Privacy Policy

This Privacy Policy explains what information PDF Editor GR (the "App") handles and why. The App is owned and published by Mobile Safe Apps di Maria Cristina Galeota. In short: your documents stay on your device, you do not need an account, and we never receive your files.

1. Who we are

The data controller is Mobile Safe Apps di Maria Cristina Galeota, Italy. The App is technically developed and maintained by Giuseppe Romano on behalf of Mobile Safe Apps. You can contact us by email only, at mobilesafeapps@gmail.com.

2. Summary

• All PDF tools work offline. Your documents are never uploaded to us.
• Text recognition (OCR) runs on your device: images and recognised text are never sent to anyone.
• Digital signatures are checked on your device. The optional online check downloads only the public EU trusted lists, and only when you ask for it: no document data is sent.
• Signing with your own certificate happens on your device. The private key stays in the secure storage of your device and is never sent anywhere. The optional trusted timestamp is off unless you turn it on, and sends only a hash of the signature to the server you chose.
• No account or registration is required.
• On Android and iOS, Google services provide ads, crash reports and a few anonymous usage statistics, as described below.
• Google Drive backup of your signature library is optional. It is off unless you connect a Google account.
• You can turn off usage statistics and crash reports at any time in Settings, under Privacy.
• We do not sell personal data.

3. Your documents

Every PDF operation in the App runs on your device, including merging, splitting, reordering, rotating, cropping, compressing, protecting, unlocking, watermarking, converting, editing, filling in forms, signing and creating documents. Your documents, pages and output files are never sent to us or to any server operated by us.

A file leaves your device only when you choose to share, export or save it elsewhere, for example through the share sheet. Files you open from other apps are read on your device.

The App keeps on your device the files it creates (in the Documents folder or in a location you choose), a list of recently used files and your settings. Temporary files used during processing are stored in the app's cache and may be removed by the system.

Text recognition (OCR). The text recognition tool runs on your device. It uses the engine of your operating system (Apple Vision on iOS, Windows OCR on Windows) or an engine bundled in the App (Google ML Kit on Android, whose models are included in the App and are not downloaded). The images, the scanned pages and the recognised text are not uploaded or sent to anyone by the App, including Google, Apple and Microsoft, and the App asks for no extra permission for it. Recognised text is kept only on the screen until you copy, share or save it, and a saved file goes where you choose. Temporary images used while reading are stored in the app's cache.

Digital signatures. The App reads and verifies the digital signatures of a PDF and of signed .p7m files on your device, using the signature and the certificates stored in the file. The document is never uploaded. The online check is optional and starts only when you choose "Verify online" and confirm: the App then downloads the official European Union List of Trusted Lists (ec.europa.eu) and the national trusted list of the signer's country, for example the Italian list published by AgID (eidas.agid.gov.it). These are public files. The request contains no document data, signature or personal data; like any web request it reveals your IP address to the servers of the European Commission or of the national authority. The lists are kept in the App's private storage and reused for up to seven days. A .p7m file you open is unpacked into the App's temporary folder on your device. Certificate revocation is not checked.

Signing with your own certificate. In Settings, under Digital certificates, you can import a personal certificate (a .p12 or .pfx file) to sign PDFs. The file is read on your device with the password you type; the App does not store the password. The imported file (still protected by its password) is kept in the secure storage of your device: the Android Keystore on Android, the Keychain on iOS. It is excluded from backups and cannot be moved to another device, and the private key is never sent to us or to anyone else. A signed PDF is written on your device as a new file next to the original; the document is never uploaded. The signing form can also ask a time-stamp authority for a trusted timestamp. This is off by default, needs an address you set yourself in Settings, and starts only after you turn it on in the signing form and confirm. The request contains only the SHA-256 hash of the signature, not the document and not your name; like any web request it reveals your IP address to the server you chose. You can delete a certificate and its key at any time.

4. Signature library and backups

Your signatures and initials are stored only on your device. The signature images are kept in the App's private storage, and the index (names, order, default flags and stroke data) is kept in the App's settings storage. The App offers these ways to keep a copy:

• Android Auto Backup. The signature files and the App's settings file are included in the backup that Android makes of your device through your Google account. Google and your device settings control this backup.
• iCloud device backup (iOS). The signature files and the App's settings are part of your iPhone or iPad backup when iCloud Backup is turned on.
• Export file. You can save your library to a .pdfgrsig file and share or store it wherever you choose. We do not receive this file.
• Google Drive (optional). You can connect a Google account in Settings, under Signature backup. The App then asks Google for the drive.appdata permission, which allows it to see only its own hidden folder in your Google Drive. The App stores one backup file there, containing your signature library. The App shows the email address of the connected account and the date of the last backup. Backups are made when you choose, or automatically about 30 seconds after your library changes if you have turned automatic backup on. This data is used only to back up and restore your library. You can sign out at any time to disconnect the account. Signing out stops further backups and restores. To delete the backup file from your Google Drive, choose "Delete backup from Drive" in Settings, under Signature backup, or choose "Sign out and delete backup" when you sign out. You can also revoke the App's access at any time in your Google Account settings, under the apps with access to your account.

Restoring a library from a file or from Google Drive either merges it with the signatures on your device or replaces them, as you choose. The App's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

5. Advertising (Android and iOS)

The App shows banner ads and full-screen (interstitial) ads from Google AdMob. Ads are not shown in Edit or Create. Full-screen ads appear only after some completed operations, at most once for every third success and never more often than every 90 seconds.

Before the App requests ads, Google's User Messaging Platform (UMP) asks for your consent where the law requires it, for example under the EU and UK General Data Protection Regulation (GDPR) and under US state privacy laws. Depending on your choices, ads are either personalised, based on your activity and interests, or non-personalised.

To show ads, Google may process your device's advertising identifier (the Android AD_ID permission supports this), your IP address, device and app information, and an approximate location derived from your IP address. Google uses this information under its own policies:

• Google Privacy Policy
• How Google uses information from sites or apps that use our services

You can review or change your consent choices in Settings, under Privacy, in the Privacy options entry. This entry appears when the law in your region requires it. You can also reset or delete your advertising identifier in your device settings.

On iOS, Google's consent message may first explain the use of the advertising identifier and then show Apple's App Tracking Transparency prompt. The App can use the advertising identifier only if you allow tracking in that prompt. If you decline, ads are shown without it and the App works exactly the same. You can change your choice at any time in the iOS Settings, under Privacy & Security, Tracking.

Ads are not requested while the "Remove ads" purchase is active (see section 7). The App does not show ads on Windows.

6. Crash reports and analytics (Android and iOS, release builds only)

These services run only in release builds of the App. Debug and test builds send no crash reports and no analytics data.

Crash reports (Firebase Crashlytics). If the App crashes or records an error, it sends a report containing the stack trace, the device model, the operating system version, the App version, the time of the event and an installation identifier generated by Firebase. This identifier is pseudonymous and is not linked to your name.

Usage statistics (Firebase Analytics). The App records a few anonymous events: which tool you used (for example Merge or Compress), the compression profile you selected, and the completion of a "Remove ads" purchase. Firebase also collects standard information such as app opens and sessions, the device model, the operating system and App version, the language, and an approximate region.

Usage statistics and crash reports are under your control and, where the law requires it, under your consent:

• In the European Economic Area, the United Kingdom and Switzerland, usage statistics are collected only if your choices in Google's consent form allow it. The "Usage statistics" switch in Settings, under Privacy, can only restrict this further: if consent is denied, statistics stay off even when the switch is on.
• Where these consent rules do not apply, usage statistics are on by default. You can opt out at any time with the "Usage statistics" switch.
• Crash reports are on by default everywhere. You can turn them off at any time with the "Crash reports" switch in Settings, under Privacy.
• Both switches take effect immediately and are applied each time the App starts, before any event is recorded.

Google keeps this data for the periods set by its default Firebase settings. For details, see the Firebase privacy information.

7. Purchases

"Remove ads" is a one-time in-app purchase sold through Google Play (Android) or the Apple App Store (iOS). The store handles the payment entirely. We do not receive or store your payment card, account or billing details. The store confirms to the App that the purchase was made, and the App remembers this on your device so that ads stay off. You can restore a previous purchase in the App, which uses the store's restore function.

8. Permissions

On Android the App requests the following permissions:

• INTERNET and ACCESS_NETWORK_STATE: to load ads, send crash reports and analytics, use Google Drive backup when you choose it, and check that a connection is available. It is also used, only when you choose "Verify online" for a digital signature, to download the public EU trusted lists. It is also used, only when you turn on the trusted timestamp while signing, to send the hash of the signature to the time-stamp server you set.
• AD_ID: to use the advertising identifier for Google ads.
• POST_NOTIFICATIONS: to show the progress of long operations in a notification. The notification contains no personal data and nothing is sent anywhere because of it.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_DATA_SYNC: to run a foreground service of type dataSync, which keeps long file operations running on your device while the App is in the background. No data leaves your device because of it.

The App does not ask for access to your contacts, location, camera, microphone or photo library. You choose the files it works on with the system file picker. The text recognition tool needs no additional permission.

On iOS the App may show Apple's App Tracking Transparency prompt (see section 5).

9. Children

The App is not directed to children under 13, or under 16 in the European Economic Area. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the App, please contact us.

10. Sharing and sale of data

We do not sell personal data. We do not share it with anyone except the Google services described in this policy, which process it under their own privacy policies, and when the law requires us to do so. We do not operate any server that receives your documents or account data.

11. Where data is processed

Google may process data on servers in the United States and in other countries. Google protects international transfers with the safeguards described in its privacy policies.

12. Security

Your documents and signatures are stored on your device and protected by its lock screen and system security features. Keep your device secured. We do not keep copies of your files, so we cannot recover them for you. Keep your own copies of important documents.

13. Your rights

Depending on where you live, you may have the right to:

• access, correct or delete personal data that concerns you;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw your consent at any time, for example through the Privacy options described in section 5;
• lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali.

We hold very little personal data, because the App does not send us your documents and does not create accounts. You can delete your signatures in the App at any time. Advertising and analytics data held by Google can be managed through the consent settings described above and through Google's own tools. To make a request, contact us at the address in section 1.

Residents of US states, such as California, have similar rights under state privacy laws, including the right to know, to delete and to limit certain uses of personal information. We do not sell personal information.

14. Governing law

This Privacy Policy is governed by Italian law and, where applicable, by the GDPR. It does not limit any mandatory privacy right that you have where you live.

15. Changes to this policy

We may update this policy. The effective date at the top of this page shows the version currently in force.

16. Contact

Mobile Safe Apps di Maria Cristina Galeota
Technical development: Giuseppe Romano
Email: mobilesafeapps@gmail.com