Privacy Policy

1. Introduction and Scope

Welcome to LingoPDF. This Privacy Policy explains how information is handled when you visit our website (https://lingopdf.in), interact with our account services, or use the LingoPDF browser extension software, including the LingoPDF PDF Reader for German to English.

LingoPDF operates on a local-first architecture: our reading tools are engineered to execute vocabulary definitions, grammatical parsing, and optical character recognition (OCR) directly inside your personal browser sandbox rather than streaming your personal reading materials to remote cloud servers.

This document clearly describes our active practices and implemented features, while accurately distinguishing future capabilities (such as commercial payment processing and device seat management) that will launch in upcoming project phases.

2. Information We Collect

Depending on how you interact with LingoPDF, we collect and process the following categories of information:

• Account & Profile Details: When you register an account, we collect your email address and optional display name.
• Authentication Credentials & Tokens: We store passwords strictly in cryptographically hashed form (using Argon2id). Single-use tokens for email verification and password resets are stored strictly as SHA-256 hashes with short-lived expiration windows.
• Session Metadata: When you sign in, we record session timestamps, your browser User-Agent string, and IP address for account security and session management.
• Website Logs & Diagnostics: Standard web server access logs (such as IP address, request method, requested URL, response code, and timestamp) collected by our hosting infrastructure to monitor availability and defend against abuse.
• Support Communications: When you email our team at support@lingopdf.in, we retain your email address and message contents to assist you.

We do not track the documents you open in the extension, we do not log your reading history, and we do not sell or monetize personal data.

3. Account Registration and Authentication

User accounts are fully implemented on https://lingopdf.in. Account creation allows you to register credentials that will be used to manage your profile and future licenses.

When interacting with our authentication system:

• Registration: You supply an email address, password, and optional name. Passwords are automatically hashed before persistence using the industry-standard Argon2id hashing algorithm.
• Email Verification: A single-use verification token is generated, hashed using SHA-256, and stored with a 24-hour expiration. An email containing the activation link is sent via our transactional email provider (Resend).
• Sessions: Successful login creates an opaque 32-byte session token stored in an HttpOnly, secure cookie (lingopdf_session), with the token hash stored in our database. Sessions expire after 30 days.
• Password Resets: Reset requests generate single-use, 1-hour expiration tokens sent via email. Upon completing a reset, the token is consumed immediately and all existing active sessions across all devices are automatically revoked.

4. Payments and Refunds (Not Yet Implemented)

Payment processing and commercial checkout are not currently active on this website. We do not currently collect, process, or store credit cards, debit cards, bank account numbers, or billing information.

When commercial purchasing launches (Phase 7A), all monetary transactions will be handled exclusively by an external, PCI-DSS compliant third-party payment processor. LingoPDF will never store full credit card numbers on our servers.

Refund Policy: All paid licenses will include a contractual three (3) calendar day money-back guarantee calculated from the exact date and time of your original purchase. Refund requests must be directed to support@lingopdf.in. Upon refund issuance, the associated license key will be deactivated. This contractual guarantee operates in addition to, and does not limit or waive, any non-excludable statutory consumer rights available in your jurisdiction.

5. How the Website Uses Information

We process collected information strictly for operational and security purposes:

• To register, authenticate, and maintain your account profile.
• To dispatch essential transactional emails (verification links and password reset requests).
• To secure our authentication routes using IP-based rate limiting against credential abuse.
• To deliver web pages, assets, and documentation reliably to your client device.
• To respond promptly to support inquiries sent to our support mailbox.

We do not sell personal data to third parties, nor do we run behavioral ad-tracking scripts.

6. Extension Functionality and Local PDF Processing

The LingoPDF browser extension is designed with a core commitment to user document confidentiality:

• Local Document Sandboxing: When you open a PDF document in your browser, the entire document file is parsed and rendered locally within your browser tab.
• Zero Document Uploads: LingoPDF does not transmit your PDF pages, text extracts, scanned images, or document contents to remote servers or cloud AI services for vocabulary lookups.
• No Reading History Dossiers: We do not log which files you read, how long you spend on individual pages, or the specific vocabulary words you select.

7. OCR and Dictionary Lookup

All linguistic and optical recognition tools in the LingoPDF extension execute locally:

• Local Lexical Datasets: Comprehensive German–English lexical datasets, definition mappings, and grammatical inflections reside within the extension's packaged assets, enabling sub-50ms lookup times without remote network requests.
• Client-Side OCR: For scanned or image-based PDF documents, optical character recognition runs entirely using client-side WebAssembly / JavaScript compute on your computer. Image bitmaps are processed in local memory and are never uploaded to an external server.

