Privacy Policy

Overview

Our Privacy Commitment

AudiFlo is designed with privacy-first principles:

• Offline-first design - Your reading content stays on your device
• No content uploads - We never upload your PDFs, EPUBs, or documents to our servers
• Optional cloud sync - You control whether to sync settings across devices
• Local processing - Text-to-speech happens entirely on your device
• Minimal data collection - We only collect what's necessary for app functionality
• No advertising - We don't use your data for targeted ads or sell it to third parties
• Transparent practices - Clear explanation of what data we collect and why

Information We Collect

We collect minimal information necessary to provide and improve AudiFlo's functionality. Here's a complete breakdown:

1. Information You Provide Directly

Account Information (Optional - Only if you sign in)

When you choose to sign in with Google, we collect:

Important: Account creation is entirely optional. You can use AudiFlo fully offline without signing in.

User-Generated Content (Stored Locally Only)

The following data is created by you and never uploaded to our servers:

• Imported documents - PDFs, EPUBs, and text files you import
• Reading progress - Current page, position, and completion percentage
• Bookmarks - Saved reading positions
• Highlights - Text selections you highlight
• Annotations - Notes and comments you add
• Custom pronunciations - Corrections for TTS mispronunciations
• Character voice assignments - Custom TTS voice mappings for characters
• Library metadata - Book titles, authors, covers (extracted from files)

Privacy Note: This content remains on your device. We cannot access, view, or recover it.

2. Information Collected Automatically

Usage & Analytics (Firebase Analytics)

To improve app performance and user experience, we collect anonymized usage data:

Analytics Privacy:

• All analytics data is anonymized and cannot be traced back to you personally
• We use Firebase Analytics with IP anonymization enabled
• No personally identifiable information (PII) is included in analytics
• You can opt out of analytics (see Your Rights & Choices)

Device Information

We collect technical device information for compatibility and optimization:

• Device model and manufacturer (e.g., Samsung Galaxy S24, Google Pixel 8)
• Operating system version (e.g., Android 14)
• Available TTS engines (e.g., Google TTS, Samsung TTS) - to show compatible voices
• Available TTS voices (e.g., English (US) - Female) - for voice selection
• Screen resolution and orientation - to optimize reading layout
• App language preference - to display UI in your language

Privacy Note: This information is used solely for app functionality and is not linked to your identity.

Advertising Data

• Advertising Data: Interactions with ads (views, clicks) and Advertising IDs (e.g., Android Advertising ID) for ad delivery and frequency capping.

3. Information Synced to Cloud (Optional - Only if Signed In)

If you enable cloud sync, the following settings only are uploaded to Firebase Firestore:

What We DO NOT Sync:

• Your imported documents (PDFs, EPUBs, text files)
• Reading content or book text
• Reading progress, bookmarks, highlights
• Annotations or notes
• Library metadata or book covers
• Any file contents whatsoever

Privacy Guarantee: Cloud sync is **disabled by default** and requires explicit opt-in through Google Sign-In.

How We Use Your Information

We use collected information solely for the following purposes:

Core App Functionality

Cloud Synchronization (Optional)

App Improvement & Support

Personalization

We DO NOT Use Your Data For:

• Targeted advertising or ad personalization
• Selling to third-party data brokers
• Training AI models on your reading content
• Behavioral profiling or tracking across apps
• Marketing analytics or audience segmentation
• Sharing with advertisers or marketing partners

Data Storage & Security

We take your data security seriously and implement multiple layers of protection.

Local Data Storage (On Your Device)

Security Philosophy

We use a layered security approach to balance performance and protection:

• Android App Sandbox: The primary security layer. Your data (books, settings) is isolated from other apps.
• Selective Encryption: Highly sensitive data (auth tokens, notification statistics) receives additional AES-256 encryption.

Encryption Implementation

We apply AES-256-GCM encryption specifically to sensitive credentials and statistics:

What Gets AES-256 Encrypted:

• Authentication tokens (if signed in)
• Notification history and statistics
• Sensitive configuration flags

What Uses Standard Sandbox Protection:

• Imported books and documents (SQLite database & Files)
• General user preferences (TTS speed, voice selection)
• Bookmarks and reading progress

Note: Sandbox protection prevents other apps from accessing this data on non-rooted devices.

