Legal

Privacy Policy

Effective date: 8 October 2026 · Qovox OCR is operated by Qovox ("we", "us"). Contact: qovox222@gmail.com

The short version. The documents you scan with Qovox OCR are read inside your own browser and are never uploaded to us or to any third party. We only keep the small amount of account and licensing data described below.

1. Your documents

Images and PDFs you scan are decoded, enhanced and recognised on your device using WebAssembly. We do not receive, store, log or have access to the files or the text extracted from them. The result of a scan exists only in your page, and what you do with it is under your control.

When the SDK runs on a website built by one of our customers, the same applies to that website's visitors: their documents stay in their browser.

2. Data we collect

Account data

When you sign up we receive your email address, your name if you provide one, and a profile photo and sign-in provider if you use Google, GitHub or Apple. Passwords are handled by Firebase Authentication and are never visible to us.

Licensing and usage data

License keys: stored only as a one-way hash plus a short preview, together with the label and the domains you allow.
License checks and usage counters: each time the SDK starts or finishes scanning it sends the license key, the website address (origin), the SDK version and a page count. We store counts per key and per month, and the time a key was last seen. No document content is included.
Plan and billing requests: your plan, upgrade requests, and, if you pay through Paddle, the identifiers Paddle gives us (we do not see your card number).
Administrative log: actions taken by our administrators on accounts and keys are recorded for security and support.

Website analytics

The qovox-ocr.web.app website uses Google Analytics for Firebase to understand how pages are used (page views, device and approximate location). The SDK itself does not run analytics inside your own application.

Technical data

Like any web service, our servers and our providers process IP addresses and request metadata to deliver the service and prevent abuse.

3. How we use it

to provide, secure and support the service (sign-in, license checks, quotas, domain locking);
to bill or to process plan changes;
to contact you about your account, security or service changes;
to understand and improve the website and the product;
to prevent fraud and abuse and to comply with the law.

We do not sell your personal data and we do not use it for advertising.

4. Where data is processed: our providers

Google Firebase (Authentication, Hosting, Analytics): sign-in, website hosting, site analytics.
Cloudflare (Workers and D1): our license API and its database.
Paddle (only if enabled): payment processing as merchant of record.
Content delivery networks (jsDelivr, cdnjs, the Tesseract language-data host): to deliver the open-source OCR engine, PDF reader and language models to your browser. Those requests reveal your IP address to the CDN, as with any hosted script, but contain no document data. You can self-host these files (see the documentation) to avoid third-party requests.

These providers may process data in countries outside your own. Where required, they rely on recognised transfer mechanisms.

5. Cookies and local storage

We use browser storage for sign-in state (Firebase), a small cache of your name and photo so the header does not flicker, and the cached language models that make later scans faster. Analytics may set identifiers as described by Google. You can clear this data in your browser settings at any time.

6. Retention

Account and licensing data is kept while your account is open. Usage counters are kept for billing and quota history. When you delete your account, or ask us to, we remove your account, keys and usage records from our licensing database; backups and logs expire on their normal schedules. We may keep information we are legally required to keep, such as invoices.

7. Your rights

Depending on where you live (for example under the GDPR), you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to complain to your data-protection authority. Email qovox222@gmail.com from the address on your account and we will respond within 30 days. You can also change your name and password from the Profile page.

8. Security

License keys are stored hashed, access to administration is restricted to verified owner accounts and checked on the server for every request, and traffic is encrypted in transit. No system is perfectly secure, so please use a strong, unique password.

9. Children

Qovox OCR is not directed to children under 16 and we do not knowingly collect their personal data.

10. If you use the SDK in your own product

Because documents never reach us, you remain the party responsible for how your application stores, transmits and uses the text it extracts, and for telling your own users about that. We act as a processor only for the licensing data described above.

11. Changes

We may update this policy. The effective date above shows the latest version, and we will give notice of material changes on the website or by email.

Questions? qovox222@gmail.com · See also our Terms of Service.