Privacy Policy

1. Who is responsible for your data

PDF Course is the controller for the personal data described here. Questions or requests: [email protected], or the contact page.

2. Data we collect

• Account data: your name, email address, password (stored hashed) and — if you log in with Google or GitHub — the identifier that provider returns to us.
• Your content: the PDFs you upload, the text extracted from them, and the courses, lessons, quizzes, glossaries and progress data generated from them.
• Usage data: study progress, quiz attempts, credits consumed, points, streaks, badges, notifications, and basic technical logs (for example error and generation job status).
• Billing data: subscription status, plan and customer references. Payment card details are handled entirely by our payment provider; we never receive or store full card numbers.

3. Why we process it (purposes and legal bases)

We process your data to provide the Service you asked for (extracting text, generating and showing your courses), to maintain your account and progress, to bill subscriptions, and to send transactional emails such as verification, password reset, welcome and new-device alerts. Our legal bases are performance of our contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and — for optional analytics cookies — your consent.

We do not sell your personal data and we do not use your documents or generated content for advertising or profiling.

4. AI processing

To generate lessons and quizzes, the extracted text of your PDF (or page-level excerpts) is transmitted to our AI provider’s API (currently OpenAI). It is used only to produce the content you requested and, under our provider terms, is not used to train third-party models or to train public models. Because generation requires an external provider, please do not upload material whose disclosure to a processor would breach a duty you owe to someone else.

5. Processors we rely on

• Hosting and database: our self-hosted PocketBase backend stores your account, documents and generated content.
• AI provider: processes document text to generate lessons and quizzes.
• Payments: our payment provider (Lemon Squeezy) handles checkout, subscriptions, tax and receipts as merchant of record.
• Email delivery: our mailer sends verification, password-reset and account-alert emails.
• Analytics (only with consent): anonymous usage statistics, including Google Analytics if enabled.

Each processor only receives the data needed for its role and acts under its own terms. We remain responsible for your data, but we are not responsible for the independent acts or outages of these providers.

7. Who can see your content

Your documents and generated content are private to your account: access is restricted to you and to the limited number of people who operate the Service where needed to provide support, investigate abuse, or comply with law. We do not share your content with other users or publish it. We may disclose information where required by valid legal process, or where necessary to protect our rights, the safety of any person, or the integrity of the Service.

8. International transfers

Our infrastructure and processors may be located in countries other than your own, including the United States. Where data is transferred internationally we rely on appropriate safeguards available under applicable law.

9. Data retention and deletion

Your documents and generated content are kept until you delete them or close your account. You can delete individual items and your whole account from your account settings; deletion removes your profile and associated content from production systems, except records we must keep for billing, tax, security or legal reasons (kept only as long as required). Backups are rotated on a limited schedule, so deleted data may persist briefly in backups before being overwritten.

10. Security

We protect accounts with hashed passwords, session tokens and transport encryption, and we restrict access to production data. No system is perfectly secure: please use a unique password and tell us promptly at [email protected] if you suspect unauthorized access. Subject to applicable law, we are not liable for unauthorized access that occurs despite these safeguards.

11. Children

The Service is not directed to children under 13 (or the minimum digital-consent age where you live) and may not be used by them.

12. Your rights

Depending on where you live, you may have the right to access, export, correct, delete or restrict processing of your personal data, to object to certain processing, and to lodge a complaint with your data protection authority. Most data can be exported or deleted directly in your account settings. For anything else, email [email protected] and we will respond within 30 days. We will not discriminate against you for exercising these rights.

13. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be announced in the app, and the “last updated” date above always reflects the current version.

14. Contact

Privacy questions or requests? Email [email protected], or use the contact page.