Privacy Policy — Loa

Controller and contact

This policy is maintained by islogicdev, an independent developer profile. For any privacy or data protection matter, write to islogicdev@gmail.com.

Who this policy applies to

This policy applies to the app "Loa — Leia, Ouça e Anote" (package com.islogicdev.reader), currently under review for distribution via Google Play. The islogicdev site has its own policy, available on the Privacy page.

How the app works

Loa is a tool to import, organize, read and listen to the user’s own documents. It was built local-first:

• It works without an account: imported documents and notes stay only on your device.
• Read-aloud is processed on the device itself, using the system voice engine. The content you read is not sent to our servers for this feature.
• You pick files through the system picker. The app does not scan your storage for files.
• There is no book catalog, no distribution or sale of third-party content, and no encouragement of piracy. The content is always provided by you.

Data we process and why

Processing depends on the features you choose to use:

• Use without an account: documents, extracted text, notes, bookmarks, categories, progress and preferences stay on the device and are not sent to islogicdev servers. The system voice engine you choose may process text under that provider’s settings and policy.
• Optional account: we process your e-mail, internal user ID, sign-in provider and technical authentication data. Plain-text passwords are never available to islogicdev.
• Loa Pro and sync: when you select cloud backup, we process the chosen files and related metadata, notes, bookmarks, categories, progress and preferences to store and sync them in your account’s private area.
• Subscription: Google Play and RevenueCat process purchase history, product and base plan, transaction identifiers, dates, environment and subscription status. islogicdev never receives your card number or full payment details.
• Security and operation: infrastructure providers may process IP address, network headers and limited technical logs for authentication, fraud prevention, diagnostics, availability and incident response.
• Support: if you contact us, we process your e-mail, message and any attachments you choose to send in order to handle the request.

Purposes and legal bases

• Performance of the service and contract: authenticate, sync, restore purchases and deliver requested Free and Pro features.
• Consent or user choice where applicable: select files, enable backup and send content to support.
• Legitimate interests, after necessity and impact assessment: secure accounts, prevent fraud, maintain availability and improve subscription operations.
• Compliance with legal or regulatory obligations and establishment, exercise or defence of rights.

What we do not do

• We show no ads and do not sell or rent personal data.
• We do not use documents, notes or voice for advertising, behavioral profiling or AI model training.
• We do not use an advertising identifier or behavioral tracking SDKs.
• There is no general behavioral analytics in the app. Purchase history is used for functionality, security, compliance, account management and subscription metrics in RevenueCat, as declared in Google Play’s Data safety section.

App permissions

On Android, we use only what is necessary:

• Notifications and playback service: to keep read-aloud running with the screen locked and show the controls.
• File access: only through system pickers, to import what you choose.
• Google Play billing: to process subscriptions, if you choose to subscribe.

Sharing with processors and third parties

We use only necessary services and limit data to each integration’s purpose:

• Google Play and Google identity services: distribution, billing, purchase restore and Google sign-in.
• Supabase: authentication, database, private storage and backend functions.
• RevenueCat: purchase validation, Pro entitlement status, restore support and operational subscription metrics.
• The Android text-to-speech engine you select: voice generation under the settings and policy of the provider installed on the device.
• E-mail provider: delivery of authentication and support messages when needed.
• Authorities or third parties only when required by law, a valid order, or to protect rights and safety.

Google, Supabase and RevenueCat may process data outside Brazil. We use applicable contractual safeguards for international transfers and remain responsible for selecting and overseeing processors.

Security and integrity

• Backend communications use encrypted connections in transit.
• The local database is encrypted and the session is stored in the system’s secure storage.
• The backend uses per-user isolation, Row Level Security, private storage, server credentials outside the app and server-side Pro validation.
• We apply data minimization, least privilege, logs without sensitive content and regular dependency updates.
• No system is invulnerable. If a relevant incident occurs, we will assess its impact and make the notices required by law.

Retention and deletion

• Local data remains on the device until you delete it or uninstall the app.
• Account and synced content remain while the account exists. After a verified request, operational deletion is completed within 30 days, except for the minimum retention required by law, fraud prevention or exercise of rights.
• Protected residual copies may remain for limited processor backup cycles and are deleted or overwritten under their respective processes.
• Google Play and RevenueCat may retain transaction records for periods required by their own obligations and terms.
• Support messages are kept only as long as necessary for the request, security and compliance records.

Account and data deletion

You can request deletion of your account and associated data at any time. The step-by-step guide is on the dedicated page:

Account and Data Deletion

Your rights

Under the LGPD, you may request confirmation of processing, access, correction, anonymization, portability and deletion of your data, plus information about sharing and withdrawal of consent. To exercise any right, write to islogicdev@gmail.com. We reply as quickly as possible.

Teenagers and protection of minors

Loa is intended for people aged 13 or older and is not designed for children under 13. Minors must use accounts and online features with parental authorization where local law requires it. We process minors’ data in their best interests, without ads, chat, behavioral profiling or data sales. If we learn of use below the minimum age without valid authorization, we will take steps to restrict the account and delete applicable data.

Changes to this policy

This policy may be updated to reflect changes in the app or in legislation. When that happens, the date at the top will be revised. Relevant changes in data processing will be highlighted with reasonable notice.