Pado — Privacy Policy

Version 1.0 — 11 July 2026. Data controller: the Pado provider, Norway (contact address in the app's settings). Drafted for GDPR (EU/EEA incl. Norway); CCPA notes for US users below.

The short, honest version

Your learning data never leaves your device. Words, photos, notes, review history — all of it is stored locally in your browser/app storage. We cannot see it. You can erase all of it at any time from your device.

What we DO process, and why

• Account data: username, email address, a salted hash of your password (never the password itself), account creation date, invite code used, consent record. Legal basis: contract. Kept until you delete your account.
• Referral requests: the email address (and optional name) of a friend you refer, provided by you with their knowledge, used once to send an invite. Legal basis: consent of the referrer.
• Survey and feedback responses you choose to submit: used only to improve Pado. Legal basis: consent. You may skip them.
• AI processing (transient): when you explicitly tap an AI feature, the selected text snippet or cropped image is sent to our processor Anthropic (USA) to generate the suggestion and returned to your device; we do not store it. Transfers rely on standard contractual clauses. No AI request ever happens in the background — only on your explicit action.
• Technical delivery: our host (Cloudflare) processes IP addresses transiently to deliver and protect the site, as any host does. We run no analytics, no advertising trackers, no fingerprinting. The only cookies are the strictly necessary session cookies that keep you logged in.

What we NEVER collect

Your words, sentences, photos, camera roll, study progress, or any content of your learning. Never. This is an architectural promise, not just a policy: the app is built local-first.

Your rights (GDPR)

Access, rectification, erasure ("delete my account"), restriction, portability (the app's export already gives you everything), and objection. Contact us via the address in the app's settings; we respond within 30 days. You may complain to Datatilsynet (Norway) or your local supervisory authority.

US users (CCPA/CPRA)

We do not sell or share personal information. You may request access or deletion via the same contact.

Children

Pado is not directed to children under 13, and we do not knowingly collect their data.

Changes

We will announce material changes in the app before they take effect.