Secure Storage Libraries

We use trusted, audited storage libraries:

• flutter_secure_storage - For storing encrypted keys and tokens
• EncryptedSharedPreferences - For sensitive preferences
• sqflite (SQLite) - For structured data (books, chapters)

Cloud Data Storage (Firebase - If Signed In)

Firebase Security Architecture

When you enable cloud sync, settings are stored in Google Firebase Firestore with multiple security layers:

Firebase Security Rules

Your cloud data is protected by strict Firebase security rules:

// Only you can read/write your own data
match /users/{userId} {
  allow read, write: if request.auth.uid == userId;
}

This means:

• Only you can access your synced settings
• Other users cannot see or modify your data
• Even AudiFlo developers cannot access your data without explicit authorization
• All access is logged and auditable

Data Centers & Infrastructure

• Hosting: Google Cloud Platform (Firebase infrastructure)
• Locations: Data may be stored in multiple global regions for redundancy
• Compliance: Firebase adheres to SOC 2, ISO 27001, and other security certifications
• Backups: Automatic backups for disaster recovery (subject to Firebase retention policies)

Additional Security Practices

Network Security

• All data transmitted over the internet uses TLS 1.3 / HTTPS encryption
• Certificate pinning prevents man-in-the-middle attacks
• No data is sent over unencrypted HTTP connections

Code Security

• Regular security audits of our codebase
• Dependency vulnerability scanning
• Secure coding practices following OWASP guidelines
• No hardcoded secrets or API keys in the app

Device Security Recommendations

• Use a device lock screen (PIN, pattern, biometric)
• Keep Android OS and AudiFlo updated
• Only download AudiFlo from official Google Play Store
• Enable Google Play Protect for malware scanning

Data Breach Response

In the unlikely event of a security breach:

1. We will notify affected users within 72 hours
2. We will disclose what data was compromised
3. We will provide guidance on protective measures
4. We will report to relevant authorities as required by law

Third-Party Services

AudiFlo integrates with trusted third-party services. Here's complete transparency on what they access:

1. Firebase (Google LLC)

Services Used: Firebase Authentication, Cloud Firestore, Firebase Analytics, Firebase Remote Config, Firebase Crashlytics

Data Shared: Email address, name, Google UID (if signed in), TTS settings, voice preferences (if cloud sync enabled), Anonymized app usage events, Crash logs and stack traces (anonymized).

Privacy Policy: Google Firebase Privacy

Our Safeguards: Firebase Analytics IP anonymization enabled, User-only security rules on Firestore, Minimal data collection configuration, No Firebase data sharing with Google Ads.

2. Google Sign-In

Service Purpose: Optional authentication for cloud sync

Data Accessed: Email address, Display name, Profile photo URL, Google User ID

Privacy Policy: Google Account Privacy

Your Control: You can revoke AudiFlo's access anytime at Google Account Permissions

3. System Text-to-Speech Engines

Service Purpose: Convert text to spoken audio

Engines Supported: Google Text-to-Speech, Samsung TTS, Other device-specific TTS engines

Privacy Note: TTS processing happens entirely on your device. Your reading content never leaves your device during TTS playback. We don't control or access TTS engine data handling.

4. Syncfusion PDF Library

Service Purpose: Extract text from PDF files for TTS playback

Privacy: PDF processing happens entirely on your device. No PDF content is sent to Syncfusion servers. Syncfusion has no access to your documents.

License: Commercial license (no data sharing requirements)

5. Google Play Services

Service Purpose: App distribution, updates, licensing verification

Data Accessed: Device information for compatibility, Installation and update events, License verification

Privacy Policy: Google Play Privacy

6. Google AdMob

Service Purpose: Displaying advertising content to support the App.

Data Collected: Device Identifiers (Advertising ID), approximate location, cookies, and usage data.

Usage: To show personalized or non-personalized ads, measure ad performance, and prevent fraud.

Privacy Policy: Google AdMob Privacy

Opt-Out: You can control personalized ads in your device settings (Settings > Google > Ads) or via Google Ad Settings.

Third-Party Data Sharing Summary

Data Sharing & Disclosure

What We DO NOT Do

We DO NOT:

• Sell your personal information to data brokers or advertisers
• Share reading content (PDFs, EPUBs, documents) with anyone
• Use data for targeted advertising or ad personalization
• Share data with marketing partners or analytics companies beyond Firebase
• Track your reading behavior for commercial purposes
• Rent or lease your data to third parties
• Provide data to AI training companies to train language models
• Cross-reference your data with other databases or services

When We May Disclose Data

We may disclose limited information only in these specific circumstances:

1. With Your Explicit Consent

• If you explicitly authorize data sharing for a specific purpose
• For example, if you request us to share data with customer support

2. Legal Compliance & Law Enforcement

• To comply with valid legal processes (court orders, subpoenas)
• To respond to government requests as required by law
• To enforce our Terms & Conditions
• To protect our legal rights or defend against legal claims

Legal Request Policy: We will notify you of legal requests unless legally prohibited, challenge overly broad or inappropriate requests, and provide only the minimum data required by law.

