Privacy Policy

PDF Reader – File Opener · Android

Updated on 06.10.2026. 

This Privacy Policy explains how we collect, use and share personal information when you use the App, and the choices you have. It applies to the PDF Reader – File Opener app for Android (store ID pdf.reader.document.viewer), called the "App" below. Each of our apps has its own privacy policy.

WAVE DESIGN STUDIO SRL ("we", "us") is responsible for your personal information as its controller (section 1).

We don't offer accounts in the App, so we don't know your name or email unless you write to us. The content you create or open in the App (for example text, drawings, documents, scans, photos and camera images) stays on your device.

If you live in California or another US state with a privacy law, see section 9.2 for your rights. If you live in the EEA, the UK or Switzerland, see section 9.1; everywhere else, see section 9.3.

1. Who we are and how to reach us

The controller of your personal information is:

WAVE DESIGN STUDIO SRL,

Drm. PADUREA NEAGRA 1-17, BL. A56, AP. 2, Sect. 1, BUCURESTI, ROMANIA .

For any question about this policy or your personal information, email contact@wave.studio, or write to the address above, marked "Privacy".

2. What the App collects

2.1 What the App collects automatically

When you use the App, we and our partners collect:

• Identifiers: your device's advertising ID (on iPhone, the IDFA only if you allow tracking), the Firebase app-instance and installation IDs, the App Set ID or IDFV, your push-notification token, and the subscription profile ID that Adapty assigns.
• Approximate location: country and region derived from your IP address. We do not collect precise location.
• Device information: device model, operating system and version, language, app version.
• Usage information: screens viewed, features used, paywalls shown, and the ads you see and tap.
• Diagnostics: crash logs and performance data.

Our own server. The App downloads content (such as templates) from our own server; the server receives your IP address, the app version and your country setting.

We link these pseudonymous identifiers to each other (for example, the Firebase app-instance ID with the Adapty profile ID), so that analytics, purchases and attribution refer to the same installation. We do not combine them with your name, email or other information that identifies you directly.

2.2 What you give us

• Support messages. If you email us, we receive your email address and whatever you write.
• Purchases. If you buy a subscription, Google Play or the App Store handles the payment. We never receive your card details; we receive the subscription status, product, purchase date and a store transaction ID.
• Settings and choices you make in the App, such as your consent and tracking choices, which are stored on your device.

2.3 What we receive from others

• Google Play and the App Store tell us about your purchase and subscription status, through Adapty.
• Google Play tells us how the App was installed (install referrer).
• Singular tells us which ad campaign, if any, led to your install.
• Advertising partners report which ads were shown and how they performed.

2.4 What stays on your device

We do not collect sensitive personal information. The App may ask for device permissions, which you can refuse or withdraw in your device settings; what they give access to stays on your device:

• Camera: used only on your device, for example for a live preview or to scan a page; images are never recorded or sent to us.
• Microphone: used only on your device, for example to measure the sound level for a sound-reactive effect; audio is never recorded or sent to us.
• Files and photos: what you open or pick is processed on your device and never uploaded.
• Notifications: used to show you notifications; you can turn them off at any time.

On Android, the App's content and settings may be included in your own Google device backup if you have backup turned on.

3. Tracking, ads and your choices

3.1 Consent and tracking

The App contains software development kits (SDKs) from our partners, listed in the Appendix. These SDKs read and store identifiers on your device to provide analytics, crash reports, attribution and advertising.

In the EEA, the UK and Switzerland, the App shows Google's consent message, which follows the IAB Transparency & Consent Framework, the first time you open it. Your choice controls whether ads are personalised. Our attribution partner (Singular), our subscription partner (Adapty) and Google Analytics for Firebase currently start when the App opens, before you answer the message; Google Analytics for Firebase follows the "Stop tracking" setting in Settings › My Data.

Crash reporting runs for everyone because we need it to keep the App working; it does not use advertising identifiers.

