1. Data Controller Information
The data controller responsible for the processing of personal data collected through the Papyria mobile application (available on Google Play Store under package com.papyria.app) and related online services is Papyria Labs ("Papyria", "we", or "our").
For inquiries or to exercise your privacy rights, contact our Data Protection representative at: contacto@papyria.app.
2. Personal & Sensitive Data We Collect
We collect only the minimal information required to deliver smart reading, RAG contextual intelligence, and cloud synchronization:
A. Authentication & Account Data
When you register or sign in via our identity provider (Auth0 / Google OAuth), we collect your full name, email address, profile avatar picture (if authorized), and a secure unique user ID (auth0_sub). We never store your passwords when you use Google Sign-In.
B. Library & User Content
Digital book files in EPUB and PDF formats that you explicitly import, bibliographic metadata (title, author, cover thumbnail, chapter count), reading progress records (current chapter, page, percentage, position), and your personal annotations (highlights, quotes, and reading notes).
C. AI Assistant Interactions (Mindie)
To power Retrieval-Augmented Generation (RAG): text chunks extracted from books you authorize for AI processing, vector representations (embeddings), queries you ask in chat with Mindie, assistant replies, and daily question counters to enforce plan quotas.
D. Payment & Subscription Data (Pro Plan)
If you subscribe to the Pro Tier ($7 USD/month), payments are handled end-to-end by Stripe Inc. Papyria NEVER collects, stores, or accesses your credit card numbers, CVVs, or expiration dates. We only store customer and subscription tokens (stripe_customer_id, stripe_subscription_id) to manage your active premium features.
E. Local Device Storage & Android Permissions
The app uses on-device local storage (SQLite and AsyncStorage) to store reading cache, appearance theme preferences (light, dark, sepia), and language settings. The app requests file access permissions only when you explicitly select the "Import Book" action through Android's native Document Picker / Storage Access Framework (READ_EXTERNAL_STORAGE where applicable).
3. Purpose of Data Processing
We process your personal data strictly for legitimate operational purposes:
- Creating and maintaining your user account, synchronizing your library and progress across devices.
- Providing smooth reading features, bookmarks, highlights, and note organization.
- Running RAG semantic search so Mindie can respond accurately based on your book chapters.
- Managing your recurring Pro subscription and billing lifecycle with Stripe.
- Delivering customer support and technical troubleshooting.
- Protecting the security, integrity, and stability of the platform.
4. Third-Party Sub-processors & International Transfers
We do not share your data with advertisers or data brokers. We partner strictly with industry-leading cloud and infrastructure providers (Sub-processors) bound by strict confidentiality and security standards:
| Provider | Function | Data Handling & Safeguard |
|---|---|---|
| Auth0 by Okta | Authentication & Identity | Encrypted session tokens, OAuth social login. SOC 2 and ISO 27001 certified. |
| Google Cloud / Google AI (Gemini) | Embeddings & AI Inference | Calculates embeddings and generates Mindie chat responses. Explicit safeguard: User book chunks sent to the enterprise API are not used to train or fine-tune Google's public AI models. |
| Stripe Inc. | Payment Processing | Highest level of payment security (PCI-DSS Service Provider Level 1). |
| Fly.io Inc. | Backend Hosting & Database | Secure cloud environment running PostgreSQL with encrypted storage at rest and in transit. |
5. Security & Cryptography
In strict compliance with Google Play User Data policies, all data communications between the Papyria mobile app and our backend servers are secured using HTTPS with TLS 1.3 encryption. Server databases are protected by strict access controls and firewalls.
6. Data Retention & Account Deletion (Google Play)
We retain your data only for as long as your account remains active.
Deletion Policy:
• Free Tier Users: When you delete your account, your books, chunks, notes, and progress records are immediately and permanently erased from our servers.
• Paid Tier Users (Pro): Deleting your account immediately stops recurring billing in Stripe. To prevent accidental data loss and support transaction dispute resolution, server content is scheduled for permanent purge after a 7-day grace period (purge_scheduled_at).
• On-Device Data: Deleting your account clears the local SQLite database. You can also clear local cache directly in Android App Settings.
How to Request Account Deletion:
- In-App: Go to Profile → Account Settings → tap Delete Account.
- Via Web: Visit our public deletion page at papyria.app/delete-account or email contacto@papyria.app with the subject "Account Deletion Request".
7. Children's Privacy
Papyria is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If we become aware of unauthorized collection, we promptly delete such data.
8. Contact Us
For privacy inquiries or data rights requests, contact:
Papyria Labs
Privacy & Support Email: contacto@papyria.app
Official Website: https://www.papyria.app