Data Policy.

1. Scope and who we are

This Data Policy explains how we collect, use, disclose, and protect information in connection with the DuPDF application (“App”). “We,” “us,” or “our” means SKNAAM Pvt Ltd, the operator of the DuPDF application and the data controller for personal data processed in connection with the App. We are committed to transparency and to minimizing data collection. Most of your data, including your documents and signatures, stays on your device and is not transmitted to us.

2. Data we collect

Account and identity. If you sign in with Apple or another provider, we may receive an identifier and, if you choose to share it, your email address and name. We use this solely to manage your account and subscription.

Subscription and purchase data. We receive information about your subscription status and in-app purchases from the App Store (e.g., product ID, renewal date) to provide the correct features and support. We do not receive your payment card number or full payment details; payments are processed by Apple.

Device and technical data. We may collect minimal technical information (e.g., app version, device type, operating system version) necessary for compatibility, troubleshooting, and support. We do not track which documents you open, edit, or sign, or any behavior inside the App for advertising or profiling.

3. Data we do not collect

We do not collect, store, or transmit the content of your documents, your annotations, your signatures, your drawing or text input, or any personally identifiable content you create in the App. We do not sell your personal data. We do not use your data for advertising, third-party marketing, or cross-context behavioral advertising. We do not perform analytics or tracking on your in-app activity for purposes other than providing and improving the App (e.g., crash reporting only if you have not disabled it). We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal basis for processing (EEA/UK)

Where required by law (e.g., in the European Economic Area or UK), we process your personal data on the following bases: (a) performance of our contract with you (providing the App and subscription); (b) your consent where we have asked for it; (c) our legitimate interests (e.g., security, fraud prevention, improving the App), where not overridden by your rights; (d) compliance with legal obligations. You may withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing before withdrawal.

5. Local storage and device data

Your documents, signatures, annotations, and app-generated data are stored locally on your device within the App’s sandbox. We do not have access to this data unless you explicitly use a feature that sends data to a third-party service of your choice (e.g., sharing, cloud backup). You are responsible for backing up your device and data. We are not responsible for loss of locally stored data due to device failure, loss, or uninstall.

6. How we use data

We use the limited data we collect only to: (a) provide, operate, and improve the App and Services; (b) manage your account and subscription; (c) respond to your requests and provide support; (d) comply with legal obligations and enforce our terms; (e) protect the security and integrity of our systems and users; (f) communicate with you about the App (e.g., important updates) where permitted. We do not use your data for profiling or automated decision-making that significantly affects you.

7. Sharing and disclosure

We do not sell or rent your personal data. We may share data only: (a) with your consent; (b) with service providers who assist us (e.g., hosting, analytics, support) under strict confidentiality and data protection obligations, and only to the extent necessary; (c) when required by law, court order, or government request, or to protect our or others’ rights, safety, or property; (d) in connection with a merger, sale, or transfer of assets, with notice and choice where required by law. We require processors to protect your data in line with this policy and applicable law.

8. Data retention

We retain account and subscription-related data for as long as your account is active and as needed to provide the App, resolve disputes, and comply with legal obligations (e.g., tax, regulatory). After account closure, we may retain data for a limited period as required by law or for legitimate purposes (e.g., fraud prevention). Locally stored data on your device remains until you delete it or uninstall the App. You may request deletion of your account and associated personal data we hold as described in “Your Rights” below; we will process such requests in accordance with applicable law.

9. Your rights

Depending on your jurisdiction, you may have the right to: access your personal data; correct or update inaccurate data; request deletion of your data; restrict or object to certain processing; data portability (receive a copy in a structured format); withdraw consent where processing is based on consent; opt out of the “sale” or “sharing” of personal data (we do not sell or share for cross-context behavioral advertising). To exercise these rights, contact us at dupdf@proton.me or through the App or website. We will respond within the time required by applicable law. If you are in the EEA or UK, you have the right to lodge a complaint with a supervisory authority. California residents: we do not sell or share personal information as defined under the CCPA.

10. Security

We implement appropriate technical and organizational measures to protect the limited personal data we process, including against unauthorized access, alteration, disclosure, or destruction. Your document and signature data is protected by your device’s security (e.g., passcode, biometrics) and the App’s sandbox. No method of transmission or storage is 100% secure; you are responsible for keeping your device and credentials secure and for any use of your account.

10A. Security architecture, external risks, and backup responsibility

DuPDF incorporates world-class, defense-in-depth security throughout its app functionality and protection architecture. It is designed to provide robust protection against classical-computing attacks at any scale, including attacks involving state-level supercomputers, and against quantum-computing threats. DuPDF’s quantum-resilience design considers attack scenarios involving quantum computers at scales up to 4.3 million physical qubits. These statements describe security design goals and threat-model assumptions, not an absolute guarantee that any system is unbreakable.

Protection may still be defeated, degraded, or bypassed by circumstances outside DuPDF’s control, including Apple-device hardware faults; natural disasters; security vulnerabilities or loopholes, including zero-day vulnerabilities; intentional or unintended backdoors introduced by hardware manufacturers, third-party component suppliers, Apple components, Apple operating systems such as iOS or macOS, or third-party software vendors; hardware or software supply-chain compromises; and weaknesses or backdoors involving mobile-network operators, SIMs, or SIM-service providers. Before using DuPDF services, users must maintain current, independent backups of important data. To the maximum extent permitted by law, DuPDF is not responsible for data loss caused by these factors. Users should use genuine Apple devices and components and choose Apple-authorized or otherwise reputable, legitimate repair and replacement services.

A fuller walkthrough of the Double PQC Shield lives on the security architecture page.

11. Children’s privacy

The App is not directed at children under 13 (or the applicable minimum age in your jurisdiction, e.g., 16 in some countries). We do not knowingly collect personal data from children. If you are a parent or guardian and believe we have collected data from a child, please contact us at dupdf@proton.me and we will take steps to delete such information promptly.

11A. Minor search experience and parent notice

For search features, we apply moderation and safety-oriented filtering intended to make browsing safer for minors. Even with these protections, we cannot guarantee that every result will always be appropriate, complete, or error-free. Parents and legal guardians should supervise search usage by minors and are strongly encouraged to actively monitor children under 10 years old while using search.

If any search result appears inappropriate, misleading, or unsafe, users should discontinue viewing that result and notify us via support so we can review and improve safeguards.

12. International transfers

Your data may be processed in countries other than your residence. Where we transfer data from the EEA, UK, or other jurisdictions with restrictions, we ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses (SCCs), or other mechanisms approved by applicable law. You may request details of the safeguards we use.

13. Changes to this policy

We may update this Data Policy from time to time. We will notify you of material changes by posting the updated policy in the App or by other reasonable means (e.g., in-app notice). The “Last updated” date will be revised. Your continued use of the App after the effective date constitutes acceptance of the updated policy. If you do not agree, you should stop using the App. We encourage you to review this policy periodically.

14. Contact (Data Policy and Privacy)

For privacy-related questions, to exercise your rights, or to report a concern, contact us at dupdf@proton.me or through the support or contact options provided in the App or on our website.