Pagiro privacy policy

Last updated: 23 October 2026

This policy covers the Pagiro app for Android. Publisher: TDH SOFTWARE CO.,LTD, 27 Street 447A, Quarter 33, Tang Nhon Phu Ward, Ho Chi Minh City 70000, Viet Nam. Contact: contact@tdhsoft.com.

1. Your documents stay on your device
2. Camera and text recognition
3. Diagnostics log
4. Files from other apps
5. Scheduled backup
6. Purchases
7. AI features
8. No ads; optional anonymous usage statistics
9. Permissions and why
10. Children and teens
11. Deleting your data
12. Changes
13. Contact

1. Your documents stay on your device

Pagiro reads, edits, scans and recognizes text on your device. Your documents and pictures are not sent to TDH Software or to any server of ours. Two things can be sent to us, and only when you choose them: the text you send to an AI feature (section 7), and the optional, anonymous usage statistics described in section 8.

Spell check while you edit (you can turn it off in Settings > Open & edit documents) uses the spell checker built into your phone, the spell checker service chosen in the phone’s settings. The words you are editing are given to that checker on your device; Pagiro sends them nowhere and keeps nothing of it (words you choose to ignore are remembered only until the app is closed).

2. Camera and text recognition

The camera permission is used only when you scan a document, take a picture to recognize text, take a photo to put on a PDF page, or photograph your signature on paper. Pictures are processed on your device. For a signature from a photo, only the ink is kept, on your device; the photo itself is not kept. Text recognition uses Google ML Kit, a library that runs on the device; Pagiro does not send your pictures to us or to anyone else. ML Kit may send anonymous usage statistics to Google (Google Data Transport); they do not contain your pictures or text. You can use the app without allowing the camera and scan pictures you already have.

3. Diagnostics log (stays on your device)

If you keep the diagnostics log switched on, crashes and problems are written to a file on your device so that you can report a bug. It is kept on your phone for at most 3 days: older entries are deleted automatically. It is not sent anywhere. When you choose “Send feedback”, you see what is included, decide whether to attach the diagnostics, and send it yourself through your own e-mail app. You can switch the log off (nothing more is recorded) or delete it at once with “Clear log” in Settings.

4. Files from other apps

When you open a file with the system file picker, or send a file to Pagiro from another app, Pagiro receives only the file you choose, and, if you allow it, remembers the permission to save back to that same file. Pagiro sends nothing about it to us. The app that stores the file applies its own privacy policy to what it stores.

Documents on this phone (All files access, Android 11 and later)

Library > On this device can list the documents, pictures and other files already on your phone that Pagiro can open, for example a file you just received in Download, in Documents or in a chat app, so you can open it without the file picker and find it with Search. This needs Android’s “All files access” permission. Pagiro asks for it only when you open On this device, or when a search finds nothing in your library, never at start; it first explains what it does, and Android’s own settings page is where you turn it on or off (Manage access in On this device takes you there). Pagiro reads a file only when you open it, and the list stays on your phone; nothing is uploaded. A file you open from there is opened like a picked file: a copy goes into your library, and your edits are saved back to the original only after you are asked. Everything else in Pagiro works without this permission.

5. Scheduled backup (Pagiro Pro)

Scheduled backups go only to a folder you pick on your phone. A new backup setup is encrypted with a passphrase that only you know (you can turn this off; a setup made by an earlier version keeps its choice); documents in the Vault are never included. We do not receive your backups.

6. Purchases (Pagiro Pro)

Purchases are handled by Google Play Billing. We do not receive your card details, name or e-mail. The app only asks Google Play whether your Google Play account has bought Pagiro Pro, and keeps a small signed record on your device so Pro works offline. This is not sent to us, except when you use AI: then our AI service checks your purchase with Google Play to find your AI credits (section 7). A monthly or yearly plan renews until you cancel it in the subscription settings of Google Play.

7. AI features (on Android, with Pagiro Pro or credit packs)

The AI features (Summarize, Ask and Create with AI) are the only part of Pagiro that sends text from your documents off your phone, and only when you use them. Nothing is sent until you tap Allow on the screen that explains this, and then only when you tap an AI action. You can turn it off at any time in Settings > Security > AI > Send text to AI.

What is sent: the text you chose (the open document, or the part you picked) and what you typed (a question, or the description of a document to create). With Create with AI, also the passages it needs from the documents you attach, and their file names. Attached documents and photos are read on your phone, and only those text passages are sent. Never the files themselves, and never your other documents. With each request the app also sends a random install ID made by the app, a Google Play Integrity verdict (Google tells our server that the request comes from a genuine copy of Pagiro on a genuine device), and your Pro or credit-pack purchase token, which our server checks with Google Play to find your credits. Without Pro, the request carries no purchase; your credit packs are then found by the install ID and the wallet key below.

