Android app

Privacy Policy — PDF Tools

Last updated: September 18, 2026

This privacy policy applies to the PDF Tools Android app (com.gookkis.pdftools), developed and published by Heri Kiswanto ("we"). It explains what data is processed when you use the app, by whom, and what choices you have.

Quick summary

  • The app does not collect any personal data on our servers. We do not operate a server.
  • There is no account, sign-in, or cloud sync.
  • Your document content is never uploaded. Every PDF operation — merge, split, remove pages, rotate, compress, photos to PDF, PDF to images, lock and unlock — is done by the PDF engine that ships inside the app, on your own device.
  • The app asks for no storage permission. Files are opened through the system file picker and saved wherever you point it.
  • A password you use to lock or unlock a PDF is used there and then, and forgotten afterwards. It is never stored and never sent anywhere.
  • The app shows ads through Google AdMob, which as a third party may collect certain data (see below).
  • The Scan to PDF feature uses the document scanner from Google Play services, which downloads its component the first time it is used.
  • Beyond that, there is no analytics SDK, crash reporter, tracker, or other third-party service in the app.

Data we collect

None. We do not request, collect, store, transmit, or sell your personal data — including your name, email address, phone number, contacts, photos, location, or the list of apps installed on your device. The app has no backend, no database, and no usage reporting to us.

The documents you work on are not an exception to that. A document is read from the location you picked, processed on the device, and written back where you point it. No path inside the app sends a page, an image, a file name, or a document password to us or to anyone else.

The app makes network requests for two things only: loading ads, and — once, the first time you use Scan — downloading the scanner component from Google Play services. Both are described below.

Data stored on your device

To do its job, the app stores a small amount of data locally in your device's internal storage:

  • your display preference: light theme, dark theme, or following the system;
  • a flag recording that you have been through the intro screens;
  • the daily allowance counter — how many operations you have used today and the date, so the allowance can refill tomorrow;
  • the expiry time of an ad-free pass, if you watched a rewarded ad to get one;
  • a simple counter that decides when the app offers to ask for a review.

Result files are written first into the app's own private cache so that you can open, save or share them from the result screen. That space is cleared every time the app starts and every time a new operation begins, so old results do not pile up on the device. A file you saved yourself with "Save to device" sits wherever you chose and the app does not touch it again.

This data:

  • is never sent to us or to anyone else;
  • may be included in your account's Google backup (Android Backup) if app backup is enabled on your device — that backup is managed by Google and accessible only to your account;
  • is removed entirely when you clear the app's data or uninstall the app.

Third-party advertising (Google AdMob)

The app is free and funded by ads served through Google AdMob, a service of Google LLC. To serve and measure ads, Google as a third-party provider may collect and process data from your device, including:

  • the Advertising ID (AAID) — an advertising identifier you can reset at any time;
  • the IP address and the coarse location derived from it;
  • device information such as model, operating system version, language and mobile carrier;
  • ad interactions such as which ads were shown, viewed or clicked.

That data is collected directly by Google, not by us, and is subject to the Google Privacy Policy. A more detailed explanation is available in How Google uses information from sites or apps that use our services. The ads never contain anything from your documents: the ad SDK receives neither the files you work on nor their names.

For users in the European Economic Area, the United Kingdom and Switzerland, the app shows Google's consent form (User Messaging Platform) before any ad loads. Your choice there decides whether Google may serve personalised ads, and you can change it again from the Settings screen inside the app.

The app also offers rewarded ads: watching one short ad adds one operation to your daily allowance, and one row in Settings trades a single ad for two hours without ads. Watching is always your choice — no feature is locked behind it, and declining costs you nothing beyond that extra operation.

Document scanner (ML Kit from Google Play services)

The Scan to PDF feature does not use a camera of the app's own. The app calls the document scanner from ML Kit provided by Google Play services: the camera view, the edge detection and the page cropping all run in Google's component, not in our code. That is why this app asks for no camera permission at all.

The first time it is used, that scanner component is downloaded from Google Play services; it is the only part of the app that needs a connection besides ads. Google documents the ML Kit Document Scanner as processing on the device. Because its interface runs inside Google Play services and outside our app's process, its data handling is governed by the Google Privacy Policy and the ML Kit Terms, not by this policy. All we receive back from the scanner are the resulting pages, and those are turned into a PDF on the device straight away.

In-app purchases

The app is set up for a single one-time purchase ("Pro") that removes the daily limit and every ad. In this version no purchase can be made: the product is not listed on Google Play yet, so the offer never reaches a payment screen and no payment data is processed at all. The Google Play Billing library ships inside the app — which is why the com.android.vending.BILLING permission appears in the permission list.

When purchasing is switched on later, the whole transaction will be handled by Google Play. We will never receive or store a card number, a billing address, or any payment detail; all that is stored on the device is a marker that the entitlement is active. This page will be updated at that point.

App permissions

Permissions the app requests directly:

  • android.permission.INTERNET — loading ads, and downloading the scanner component the first time it is used.
  • com.google.android.gms.permission.AD_ID — access to the Advertising ID for advertising purposes.

The following permissions are added automatically by the libraries the app uses, and are used only by those libraries:

  • android.permission.ACCESS_NETWORK_STATE — checking that a connection exists before loading an ad.
  • android.permission.WAKE_LOCK and android.permission.FOREGROUND_SERVICE — used by the ads SDK while loading ad creatives, and by WorkManager so that a PDF operation in progress is not stopped by the system halfway through.
  • android.permission.ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS — the Android Privacy Sandbox advertising APIs on Android 13 and above.
  • com.android.vending.BILLING — added by the Google Play Billing library that ships inside the app. See "In-app purchases" above.

The app requests no storage, camera, microphone, location, contacts or notification permission, and no other sensitive permission. Files come in and go out entirely through the system file picker (the Storage Access Framework), which gives the app access only to the files you pick yourself.

Your choices

  • Turning off personalised ads. Open Settings › Google › Ads on your Android device and turn on "Opt out of Ads Personalisation" or delete the Advertising ID. Ads will still appear, but they will no longer be personalised. Users in Europe can also change their ad consent choice from the Settings screen inside the app.
  • Resetting the Advertising ID. From the same menu, you can reset the advertising identifier at any time.
  • Using the app without a connection. Nine of its ten tools work fully offline; only Scan needs a connection the first time, to download its scanner component. With no connection, no ads are loaded.
  • Not using Scan at all. If you never open Scan to PDF, Google's scanner component is never downloaded and never run.
  • Removing result files. A result you have not saved disappears by itself when the next operation starts or when the app is opened again. A file you did save sits where you chose and can be deleted like any other file.
  • Deleting all your data. Since everything is stored locally, clearing the app's data (Settings › Apps › PDF Tools › Storage › Clear data) or uninstalling the app permanently removes all of it. There is no copy left on our side, because we never received it.

Children's privacy

The app is a general-purpose utility for anyone who needs to fix a PDF file, and it is not directed at children under 13. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at the address below.

Security

All connections to the ad network and to Google Play services use HTTPS. Because the app sends no documents and no personal data to any server, there is no copy of your documents on our side that could leak. The document being processed and the result files live in the app's private space, isolated from other apps by the Android operating system, and a PDF password stays in memory only for the duration of the operation.

Changes to this policy

This privacy policy may be updated from time to time, for example when a feature or a third-party service changes. The latest version is always published on this page with a new update date.

Contact

Questions about this privacy policy can be sent to admin@gookkis.com.