1. Introduction
PDFly is a private PDF reader and annotator for Android, made by Ctoryteller. It finds the PDFs on your phone, keeps them behind a PIN, and lets you read, mark up, sign and reorganise them.
This Privacy Policy explains what information PDFly handles and where it goes. The short answer is that everything PDFly does happens on your phone, and none of it is sent to us.
2. The short version
- No account. PDFly has no sign-up, no login and no profile.
- Nothing is uploaded. Your PDFs, file names, marks, signatures and settings stay on your device. PDFly's own code never opens a network connection.
- No analytics, no advertising, no tracking. PDFly contains no analytics, advertising or crash-reporting software.
- The one exception is buying the editor pass, which goes through Google Play. Google handles that payment; we never see your card or bank details (Section 5).
3. Information PDFly keeps on your device
To work, PDFly stores the following only in its own private storage on your phone:
- Your PIN, as a salted hash — never the PIN itself — in Android's encrypted secure storage, together with your lock-out state and whether fingerprint unlock is on.
- Where your PDFs are — the folders you chose, and an index of the PDFs found in them (names, sizes, dates and locations), so your library appears instantly.
- What you do with them — favourites, bookmarks, where you stopped reading, recently opened files, and your settings.
- Your marks — highlights, drawings, shapes, text and stamps you add in the editor. They are kept separately from your PDF; your original file is never changed.
- Your signatures — up to five saved signatures, drawn on screen or imported from a picture you choose. They are stored as images inside PDFly, behind the PIN.
- Page pictures and working copies — thumbnails of first pages, and temporary copies of PDFs you open, held in the app's cache and cleared automatically as it grows.
- The editor pass — whether Google Play last reported an active pass, and when, so the editor keeps working without a connection for up to 30 days.
None of this leaves your phone. We cannot see it, and we have no copy of it.
Fingerprint unlock uses Android's own biometric system. PDFly is told only whether the fingerprint matched; it never receives or stores your fingerprint.
4. Permissions
PDFly asks only for what its features need:
| Permission | Why | When |
|---|---|---|
| Access to folders you pick | To find and open the PDFs in them | When you add a folder |
| All files access | To scan the whole phone for PDFs | Only if you turn on "Scan whole device" |
| Read storage (Android 10 and older) | The same whole-device scan on older Android | Only if you turn on the scan |
| Biometrics | Optional fingerprint unlock | Only if you turn it on |
| Internet, network state and billing | Added by Google Play Billing, for the editor pass | Only when buying or checking a pass |
The whole-device scan reads PDF file names and locations so it can list them. It does not send them anywhere.
5. The editor pass and Google Play
Reading is free. Saving a marked-up copy, extracting and organising pages, and signatures need an editor pass, bought through Google Play.
- The purchase is made on Google Play's own screen, under your Google account and Google's terms. Google processes the payment and the information needed for it; we do not receive your card, bank or Google account details.
- To know whether your pass is active, PDFly asks Google Play on your phone. Google Play's answer, and the time it was given, are stored on your device as described in Section 3.
- Google may provide us with purchase records — such as an order number, the date and the amount — through the Google Play Console, as it does for every developer. We use them only to handle refunds, support requests and our accounting.
Google's handling of your information is governed by the Google Privacy Policy.
6. Sharing
We do not sell, rent or share your information, because we do not receive it.
When you choose to share a PDF, or open it in another app, Android's share sheet sends the file to the app you pick. What that app does with it is governed by its own policy.
7. Backups and deleting your data
- PDFly opts out of Android backups and device-to-device transfer. Its data is not copied to your Google account or to a new phone. This keeps your PIN, marks and signatures on the one device — but it also means they are not backed up, and are lost if the app is uninstalled or the phone is reset.
- "Forgot PIN" wipes everything PDFly has stored — its database, signatures, caches, settings and secure storage — and lets you start again. It never deletes your PDFs.
- Uninstalling PDFly removes all of its data from the phone. PDFs you saved with "Save as new PDF" or "Extract pages" are your files and stay where you saved them.
- You can also clear the thumbnail cache and recent history at any time in Settings.
8. Security
Your data is protected by Android's app sandbox, so other apps cannot read PDFly's private storage, and by PDFly's own PIN lock, which can lock the app automatically when it goes to the background. The PIN is stored only as a salted, slowly computed hash in encrypted storage, and repeated wrong attempts trigger increasing lock-outs.
No method of storage is perfectly secure. In particular, a phone that is rooted or otherwise compromised may expose app data.
9. Children
PDFly is a general-purpose document tool and is not directed at children. We do not knowingly collect personal information from anyone, of any age. A child under 18 should buy the editor pass only with a parent's or guardian's consent.
10. Your rights
Under India's Digital Personal Data Protection Act, 2023, you have the right to access, correct and erase your personal data, to withdraw consent, to nominate someone to act for you, and to have a grievance addressed. As PDFly keeps your data only on your own device, you exercise most of these directly in the app (Section 7). For anything we hold — such as purchase records Google provides, or emails you send us — write to pdfly@ctoryteller.com or our Grievance Officer. If your grievance is not resolved, you may escalate it to the Data Protection Board of India.
11. Changes to this policy
If PDFly ever starts to collect or send anything new, we will update this policy before the app version that does so is released, and change the "Last updated" date above.
12. Contact us and grievance redressal
- Support email: pdfly@ctoryteller.com
- Grievance Officer: Faroze War, grievance@ctoryteller.com
- Phone / WhatsApp: +91-9970983661
- Registered address: Ctoryteller, 7th Floor, Skyline Icon, Andheri East, Mumbai 400059, India
- Business hours: Monday–Saturday, 10:00 AM – 6:00 PM IST
- Response time: Within 2 business days (general); 15 business days (formal grievances)
See also our Terms of Service and Refund Policy.