the task ends or the next time the Application starts. The Application excludes its data from Android backup and device-to-device transfer.

Because your documents never reach us, we can neither see nor control them. We are therefore neither the controller nor the processor of what your documents contain: you decide what to process and remain responsible for having the right to process it, including any personal data of other people in it.

4. Camera, Photos and Files

Scanning uses your phone’s camera. When you open the scanner, Core PDF Converter asks Android for the camera permission and uses it only to scan: the live picture is analysed on your device to find the page and take the shot, is never recorded, stored or sent anywhere, and only the finished pages you confirm are kept. If you decline, you can scan with Google’s ML Kit Document Scanner instead, which runs on your device inside Google Play services with its own camera access, or import pictures. Photos and PDFs are chosen with Android’s system photo picker and document picker, which give the Application only the files you select. The Application does not request access to your photo library, storage, contacts, location or microphone. Google Play services are provided by Google and run in Google’s own processes, outside this Application and its permissions; Google is responsible, under its own privacy policy, for any diagnostic information it processes about them.

5. Purchases (Google Play)

PRO subscriptions are sold and billed by Google Play under Google’s terms and privacy policy. The Application receives a signed purchase confirmation from the Play Store app on your device, checks it on the device and keeps it, sealed, there; it never receives your payment details, name or e-mail address. Google provides us with sales and subscription reports (for example order number, date, product, country, amount and subscription status and, if Google makes it available to us, the e-mail address of the purchasing Google account). We use them only to keep our accounts and tax records, handle refunds and detect misuse (GDPR Art. 6(1)(b), (c) and (f); KVKK Art. 5(2)) and keep them for as long as accounting and tax law require (in most countries five to ten years).

6. Contacting Us

If you write to us (for example for support, a refund question or a privacy request) we receive your e-mail address and whatever you tell us. We use it only to answer you and to keep a record of the matter (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)), we add it to no mailing list, and we delete it about two years after the matter is closed unless a legal obligation or the defence of a legal claim requires us to keep it longer. Our e-mail service is run by Google as our processor. Please do not send documents or sensitive personal data.

7. Files You Save or Share

When you save or share a result, the file leaves the Application’s private storage: it is written to a folder you can reach (for example Downloads) or handed to the app you pick in Android’s share sheet. Text you copy goes to the system clipboard, which other apps may be able to read. From then on that app or location controls the data, under its own terms and privacy policy, not we.

8. Recipients and International Transfers

Information reaches only Google (Google Play, Google Play services and the e-mail service we use), either under Google’s own terms or as our processor. Google may process it in the United States and other countries outside your own, relying on safeguards such as the EU-US Data Privacy Framework and standard contractual clauses and, for Türkiye, the mechanisms of KVKK Art. 9. We pass nothing on to anyone else. We do not sell, rent or disclose personal data to advertisers, analytics providers or other third parties.

9. Children

The Application is not directed at children, and we do not knowingly collect personal data from anyone under 16 (under 13 in the United States). It needs no account. Purchases need a Google account, and Google requires a parent or guardian for minors. If you think a child has written to us, tell us and we will delete the message.

10. Your Rights (GDPR, KVKK, CCPA/CPRA)

For the little data we do hold (see “Purchases” and “Contacting Us”) you have, under the GDPR and UK GDPR, the rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests; under KVKK (Article 11) the corresponding rights; and under the CCPA/CPRA the rights to know, delete and correct. We make no automated decisions and do no profiling. Write to the contact address below; we answer free of charge within the period your law sets (one month under the GDPR, 30 days under KVKK, 45 days under the CCPA) and may first confirm your identity. What the Application keeps on your device is in your hands alone: removing the Application, or clearing its storage, deletes everything it holds there. You may complain to your data protection authority (in the EU/EEA your national authority, in the United Kingdom the ICO, in Türkiye the KVKK Board after first applying to us, in California the Attorney General or the California Privacy Protection Agency). For data Google processes itself, you can turn to Google.

11. Notice for California and Other US Residents

In the past 12 months we have not sold or shared personal information (as those terms are defined in the CCPA), have not used sensitive personal information to infer characteristics, and have not knowingly collected information from anyone under 16. The categories we receive (identifiers, such as an e-mail address when you write to us, and commercial information, such as purchase and subscription records from Google Play) come from you or from Google and are used for the purposes above. Because we do not track you across sites or apps, there is nothing to opt out of and no signal (such as Global Privacy Control) to honor. You have the right to know, delete and correct and, where they apply, to limit and opt out, and we will not treat you differently for using them. Write to the address below; an authorized agent may do so for you with your written permission. Residents of other US states with privacy laws have the equivalent rights.

12. Changes to This Policy

We update this policy when what the Application does changes (for example if crash reports are added). The date at the top shows the last review. We announce material changes in the Application or on its Google Play page before they apply and, where the law requires your consent, we will ask for it.