Wallet key: so that your credits are found again after a reinstall, on a new phone or with a new purchase, the app makes a random key (not linked to your name, e-mail or device) and gives it to Google Play with each purchase. Our server receives it in Google’s answer and, when you use credit packs without Pro, from the app itself, and keeps only a keyed hash of it; it is never logged. On Android the key is also kept in Google Block Store, which backs it up, end-to-end encrypted, to your Google account when your phone supports it. If you use Restore credits, the Google Play order number you type is checked with Google Play and kept only as a keyed hash; the credits of that earlier purchase move to you after 7 days, and only if nobody used them in the last 30 days or during those 7 days.

Who processes it: our AI service at ai.pagiro.app, run by TDH Software on Cloudflare (Cloudflare, Inc.), passes the text to Anthropic (Anthropic, PBC, United States), whose model writes the answer. Both act as our service providers; the text is processed in the United States. We use no provider that trains on the text. If we change the provider, we will update this page and the screen in the app first.

How long it is kept: our service keeps the text only while the answer is written. A job is kept for at most 15 minutes, so that a dropped connection can resume, and is then deleted. Document text, questions and answers are never written to our database or our logs. It is not stored by us and not used for training. Anthropic does not use it to train its models and deletes inputs and outputs within 30 days. Two exceptions apply on Anthropic’s side: content that its safety systems flag as possibly breaking its usage policy may be kept longer (up to two years for the content, and up to seven years for the safety scores), so that it can be reviewed and abuse can be stopped; and content may be kept longer where the law requires it. We cannot see or switch off these safety reviews. Anthropic has not agreed to delete the text at once (“zero data retention”); if that changes, we will update this page. Summaries, answers and created documents are kept only on your phone: Settings > Security > AI > Clear all AI results deletes the summaries and answers, and a created document is deleted like any other file.

What our server keeps: no names, e-mail addresses or document content. For credits: a keyed hash of your purchase (the wallet ID), the plan, the credit balance and the use per action each month. For each AI run, numbers only (the action, its size band, the credits, the tokens, the time and the result), for 30 days. Integrity verdicts and the results of purchase checks, for up to 30 days. A record per install of the 2 free Create with AI tries. IP addresses are used only as a hash, to limit abuse. Your usage history (date, action, credits and document name) stays on your phone.

Delete my AI data: Settings > Security > AI > Delete my AI data deletes, at once and after you confirm, your wallet on our server: the credit balance and plan record, the use per action, the records of your AI runs and the links between your installs and the wallet. Unused pack credits are lost and cannot be restored; your plan’s monthly credits come back with your plan the next time you use AI. We keep only what refunds and the law need: the record of each credit pack bought (a keyed hash of its purchase token, the product, the credits and whether it was refunded), so that a store refund can be matched and a pack is never added twice; the keyed hash that links your store purchase to the wallet ID; the records of credits moved by Restore credits, so that a later refund is taken from the right wallet; the per-install count of the free Create with AI tries; and, until the current monthly period ends, the number of credits already used in it, so that deleting does not refill the month; and, if a refunded credit pack had left your balance below zero, that negative balance, which comes back when the wallet is opened again with the same purchase, install or wallet key (deleting does not cancel a refund debt). None of these holds a name, e-mail address or document content. Text sent to AI is not part of this: it is never in our database, and Anthropic deletes it as described above.

Purposes and legal basis: giving you the AI result you asked for, counting your credits, and preventing fraud and abuse. The legal basis is the performance of the service you request and our legitimate interest in preventing abuse. The text is not used for advertising or profiling, and it is not sold or shared.

8. No ads; optional anonymous usage statistics (off unless you allow them)

Pagiro has no advertising and no tracking across apps or websites. We do not sell or share data. To learn which parts of the app are used and how people move to Pagiro Pro, the app can send anonymous usage statistics, only after you tap “Allow” on the card that asks for it, or turn on Settings > Security > Privacy > Share anonymous usage data. Until then nothing is collected, kept for later or sent.

Purposes: improving the app (which tools, document types and screens are used) and measuring the steps of the upgrade to Pagiro Pro. Legal basis: your consent, which you can withdraw at any time.

