Privacy Policy

Data we process

To provide the service we process:

• Account: your email, name, profile image and account ID received from Google or Apple when you sign in. If you pick “Hide My Email” with Sign in with Apple, we receive Apple’s relay address rather than your real one.
• Preferences: the interests/subfields you pick, optional occupation, date of birth and academic role, language and notification settings.
• Usage: your read/save/skip interactions, searches, saved articles, lists, notes and the feedback you send us. These records carry the app version and a session id (random per foreground stretch or browser tab; it does not identify the device and is not persisted). No IP address, precise location or device identifier is added to these records; of a search only an irreversible hash is kept, never the text.
• Device & technical: device push token (FCM) for notifications, device name, app version, and IP address in server logs.
• Country: only a two-letter country code (e.g. GB) is added to your account, so we can see which countries use Pofolia. It is estimated from your app store region, the IP address of your sign-in, your device timezone or your browser language. The IP lookup runs against a local database on our server; the IP address is not stored for this and is not sent to anyone (IP Geolocation by DB-IP).
• Diagnostics: if the app crashes, a crash report — stack trace, device model and operating-system version.
• How you found us: when your account is created, the label of the link that brought you (e.g. an article page, an Instagram link or a search engine’s name), on Android the source label Google Play passes along with the install, and your optional answer to “Where did you hear about Pofolia?”. Used only to see which channels work; never shared for advertising.

We do not process payment-card data; subscription payments are handled entirely by Google Play (Android) and the App Store (iOS).

Why we process it

• To provide the service, including your personalized feed and library sync (performance of a contract).
• To send your daily digest notification at the time you choose (your consent).
• If you turn it on, to email you a weekly literature digest picked from your interests (your consent). We measure that these emails were delivered, an estimated signal that one was opened (an image in the email loading; some mail apps do this on their own) and which paper link was clicked. You can leave in one step from the link in every email or from the app settings; after that nothing more is sent.
• If you follow a search, we keep that search (the text you typed and the filters you chose) to provide the follow: once a week we find newly published papers and tell you through the channel you chose (an app notification; email too if you tick it) (performance of a contract; your consent for email). For follow emails we also measure delivery, an estimated open and clicks. We use the search text only for this service; measurement uses an irreversible hash of it, never the text.
• To verify and manage your subscription.
• For security, abuse prevention and improving the service (legitimate interests).

Sharing & third parties

We do not sell your personal data. We use a limited set of providers to run the service:

• Google — sign-in (Google Sign-In), notifications (Firebase Cloud Messaging) and payments (Google Play).
• Apple — sign-in (Sign in with Apple) and payments (App Store) on iOS. Purchase receipts are shared with Apple’s servers to verify your subscription.
• Google Analytics 4 — on the website only, and only if you accept in the cookie bar; anonymous page-view and click statistics (see the Cookie Policy). Not used in the app.
• Firebase Crashlytics (Google) — collects crash diagnostics when the app terminates unexpectedly. Used only to find and fix the fault; the contents of your feed, saves or notes are never sent to it.
• Google Gemini — to generate paper summaries. Summaries are of public papers; we do not send your personal profile to this service.
• Content sources — OpenAlex, Scimago and Pexels for paper metadata, journal metrics and images; no personal data of yours is sent to them.
• Amazon Web Services (Amazon SES) — only if you turned on the weekly digest email or chose to get a follow by email, to deliver it. Your email address and the email content are sent to this service; delivery, bounce and complaint notices are reported back to us.
• Hosting provider — data is stored on the infrastructure that runs our server.

Some providers (e.g. Google) may process data outside your country. Such transfers take place under appropriate safeguards, such as the provider’s Standard Contractual Clauses (SCCs), an adequacy decision, or your explicit consent.

Retention

We keep data only as long as needed:

• Account and preference data: while your account is active.
• Server logs and IP records: up to 90 days.
• Payment and abuse audit records: the audit trail of subscription and promotional transactions — including the IP address used at the time — is kept longer than that, to resolve disputes and prevent fraud. Deleting your account severs these records from your account.
• Notification (FCM) tokens: until they become invalid or you remove the device.
• Email digest preference and send records: while your account is active. For an address that bounced permanently or reported spam we keep only an irreversible hash, so that nothing is ever sent to it again.
• Searches you follow and the papers found for them: until you delete the follow or your account; both go together.
• Unsaved articles in the shared pool: pruned automatically (not personal data).

When you delete your account, we delete the associated personal data within 30 days; records we must keep by law (e.g. payment/subscription) may be retained in anonymized form.

Your rights

Under GDPR and KVKK you have the right to access, correct, delete, object to processing, port your data and withdraw consent. To exercise these rights or delete your account, contact us at pofostudio@gmail.com.

You also have the right to lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Authority (KVKK); in the EU, the data protection authority of your country.

Security

We encrypt data in transit with TLS, limit access, and apply server-side protections. No system is 100% secure, but we aim to reduce risk to a reasonable level.

Children

Pofolia is not directed to children under 13, and we do not knowingly collect data from anyone under that age.

Changes & contact

We may update this policy from time to time and will announce material changes in the app or site. Questions? Email pofostudio@gmail.com.