3. Safety & Security

• To prevent fraud, abuse, or security threats
• To protect the safety of users or the public
• To investigate Terms violations or illegal activity

4. Business Transfers

• In the event of a merger, acquisition, or sale of assets
• Successor entity must honor this Privacy Policy
• We will notify you 30 days before any ownership change

5. Aggregated & Anonymized Data

• We may share anonymized, aggregated statistics that cannot identify you
• Examples: "80% of users prefer dark mode" or "Average session duration: 25 minutes"
• Used for research, press releases, or public presentations

Data Processors

We use trusted third-party processors who handle data on our behalf:

All processors are contractually required to use data only for specified purposes, implement appropriate security measures, not disclose data to unauthorized parties, and delete data when no longer needed.

Your Rights & Choices

You have full control over your data. Here are your rights and how to exercise them:

Our Commitment: We prefer to resolve concerns directly. Please contact support@zrota.us first.

Data Retention

We retain data only as long as necessary for app functionality and legal compliance.

Local Data (On Your Device)

Control: You have complete control. We cannot access or delete local data remotely.

Cloud Data (Firebase - If Signed In)

Analytics & Crash Data

• Firebase Analytics events: 14 months (governed by Firebase retention policy)
• Crash reports: 90 days (governed by Firebase Crashlytics policy)
• Performance metrics: 90 days (governed by Firebase Performance policy)

Automatic Deletion: Firebase automatically purges analytics data after retention periods.

Legal Retention

We may retain certain data longer if required by legal obligations, ongoing legal disputes, or legitimate business interests (fraud prevention, security). We will inform you if we must retain your data beyond normal retention periods.

Children's Privacy

AudiFlo requires users to be at least 13 years of age (or 16+ in certain jurisdictions where applicable).

COPPA Compliance (USA)

We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

No Directed Content

AudiFlo is not designed or marketed to children under 13.

Parental Notice

If you are a parent or guardian and believe your child under 13 has provided personal information to AudiFlo, please contact us immediately at support@zrota.us and we will delete the account and all associated data within 30 days.

International Data Transfers

AudiFlo is developed in India and uses Firebase infrastructure hosted by Google, which may process data in various global regions. This means your data may be transferred to and processed in countries outside India.

Transfer Safeguards

• Standard Contractual Clauses (SCCs) - Google (Firebase) uses EU-approved Standard Contractual Clauses
• Encryption in Transit - All data transferred internationally uses TLS 1.3 / HTTPS encryption
• Firebase Security Certifications - SOC 2 Type II, ISO 27001, GDPR-compliant infrastructure

Your Rights by Region

• EU/EEA/UK: Full GDPR rights apply (access, deletion, portability, etc.)
• India (DPDP Act): Rights under Digital Personal Data Protection Act 2023 apply
• California (CCPA/CPRA): Right to know, delete, and opt out of data sales (we don't sell data)
• Other Regions: We respect data protection rights recognized in your jurisdiction. Contact support@zrota.us

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in data practices, new features, or legal requirements.

Notification of Changes

• Minor Changes: Update the "Last Updated" date at the top, post revised policy in-app.
• Material Changes: Update "Effective Date", notify via in-app notification and email (if signed in) with 30 days' notice.

Continued use of AudiFlo after changes take effect constitutes acceptance of the updated Privacy Policy.

Version History

You can request previous versions of this Privacy Policy by emailing support@zrota.us.

Contact Us

Email: support@zrota.us
Developer: ZrotA
Location: Assam, India

Specific Requests

What to Include in Your Request

For faster processing, please include your name and account email (if signed in), clear description of your request, and any relevant details (e.g., device model, app version).

Data Protection Officer

For formal data protection inquiries, email support@zrota.us (mark "ATTN: Data Protection"). We will designate a formal DPO when required by law.

Complaints & Escalation

1. Escalate internally: Reply to our response requesting escalation
2. File a complaint: Contact your local data protection authority
3. Legal action: You may have the right to pursue legal remedies

Additional Information

Google Play Data Safety Disclosure

As required by Google Play, here's our complete data safety disclosure:

Security Practices

• Data encrypted in transit - TLS 1.3 / HTTPS for all network communication
• Data encrypted at rest - AES-256-GCM for sensitive local data
• User can request deletion - Via Settings > Account > Delete Account
• No third-party data sharing - Your data stays with AudiFlo and Firebase only
• Compliant with Google Play Families Policy - When applicable

Open Source Privacy

AudiFlo uses open-source libraries with audited privacy practices:

• Firebase SDK (Apache License 2.0)
• flutter_secure_storage (BSD-3-Clause)
• Google Sign-In (Google APIs)

Full license attributions available in Settings > About > Open Source Licenses

Summary - Your Privacy in Plain English