Privacy Policy — HearDocs

1. Introduction

Welcome to HearDocs ("we", "us", or "our"). HearDocs is a web-based application that allows users to upload PDF documents, extract text (including via OCR), convert text into audio using text-to-speech technology, and organize and share content.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service at hear-docs.com.

By using HearDocs, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following types of information:

Account Information

• Email address — used to create and manage your account.
• Password — securely hashed and managed by our authentication provider (Supabase). We never store or have access to your plaintext password.

User-Uploaded Content

• PDF documents — files you upload for text extraction and audio conversion.
• Generated audio files — audio produced from your documents using our text-to-speech system.

Usage Data

• Server logs that may include your IP address, browser type, pages visited, and timestamps. These are used solely for security and operational purposes.

Payment Information

• If you subscribe to a paid plan, payment is processed by Creem Payments. We do not store your credit card number or full payment details. Creem Payments may collect billing information as required to process your transaction, and may receive your email address to send transaction-related communications (such as purchase confirmations or checkout reminders).

3. How We Use Your Information

We use the information we collect to:

• Provide the Service — authenticate your account, process your documents, generate audio, and store your content.
• Process payments — manage subscriptions and billing through our payment processor.
• Ensure security — detect abuse, enforce rate limits, and protect the integrity of the Service.
• Improve the Service — monitor system performance and fix technical issues.
• Communicate with you — respond to support requests or send essential service-related notices.
• Send transaction-related communications — our payment processor may send emails related to your purchase, such as checkout reminders, payment confirmations, and subscription notices. These are transactional communications, not marketing.

We do not use your data for advertising, profiling, or selling to third parties.

4. Legal Basis for Processing

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:

• Contractual necessity — processing your data is necessary to provide the Service you signed up for (account management, document processing, audio generation).
• Consent — where applicable, such as when you voluntarily upload content or create an account.
• Legitimate interests — to maintain security, prevent fraud, improve the Service, and send transaction-related communications (such as reminders to complete an initiated purchase), provided these interests do not override your fundamental rights.
• Legal obligation — to comply with applicable laws and regulations.

5. Data Sharing and Third Parties

We share your data only with the following service providers, strictly as necessary to operate HearDocs:

• Supabase — authentication and user account management. Supabase receives your email and hashed password.
• Cloudflare — content delivery (CDN), DNS, and file storage (Cloudflare R2). Your uploaded PDFs and generated audio files are stored on Cloudflare R2.
• Vultr — server hosting. Our application servers run on Vultr infrastructure.
• RunPod — GPU infrastructure used to run our proprietary text-to-speech model. The text extracted from your documents is sent to our own model running on RunPod exclusively for audio generation. RunPod may retain operational logs that are outside our direct control.
• Google (Gemini API) — text extracted from your documents may be processed through Google's Gemini API for cleaning and preparation before audio generation. Only document text is sent; no personal account data is transmitted.
• OpenAI — same purpose as Google Gemini: text cleaning and preparation of document content before audio generation.
• Anthropic — same purpose as Google Gemini: text cleaning and preparation of document content before audio generation.
• Creem Payments — payment processing and subscription management for paid plans. Creem receives your email address and may send transaction-related communications on our behalf (such as purchase confirmations or checkout reminders).

Important: Our OCR processing (Tesseract) runs locally on our servers. Your PDFs are not sent to any third-party OCR API. Our text-to-speech model is proprietary (developed by HearDocs) but runs on third-party GPU infrastructure (RunPod). Before audio generation, the extracted text may be processed by third-party AI services (Google Gemini, OpenAI, Anthropic) for cleaning and preparation. Only document text is sent to these providers; no personal account information is shared with them. All of these providers process your content exclusively for inference (audio generation and text cleaning) and do not retain or use your content to train their models. All providers listed above are GDPR compliant.

We do not sell, rent, or trade your personal information to any third party.

6. Data Retention

We retain your data as follows:

• Account data — retained for as long as your account is active.
• Uploaded PDFs and generated audio — stored indefinitely until you request deletion.
• Server logs — retained for a limited period for security and debugging purposes, then automatically deleted.
• Third-party processing logs — some providers (such as RunPod) may retain temporary operational logs related to the processing of your content. These logs are outside our direct control but do not contain personal account information.

If you wish to have your data deleted, you may request it at any time by contacting us at [email protected]. Upon receiving a valid deletion request, we will remove your personal data and associated content within a reasonable timeframe, and will request deletion from our payment processor (Creem) where technically possible.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate personal data.
• Right to erasure — request deletion of your personal data and uploaded content.
• Right to data portability — request a machine-readable copy of your data.
• Right to restrict processing — request that we limit how we use your data.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days of receiving your request.

8. Cookies and Tracking Technologies

HearDocs uses a minimal approach to cookies:

• Essential authentication cookie — we set a short-lived cookie (_hd_jwt) that lasts 30 seconds and is used solely to authenticate your session during page navigation. This cookie uses the SameSite=Lax attribute for security.
• Campaign cookie — if you reached HearDocs by scanning the QR code on one of our printed cards or flyers, we set a cookie (hd_qr) that lasts 180 days and contains only a random number, unrelated to your identity. It lets us know how many people who received a card ended up using the service. If you did not arrive through one of those cards, this cookie is never set.

We do not use:

• Marketing or advertising cookies
• Third-party tracking scripts
• Any form of cross-site tracking
• Advertising profiling or data selling

The campaign measurement described above runs entirely on our own infrastructure: no data is sent to Google Analytics or any other external tool, and we do not record your IP address for this purpose.

The authentication cookie is strictly necessary for the service to work. The campaign cookie is not: you can delete it at any time from your browser settings without affecting your use of HearDocs in any way.

9. Data Security

We implement the following measures to protect your data:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Secure authentication — user sessions are managed via JSON Web Tokens (JWT) with short expiration times.
• Rate limiting — we enforce request rate limits to prevent abuse and protect system integrity.
• Access control — role-based access controls ensure that users can only access their own data and content shared with them.
• Secure file handling — uploaded filenames are sanitized to prevent security vulnerabilities.
• Database security — database connections use SSL with certificate verification.

While we take reasonable precautions to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

HearDocs is operated from the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers operate.

Our AI providers (Google, OpenAI, Anthropic), GPU infrastructure provider (RunPod), and payment processor (Creem) may process data in various regions. All of these providers comply with GDPR and maintain appropriate data protection standards.

We ensure that any international transfers of personal data are conducted in compliance with applicable data protection laws. Our service providers maintain appropriate security standards regardless of where data is processed.

By using HearDocs, you acknowledge that your data may be transferred internationally as described in this section.

11. Children's Privacy

HearDocs is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we may notify you via email or through a notice on the Service.

Your continued use of HearDocs after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: [email protected]