Privacy
Documents stay on your device. Opening a PDF in duo·reader is not an upload. We do not receive a copy of the file, its text, or its filename. We are not your processor or sub-processor for that document.
Optional product feedback is the exception: only if you press Send. That message and a short technical summary leave the browser.
1. Who we are
duo·reader is a free web application at duo-reader.com, operated by Kaoru, an individual developer based in Japan (“we”, “us”).
Privacy contact: kaoru@duo-reader.com.
This notice is written so it can be used in the United States, the EEA and United Kingdom, Australia, Singapore, and other English-speaking markets in Southeast Asia, and so it also covers Japan’s Act on the Protection of Personal Information, to the extent those laws apply. It describes our current product. It is not a warranty, and it is not legal advice to you about your own documents.
2. What we do not collect
We do not ask you to create an account. We do not run advertising or analytics tags.
We do not design the service to collect:
- PDF files, extracted text, annotations, or document titles;
- names, payment details, government IDs, or employee/customer lists inside a file;
- precise location, contacts, or address books;
- cross-site advertising identifiers, or a sale or “share” of personal information for cross-context behavioural advertising.
Do not paste document text into Feedback. If you do, treat that as you choosing to send it.
3. What exists only on your device
The library, PDFs you open, pane layout, page, scroll position, and language preference are stored in your browser (IndexedDB and localStorage) for duo-reader.com. That storage is needed to provide the reader you asked for. It is not a cookie used for tracking.
Anyone with access to that browser profile can see those files. Clearing site data for duo-reader.com, or deleting an item in the library, removes what we stored there. We cannot recover it. Employer-managed devices, backups, and browser sync are outside our control.
4. What reaches a network
When you load the site or the app, your browser makes ordinary web requests.
- Hosting. Pages and the app are served by Cloudflare. Like any HTTPS host, Cloudflare may process IP address, user-agent, timing, referrer, and similar connection data for delivery, security, and abuse prevention, under Cloudflare’s terms.
- PDF engine worker. The reader loads a pdf.js worker script from cdnjs (Cloudflare). That is program code, not your PDF.
- Feedback (opt-in). If you send Feedback, we receive your short message plus: browser/OS family and version, desktop or mobile, viewport, colour scheme, app language, time zone, page path, first-touch referrer (query string stripped), UTM parameters if present, and coarse location from Cloudflare (country / continent / edge colo). We do not write your IP address into the report. GitHub stores the issue in our private operations inbox.
- Email you send us. If you write to the address above, we process the content of that correspondence to respond.
Cloud document sync exists only as unused code. It is not offered in the current service. If we ever enable it, we will update this notice first and will not silently upload your files.
5. Purposes and legal bases
Where GDPR, UK GDPR, or similar laws apply, we rely on the following. Other regimes use equivalent grounds (for example, a reasonable expectation of collection, or consent).
| Activity | Purpose | Basis (EEA/UK) |
|---|---|---|
| On-device storage | Provide the library and reading position | Contract / strictly necessary storage. We do not receive this data |
| Hosting and security logs | Deliver the site, keep it up, limit abuse | Legitimate interests; where applicable, steps needed to provide the service |
| pdf.js worker | Render PDFs in the reader | Legitimate interests in providing a usable reader |
| Feedback | Improve the product; we do not reply as a rule | Consent (you press Send) |
| Email to us | Respond to a request, including privacy requests | Legitimate interests, or legal obligation for a rights request |
We do not use your information for automated decisions that produce legal or similarly significant effects.
6. Cookies
We do not set advertising or analytics cookies, and we do not show a cookie banner. Under EU practice, a consent wall is for non-essential tracking. This service does not use that tracking, so a banner would have nothing lawful to ask. Library and language storage in your browser is needed for the reader to work. You can block third-party requests in your browser; the PDF worker in the app may then fail to load.
7. Who else is involved
We use infrastructure providers. They process technical data to run their networks:
- Cloudflare, Inc. — hosting, CDN, edge functions, optional security logs;
- GitHub, Inc. (Microsoft) — storage of Feedback you submit, as an issue in our inbox.
We do not sell personal information. We do not disclose it for money. We do not use it to train public AI models. We may disclose information if required by law, to protect the service, or in a transfer of the project (for example if another operator takes over duo·reader), in which case this notice will be updated.
8. International processing
We are in Japan. Cloudflare and GitHub process data in the United States and in other countries where they operate. A request from Australia, Singapore, the EU, the UK, or the US may be handled on servers outside your country. Where a transfer law applies, those providers rely on their own transfer tools (for example standard contractual clauses). Coarse country is inferred by Cloudflare from the connection; we do not ask you to type an address.
9. Retention
- On-device data: until you delete it or clear the site.
- Hosting logs: according to Cloudflare’s then-current practices, typically short.
- Feedback issues: until we no longer need them for product work, or you ask us to delete an identifiable submission and we can locate it.
- Email: for as long as needed to handle the request and keep a minimal record of compliance.
We do not keep a copy of your PDFs, so we cannot delete a document from “our systems” that was never sent.
10. Your rights
Depending on where you live, you may have the right to request access, correction, deletion, restriction, objection, portability, withdrawal of consent (for Feedback, by not sending further messages and asking us to delete a prior one), and to complain to a supervisory authority (for example an EU/UK data protection authority, the OAIC in Australia, the PDPC in Singapore, or a US state attorney general). Japan’s APPI disclosure and cessation rights are handled through the same contact.
Because we hold almost nothing, many requests will result in us confirming that we do not have your documents. If you used Feedback or email, tell us the approximate time and wording so we can find the record. We may need to verify that the request is yours. We will not discriminate against you for exercising a privacy right.
California / similar US state laws. In the last 12 months we have not sold or shared personal information as those terms are used in the CCPA/CPRA. Categories we may process are: identifiers and internet/technical data (IP at the host, truncated in Feedback; coarse region; user-agent), and the contents of messages you choose to send. We do not collect sensitive personal information for the purpose of inferring characteristics. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.
11. Children
The service is aimed at people who read long professional documents. It is not directed at children under 13 (or the higher digital-consent age in your country, often 16 in parts of the EEA). Do not send Feedback on behalf of a child.
12. Security
Transport uses HTTPS. Document bytes are not stored on our servers. No method of transmission or browser storage is perfectly secure. You remain responsible for the classification of files you open on a given device (including confidential contracts).
13. Changes
We will post a revised notice here and update the effective date. If we start collecting more (for example cloud sync, accounts, or analytics), we will say so in this notice before that collection begins. Continued use after a change means the new notice applies to subsequent use.
14. Contact
Kaoru · duo·reader · Japan
kaoru@duo-reader.com
Product comments can also be sent with the Feedback control. Use email for privacy requests.