What is sent, each as a separate event:

• a tool was used: which tool (for example “merge”), whether it finished, was canceled or failed, and how long it took in a broad range (under 5 seconds, 5–30 seconds, 30 seconds–2 minutes, over 2 minutes);
• a document was opened: its type (PDF, DOCX, XLSX, EPUB…), its size in a broad range (under 1 MB, 1–10 MB, 10–50 MB, over 50 MB) and whether it came from the library, another app or an archive;
• time on a kind of screen (Home, Library, Tools, Settings, the upgrade screen, the PDF reader, the document editor…) in a broad range, when you leave it or the app goes to the background; never the time spent on a particular document;
• the steps of the Pro upgrade: the upgrade screen was opened (and from which tool), a plan was chosen, a purchase was started, completed, canceled or failed (as a category), a restore found Pro or not, a subscription ended, which Pro tool was used, the thank-you was shown;
• with each event: the app version, the platform and the app’s interface language.

Never sent: names, titles, paths or contents of documents, page counts, the language of a document, your reading position, search terms, notes, anything about the Vault, your e-mail, account or store details, the advertising ID or any device ID. Nothing is recorded while a Vault document is open, while the Vault is unlocked or while the app is locked.

Anonymous ID: the events carry a random ID that the app creates when you allow the statistics. It is not linked to you, your device or your Google Play account. You can see and copy it in Settings > Security > Privacy.

Provider and place: the statistics are processed by PostHog (PostHog Inc.) on its servers in the European Union, as our processor. The PostHog project is set to discard the IP address of your connection, does not create person profiles, and records no screens, taps or recordings of the app (no session replay, no autocapture). The PostHog software in the app adds technical details: device manufacturer and model, operating system and version, screen size, app version, device language and time zone. The app removes the other details this software would add (mobile carrier, device name, emulator flag, browser user agent) before anything is sent. PostHog does not receive your documents. Events are sent in small batches when you are online; if the device stays offline, the oldest waiting events are dropped.

Retention: events are kept for 12 months, then deleted by PostHog.

How to stop: turn off Share anonymous usage data in Settings > Security > Privacy. Sending stops at once, events still waiting on the device are dropped, and the anonymous ID is deleted (if you turn it on again later, a new one is made). “No thanks” on the card means it is never shown again; closing the card without choosing shows it again no sooner than 30 days later, at most twice.

Deletion: to have the statistics already sent deleted, copy your anonymous ID in Settings > Security > Privacy before you turn the statistics off, and e-mail it to contact@tdhsoft.com. Without that ID we cannot tell which events are yours.

9. Permissions and why

Pagiro does not ask for location, contacts or the microphone. Without “All files access” you choose each file through the system file picker.

10. Children and teens

Pagiro is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Pagiro has no accounts: we collect no names, e-mail addresses or other account data from anyone, of any age. We follow the US Children’s Online Privacy Protection Act (COPPA): Pagiro shows no ads, and nothing it collects is used for advertising or profiling.

AI features: Summarize, Ask and Create with AI are for users aged 13 and over (16 and over in the European Economic Area, the United Kingdom and Switzerland). The first time you use them, the app asks you to confirm your age; it keeps only that you confirmed and the age asked, on your phone, never a birth date. If you are younger, the AI features stay off and the rest of the app works as before. AI results are written by an AI model, not a person, and may contain mistakes: check them before you rely on them. Because we do not know a user’s age, our AI service gives the model the same safety rules with every request, for everyone: no sexual content, no instructions for self-harm or dangerous activities, and a respectful tone.

Parents and guardians: if you think your child under 13 (or under 16 where that age applies to the AI features) has used Pagiro, or you have a question about your child’s data, write to contact@tdhsoft.com. Everything Pagiro keeps on the phone is deleted by uninstalling the app; AI data on our server is deleted with Settings > Security > AI > Delete my AI data, or we help you by e-mail.

11. Deleting your data

Uninstalling the app, or clearing the app’s data in your system settings, deletes everything Pagiro keeps on your device (library, settings, diagnostics log). Your original files are not deleted by this. We hold no copy of your documents: text sent to an AI feature is deleted within 15 minutes, and our AI service keeps only the numbers and hashes listed in section 7 (run records for 30 days; the credit balance while it is in use). Only the random AI wallet key stays in Google Block Store (section 7), so a reinstall finds your credits; it holds nothing else. To delete your AI data on our server, use Delete my AI data in the app, or write to contact@tdhsoft.com. For the optional anonymous usage statistics, see section 8 for how to stop them and how to ask for their deletion with your anonymous ID.

12. Changes

We will update this page when anything changes and show the date above.

13. Contact

Questions about privacy, or a request about your data: contact@tdhsoft.com.