8. License Activation and Device Management (Planned)

Commercial license activation and device management are planned features scheduled for introduction in Phase 7A. They are not currently operational.

When implemented, commercial licensing will operate under the following privacy principles:

• A brief network call during initial license activation will verify the validity of your license key.
• A pseudonymized cryptographic device identifier will enforce the approved seat limit of a maximum of two (2) active browser installations or personal devices per lifetime license.
• Following successful one-time activation, paid functionality is engineered to work completely offline without requiring continuous network connectivity or periodic heartbeat pings.

9. Usage Limits and Operational Quota

LingoPDF offers a permanent free tier of five (5) word lookups per calendar day. There is no time-based free trial (such as a 3-day or 7-day trial).

Based on our actual extension architecture, this daily quota is tracked and stored locally within your browser storage (using extension storage / LocalStorage) associated with calendar dates. Daily lookup counts are not sent to or stored on remote servers.

10. Cookies and Similar Technologies

We use strictly necessary cookies to operate our authenticated user services and maintain functional site preferences:

• lingopdf_session: Strictly necessary authentication cookie. Generated upon successful login, configured with HttpOnly, Secure in production,SameSite=Lax, and a 30-day lifetime. Used solely to keep you signed in.
• lingopdf_region: Functional preference cookie used to remember your manual currency and regional pricing selection across page visits.

We do not use third-party advertising cookies, cross-site tracker beacons, or canvas fingerprinting technologies.

11. Third-Party Service Providers

To provide dependable web services, we engage the following infrastructure providers:

• MongoDB Atlas: Managed cloud database infrastructure used to store registered account records, hashed credentials, verification hashes, and session records with network encryption in transit and at rest.
• Resend: Transactional email service provider used to deliver account verification links and password reset instructions.
• Cloud Hosting / Edge Infrastructure (e.g. Vercel): Web application hosting, static asset caching, and serverless execution for web endpoints.

Each provider processes only the minimum data strictly necessary to execute their designated infrastructure service.

12. Data Retention

We adhere to data minimization principles across all systems:

• User Accounts: Account profiles and hashed credentials are retained for as long as your account remains active, or until you request account deletion.
• Sessions: Active sessions expire automatically after 30 days of inactivity.
• Tokens: Email verification tokens expire after 24 hours. Password reset tokens expire after 1 hour. Both are deleted immediately upon consumption.
• Server Logs: Web hosting access logs are rotated and purged on standard hosting provider maintenance schedules.
• Support Inquiries: Direct customer email correspondence is retained only as long as needed to resolve your query and maintain record continuity.

13. Data Security

We apply robust modern security controls across our platform:

• Password Security: Passwords are hashed using the memory-hard Argon2id algorithm with unique per-user salts. Plaintext passwords are never saved.
• Token Hashing: Security tokens (email verification and password resets) are stored only as cryptographic SHA-256 hashes. If the database were compromised, raw tokens cannot be retrieved.
• Transit Encryption: All public website routes enforce HTTPS with modern TLS encryption.
• Cookie Hardening: Authentication cookies use HttpOnly and Secure flags with SameSite=Lax to protect against cross-site scripting (XSS) and cross-site request forgery (CSRF).
• Abuse Prevention: Public authentication endpoints (login, register, password reset, verification) enforce IP-based rate limiting to protect against brute-force attacks.

14. International Data Transfers

Our hosting infrastructure, database nodes (MongoDB Atlas), and email dispatch systems (Resend) may operate in secure data center locations globally. By using https://lingopdf.in and creating an account, you acknowledge that your information may be transferred to and processed in these facilities in accordance with this Privacy Policy.

15. Children's Privacy

LingoPDF is intended for general student, research, and adult reading audiences. We do not knowingly collect or solicit personal information from children under 13 years of age (or applicable local age threshold). If we discover that a child has created an account, we will promptly delete that account and associated records upon notice.

16. User Privacy Rights and Choices

Depending on your location and applicable privacy laws, you may exercise specific rights regarding your personal information:

• The right to request confirmation of the personal data we hold about you.
• The right to request correction of inaccurate or outdated profile details.
• The right to request deletion of your account and associated authentication records.
• The right to withdraw consent for email communications.

To exercise any of these rights, contact us at support@lingopdf.in.

17. Policy Updates

We may update this Privacy Policy from time to time as new features (such as commercial licensing or additional language editions) are released. When changes are made, we will update the “Last updated” date at the top of this document. Material updates will be communicated with notice on our website.

18. Contact Information

For any questions, concerns, or privacy requests regarding this Privacy Policy or our local-first reading architecture, please reach out to: