Fractal

Privacy Policy

Last updated: October 19, 2025

Your Documents Stay Private

Fractal processes PDF text extraction locally in your browser using client-side technology. Your original PDF files never leave your device and are not uploaded to our servers.

However, please note:

  • Extracted text (not the PDF file) may be processed by external AI services if you use the optional AI enhancement feature
  • If you choose to export to Notion or Google Docs, the extracted text is transmitted to those services
  • If you save extractions to your history, the text is stored in our secure database

What We Collect

Account Information

  • Name and email address (for account creation)
  • Authentication credentials (encrypted via Supabase)
  • Profile information from OAuth providers (if you sign in with Google)

Usage Data

  • Number of PDF extractions performed
  • Features used (AI enhancement, OCR, exports)
  • Usage limits tracking (25/month for free, unlimited for Pro)
  • Error logs and performance metrics

Saved Extraction History (Optional)

If you choose to save extractions:

  • File names (PDF names you uploaded)
  • Extracted text content (not the original PDF)
  • Timestamp of extraction
  • This data is stored for 7 days (free tier) or 30 days (Fractal+)

Payment Information

  • Processed securely via Stripe
  • We never see or store your card details
  • Stripe shares: email, payment status, subscription status

How We Use Your Data

We use your information to:

1. Provide the Fractal service

  • Process PDF extractions in your browser
  • Track usage limits and subscription status
  • Store extraction history (if you choose to save)

2. Improve the service

  • Analyze feature usage patterns (anonymized)
  • Fix bugs and optimize performance
  • Develop new features based on user behavior

3. Manage your account

  • Send service-related emails (password resets, subscription confirmations)
  • Process payments and prevent fraud
  • Provide customer support

4. Comply with legal obligations

  • Respond to legal requests
  • Enforce our Terms of Service
  • Protect against abuse and fraud

Third-Party Services & OAuth Integrations

Services We Use

Supabase (Authentication & Database)

  • Stores: Email, encrypted password, account metadata
  • Purpose: User authentication and data storage

Privacy: Supabase Privacy Policy

Stripe (Payment Processing)

  • Stores: Email, payment methods, transaction history
  • Purpose: Process subscriptions and payments
  • We never see your card details

Privacy: Stripe Privacy Policy

Vercel (Hosting)

  • Stores: Technical logs, performance data
  • Purpose: Host and deliver the Fractal application

Privacy: Vercel Privacy Policy

OpenAI (AI Enhancement - Optional)

  • Stores: Temporarily processes extracted text to improve formatting
  • Purpose: Enhance formatting quality with AI
  • Your original PDFs are never sent to OpenAI
  • Text is processed temporarily and not used to train models

Privacy: OpenAI Privacy Policy

OAuth Integrations (User-Initiated Only)

Google OAuth & Google Docs API

When you connect your Google account to export to Google Docs:

Scopes we request:
  • https://www.googleapis.com/auth/docs - Create and edit Google Docs
  • https://www.googleapis.com/auth/userinfo.email - Get your email address
  • https://www.googleapis.com/auth/userinfo.profile - Get your profile info
Why we need these scopes:
  • To create new Google Docs or append to existing docs with your extracted PDF text
  • To identify your Google account and show your docs
What we do with your data:
  • We store OAuth access tokens securely in our database (encrypted)
  • We use these tokens ONLY to export text to Google Docs when you explicitly click "Export to Google Docs"
  • We do NOT access, read, modify, or delete your Google Docs except when you initiate an export
  • We do NOT share your Google data with any third parties
How long we store tokens:
  • Access tokens are stored until you disconnect the integration or delete your account
  • Refresh tokens are stored to maintain access (you can revoke at any time)
How to revoke access:

Notion OAuth & Notion API

When you connect your Notion account to export:

Scopes we request:
  • Read and write access to pages you select
Why we need this scope:
  • To create new pages or append content to your Notion workspace
What we do with your data:
  • We store OAuth access tokens securely (encrypted)
  • We use tokens ONLY when you click "Export to Notion"
  • We do NOT access, read, or modify Notion pages except during export
  • We do NOT share your Notion data with third parties
How to revoke access:

Google API Services User Data Policy Compliance

Fractal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request the minimum scopes necessary to provide Google Docs export functionality
  • We do NOT use Google user data for serving advertisements
  • We do NOT allow humans to read user data unless:
    • We have your explicit consent for specific messages
    • It's necessary for security purposes
    • It's required to comply with applicable law
  • We do NOT transfer Google user data to third parties (except as necessary to provide the service, comply with law, or as part of a merger/acquisition with notice to users)

Data Security

We implement industry-standard security measures:

  • Encryption in transit: All data transmitted via SSL/TLS (HTTPS)
  • Encryption at rest: Database encrypted via Supabase
  • Password security: Hashed and salted (never stored in plain text)
  • Access controls: Role-based access to database
  • OAuth tokens: Encrypted before storage
  • Regular audits: Security reviews and dependency updates

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights (GDPR & CCPA Compliant)

You have the right to:

1. Access Your Data

  • View your account information
  • See your saved extraction history
  • Request a copy of all data we have about you

2. Correct Your Data

  • Update your name, email, or profile
  • Edit saved extraction titles

3. Delete Your Data

  • Delete individual saved extractions
  • Delete your entire account at Account Settings
  • Request complete data deletion by emailing us
  • All data permanently deleted within 30 days

4. Export Your Data

  • Download your saved extraction history as JSON or CSV
  • Export before account deletion (data cannot be recovered after)

5. Revoke OAuth Access

  • Disconnect Google Docs integration
  • Disconnect Notion integration
  • Tokens are immediately deleted from our database

6. Opt-Out of Optional Features

  • Disable AI enhancement (extracted text won't be sent to OpenAI)
  • Disable analytics tracking

7. Object to Processing

  • Request we stop processing your data (may limit service functionality)

To exercise these rights, email us at fractal.pdf@gmail.com

Data Retention

  • Free tier saved extractions: Auto-deleted after 7 days
  • Fractal+ saved extractions: Auto-deleted after 30 days
  • Account data: Retained while your account is active
  • OAuth tokens: Retained until you disconnect or delete account
  • Deleted account data: Permanently removed within 30 days
  • Payment history: Retained for 7 years (legal requirement for tax purposes)

Children's Privacy

Fractal is not intended for users under 13 years old. We do not knowingly collect data from children under 13. If we discover we have collected data from a child under 13, we will delete it immediately.

International Data Transfers

Fractal is operated in the United States. If you access Fractal from outside the US, your data may be transferred to, stored, and processed in the US or other countries where our service providers operate.

By using Fractal, you consent to the transfer of your data to the US and other countries that may have different data protection laws than your country of residence.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

  • Right to know: What personal information we collect and how we use it
  • Right to delete: Request deletion of your personal information
  • Right to opt-out: We do NOT sell your personal information
  • Right to non-discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, email fractal.pdf@gmail.com

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under GDPR:

  • Legal basis for processing: Consent, contract performance, legal obligations
  • Data controller: Fractal PDF (fractal.pdf@gmail.com)
  • Data processor: Our third-party services (Supabase, Stripe, etc.)
  • Right to lodge a complaint: Contact your local data protection authority

Cookies & Tracking

Fractal uses minimal cookies:

  • Essential cookies: Session authentication (required for the app to work)
  • Analytics cookies: Anonymous usage tracking (can be disabled)

We do NOT use cookies for advertising or tracking across other websites.

Do Not Track

Some browsers have a "Do Not Track" (DNT) feature. Fractal respects DNT signals and will not track users who have DNT enabled.

Policy Updates

We may update this privacy policy from time to time. We'll notify you of material changes via:

  • Email to your registered address
  • Prominent notice in the app
  • Banner on the website

Continued use after changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this policy shows when it was last modified.

Contact Us

If you have any questions about this privacy policy or how we handle your data:

We'll respond to privacy inquiries within 30 days.

This privacy policy was last updated on October 19, 2025.

Fractal - Extract PDF Text with Formatting | 90%+ Accuracy