On iPhone and iPad, we ask for permission through Apple's App Tracking Transparency prompt before we or our partners access your device's advertising identifier (IDFA).

3.2 Your ad choices

The App is free because it shows ads. Ads can be contextual (based on the App) or personalised (based on your device's advertising ID and your activity across apps), depending on your choices and the law where you live.

• Consent (EEA, UK, Switzerland): you choose in Google's consent message the first time you open the App, and can change your choice at any time in Settings › My Data › Manage ad consent.
• App Tracking Transparency (iPhone, iPad): if you choose "Ask App Not to Track", we don't access the IDFA; ads still appear and are measured through Apple's privacy-preserving SKAdNetwork. Change it at any time in Settings › Privacy & Security › Tracking.
• Advertising ID (all devices): reset or delete it in your device settings (Android: Settings › Privacy › Ads; iPhone: Settings › Privacy & Security › Tracking). Without it, ads are less relevant but still appear.
• "Stop tracking" in Settings › My Data: turns off Google Analytics for Firebase and Crashlytics; it does not stop advertising or attribution partners.

• Do Not Track: we don't respond to the browser "Do Not Track" signal; the App is not a browser.
• Ad-free subscription: if you buy a subscription that removes ads, we stop showing ads; analytics, attribution and purchase processing continue under your choices above.

4. Why we use your information

We use personal information only for these purposes. In the EEA, the UK and Switzerland, each purpose relies on the legal ground shown.

Note: consent applies in the EEA, the UK and Switzerland; elsewhere, these uses are subject to your opt-out rights in sections 3.2 and 9.2. We rely on legitimate interests only where they are not outweighed by your rights. You can withdraw consent at any time (section 3.2); this does not affect processing that happened before.

5. Who receives your information

We don't sell your personal information for money. We share it only as follows:

• Affiliated companies. We share personal information with our affiliated companies, which can manage the development and publishing of the App for us. Section 6 gives the details.
• Service providers that process personal information only on our instructions and under a data-processing contract: Google (Firebase), Adapty and Cloudflare.
• Advertising and measurement partners that also use the data for their own purposes, as independent controllers under their own privacy policies: Google (AdMob), Singular, and the advertising networks listed in the Appendix, any of which may be active at any time. Adapty forwards purchase events (subscription started, renewed, cancelled) from its servers to Singular and Google Analytics for Firebase.
• Legal matters and safety. When the law requires it, or to protect the rights, property and safety of our users, the public or us.
• Successor organisation. If we are involved in a merger, acquisition or sale of assets, the buyer receives personal information and must honour this policy.
• With your consent, for any other purpose we tell you about first.
• Aggregated information that no longer identifies anyone, for any purpose.

The Appendix lists each partner, what it receives, why, and for how long. We work only with partners that contractually commit to protect personal information to a standard at least equal to this policy and to the App Store and Google Play requirements.

6. Our affiliated company and international transfers

Our affiliated companies are companies that can manage the development and publishing of our apps. The affiliated company that may receive personal information from the App is in Romania, in the European Union:

Some partners, mainly Google, Singular, Adapty, Cloudflare and the advertising networks in the Appendix, process personal information in the United States and other countries outside the EEA. For the US we rely on the EU-US Data Privacy Framework where the partner is certified (and its UK Extension and the Swiss-US framework for UK and Swiss data), and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum). For other countries we rely on an adequacy decision or the Standard Contractual Clauses.

You can ask us for a copy of these safeguards at contact@wave.studio.

7. How long we keep it

We keep personal information only as long as we need it for the purposes in section 4, then delete it or make it anonymous:

8. Deleting your data and other requests

Because we don't hold your name or email, include the IDs shown in Settings › My Data when you write to us, so we can find your personal information.

