1. Data we collect
- Account data: when you register, we store your username, password (hashed), and the information you provide such as email, phone number, region (province/city, ward/commune), and the account creation time. If you sign in via Google/Facebook, we store the provider-issued identifier along with your email/name (if available).
- Usage data: pages viewed, search keywords, device/browser information — used for analytics and improving the service.
- AI quota & activity: the number of tokens used during the day to apply a fair quota.
- Local device storage (localStorage): saved documents, recent viewing history, light/dark theme, font size — kept on your device and not sent to the server.
- Information you actively send: the content of contact emails, suggestions, and error reports.
2. Purposes of use
We use data to: provide and operate accounts; authenticate logins and maintain sessions; provide the Ask-AI feature and apply quotas; send transactional emails (welcome, password reset); produce anonymized analytics to improve the service; and respond to contact requests. We do not sell personal data.
3. Password security
Your password is stored as a salted one-way hash (PBKDF2) — we do not store and cannot recover the original password. Therefore, if you forget your password, the system can only help you reset it via email, not resend the old one.
4. Sign in via Google/Facebook
When you choose third-party login, we only receive the basic information needed to create/link the account (identifier, email, display name). We do not receive the password of your Google/Facebook account. This login is also subject to those platforms' policies.
5. Questions sent to the AI assistant
When you use the “Ask AI about this document” feature, your question is sent to a third-party AI model provider to generate an answer. Please do not enter sensitive/personal information in the question box. Processing at the AI provider is subject to their privacy policy.
6. Transactional email
We use a third-party email service to send transactional emails such as welcome messages and password-reset links. Your email address is used for this purpose and only shared with the email service provider to the extent necessary to deliver messages.
7. Cookies & local storage
We use an authentication cookie to keep you signed in (a session may last up to 30 days if you choose to be remembered). The site may also use cookies/measurement as needed for operation and analytics. You can clear cookies or localStorage data in your browser; you will then need to sign in again and some conveniences may be affected.
8. Data sharing
We only share data as necessary with: the AI model provider (to process questions), the email service (to send transactional mail), and the login platforms Google/Facebook (when you choose them). We may disclose data when required by law. Apart from these cases, we do not share or sell personal data.
9. Storage & retention
Account data is kept until you request deletion. Password-reset links are valid for a short time (about 60 minutes) and are single-use. The token-quota counter is refreshed each day.
10. Your rights
You have the right to: access and update your account information; request account deletion and related personal data; delete locally stored data by clearing your browser data; and withdraw consent for non-essential transactional emails. To do so, please contact us via the email below.
11. Children's privacy
The service is not directed at children under 15. If you believe a minor has provided us information without appropriate consent, please contact us so we can address it.
12. Changes & contact
This policy may be updated over time; the new version takes effect upon posting. For any privacy questions, please email [email protected].