Privacy Policy

Data we process

To provide the service we process:

• Account: your email, name, profile image and account ID received from Google or Apple when you sign in. If you pick “Hide My Email” with Sign in with Apple, we receive Apple’s relay address rather than your real one.
• Preferences: the interests/subfields you pick, optional occupation, date of birth and academic role, language and notification settings.
• Usage: your read/save/skip interactions, searches, saved articles, lists, notes and the feedback you send us.
• Device & technical: device push token (FCM) for notifications, device name, app version, and IP address in server logs.
• Diagnostics: if the app crashes, a crash report — stack trace, device model and operating-system version.

We do not process payment-card data; subscription payments are handled entirely by Google Play (Android) and the App Store (iOS).

Why we process it

• To provide the service, including your personalized feed and library sync (performance of a contract).
• To send your daily digest notification at the time you choose (your consent).
• To verify and manage your subscription.
• For security, abuse prevention and improving the service (legitimate interests).

Sharing & third parties

We do not sell your personal data. We use a limited set of providers to run the service:

• Google — sign-in (Google Sign-In), notifications (Firebase Cloud Messaging) and payments (Google Play).
• Apple — sign-in (Sign in with Apple) and payments (App Store) on iOS. Purchase receipts are shared with Apple’s servers to verify your subscription.
• Firebase Crashlytics (Google) — collects crash diagnostics when the app terminates unexpectedly. Used only to find and fix the fault; the contents of your feed, saves or notes are never sent to it.
• Google Gemini — to generate paper summaries. Summaries are of public papers; we do not send your personal profile to this service.
• Content sources — OpenAlex, Scimago and Pexels for paper metadata, journal metrics and images; no personal data of yours is sent to them.
• Hosting provider — data is stored on the infrastructure that runs our server.

Some providers (e.g. Google) may process data outside your country. Such transfers take place under appropriate safeguards, such as the provider’s Standard Contractual Clauses (SCCs), an adequacy decision, or your explicit consent.

Retention

We keep data only as long as needed:

• Account and preference data: while your account is active.
• Server logs and IP records: up to 90 days.
• Payment and abuse audit records: the audit trail of subscription and promotional transactions — including the IP address used at the time — is kept longer than that, to resolve disputes and prevent fraud. Deleting your account severs these records from your account.
• Notification (FCM) tokens: until they become invalid or you remove the device.
• Unsaved articles in the shared pool: pruned automatically (not personal data).

When you delete your account, we delete the associated personal data within 30 days; records we must keep by law (e.g. payment/subscription) may be retained in anonymized form.

Your rights

Under GDPR and KVKK you have the right to access, correct, delete, object to processing, port your data and withdraw consent. To exercise these rights or delete your account, contact us at pofostudio@gmail.com.

You also have the right to lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, the data protection authority of your country.

Security

We encrypt data in transit with TLS, limit access, and apply server-side protections. No system is 100% secure, but we aim to reduce risk to a reasonable level.

Children

Pofolia is not directed to children under 13, and we do not knowingly collect data from anyone under that age.

Changes & contact

We may update this policy from time to time and will announce material changes in the app or site. Questions? Email pofostudio@gmail.com.