Settings › My Data › Delete my data removes the content and settings stored on your device and resets the analytics identifier on your device. To have the data our partners hold deleted too, email contact@wave.studio with the IDs shown in Settings › My Data. We will ask Google (Firebase), Singular and Adapty to delete the records linked to those IDs within 30 days and tell you when the requests are done.

Deleting your data does not cancel a subscription; manage that in your App Store or Google Play account. Advertising partners hold data under your advertising ID; reset or delete it in your device settings, or contact the partner using the links in the Appendix.

9. Your rights where you live

9.1 EEA, UK and Switzerland

If you are in the EEA, the UK or Switzerland, you can:

• request access to your personal information;
• request correction of your personal information;
• request erasure of your personal information (section 8);
• request restriction of processing your personal information;
• request transfer of your personal information;
• object to processing based on our legitimate interests, at any time;
• withdraw consent at any time, without affecting earlier processing.

To use these rights, email contact@wave.studio. We answer within one month, and may extend this by two more months for complex requests, telling you why. Using your rights is free unless a request is manifestly unfounded or excessive.

You can complain to the Romanian data protection authority (ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, dataprotection.ro), to the authority where you live or work, or in the UK to the Information Commissioner's Office (ico.org.uk).

9.2 United States

Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas, Oregon and others) have these rights, as their state law provides:

• Access and confirmation: confirm whether we process your personal information, and get a copy.
• Deletion: see section 8.
• Correction of inaccurate personal information.
• Opt-out of sale, "sharing" and targeted advertising: see "Do Not Sell or Share" below and section 3.2.

Exercising your privacy rights. Email contact@wave.studio, with the IDs shown in Settings › My Data. We answer within 45 days, and may extend this once by 45 days, telling you why. You may use an authorised agent; we will ask the agent for your signed permission. If we refuse your request, reply with the subject "Appeal" within 60 days; we answer within the time your state's law sets. If we deny the appeal, you can contact your state Attorney General. Using these rights doesn't change the App or its price.

Information collected, sources and business purposes (last 12 months):

Do Not Sell or Share My Personal Information (California and other states). We disclose identifiers, approximate location and app and ad activity to the advertising and measurement partners in the Appendix. State laws may treat this as "selling" or "sharing" personal information, or as "targeted advertising", even though we receive no money for the data.

• email contact@wave.studio with the subject "Do Not Sell or Share", and reset or delete your advertising ID.

The App does not receive browser-based opt-out preference signals such as Global Privacy Control. We don't knowingly sell or share personal information of anyone under 16.

California Shine the Light. We don't share personal information with third parties for their own direct-marketing purposes as that law defines it.

Nevada residents. We don't sell covered information as Nevada law defines it.

9.3 Everywhere else

Wherever you live, you can ask us to access, correct or delete your personal information, or to stop using it for personalised ads, by emailing contact@wave.studio with the IDs shown in Settings › My Data. We answer within 30 days, or sooner if your local law requires it. You can also complain to the data protection authority in your country.

10. Children

The App is made for a general audience aged 13 and over and is not directed to children. We do not knowingly collect personal information from children under 13, or, in the EEA and UK, from children under the age of digital consent where they live (16 in Romania; 13 to 16 elsewhere in the EEA; 13 in the UK) without the parental consent the law requires. If you believe a child has used the App and we hold their personal information, email contact@wave.studio and we will delete it.

11. Security

We protect personal information with technical and organisational measures suited to the risk, including encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Updates to this policy

When we change this policy, we update the version and effective date at the top and keep earlier versions at stable links. If a change materially affects how we use your personal information, we tell you in the App before it takes effect.

What changed in version 3.0: a new policy written for this App, replacing the shared October 26, 2024 version. It names the controller per platform, lists our partners, gives retention periods, and describes deletion and opt-out as they actually work.

---

Appendix: our partners and what they receive

The App uses Google, Singular, Adapty and Cloudflare. We may also share personal information with any of the advertising partners listed here: they may be active for the App at any time, because we switch advertising partners on and off, and a partner receives data only while it is active.