Privacy policy

1. Who we are

JSCodeArt is a brand of Aqar Lagta LLC, a company registered in Wyoming, USA. Aqar Lagta LLC is the controller of the personal data described in this policy.

Contact: [email protected]

2. Your documents

Your documents stay on your device. JSCodeArt PDF opens, fills, signs and edits your PDFs on your device. We don't upload your documents.

3. What we collect

iPhone, iPad and Mac App Store

• No sign-up.
• Apple DeviceCheck: the app sends a DeviceCheck token to our server, which reads and sets Apple's per-device "trial used" bits. Our trial record is keyed to the DeviceCheck result. It doesn't include your Apple Account ID or your email.
• Purchases: Apple handles the 3-day trial and the $5 purchase and tells the app your purchase status.

Android (Google Play)

• No sign-up.
• Your App Set ID.
• A Play Integrity token and verdict from Google, which can include device recall information where available.
• A trial record.
• The Google Play purchase token for the $5 unlock.

Desktop downloads from our website (Windows, Linux, Mac)

• Your email address, to sign you in.
• The one-time 6-digit sign-in code we email you.
• A hashed install ID, used only for your desktop trial and licence records: a random ID the app creates and stores as a hash. It isn't a hardware serial number, and it's never part of crash reports.
• A signed trial token.
• Your licence key and activation record, from our payment provider when you buy.

The download form on jscodeart.com

• Your email address and the platform you choose, so we can email your download link. We ask you to confirm your address first.

Visiting jscodeart.com

• The site sets no cookies of its own and has no analytics or tracking cookies. It keeps up to three preferences in your browser’s local storage: theme (light or dark mode), lang-choice (the language you picked) and lang-banner-dismissed (the language suggestion you closed). The two language keys hold only a language code, such as ja. They stay on your device, aren’t sent to us, aren’t cookies and aren’t used for tracking. They have no expiry date and stay until you clear your browser’s site data. Choosing a language anywhere on the site clears lang-banner-dismissed.

Crash reports (all channels)

• Crash reports are off by default. If you turn them on, the app sends crash reports to Sentry so we can fix crashes. You can turn them off again.
• A crash report contains only the technical details of the crash (the stack trace), the app version and build, your operating system and its version, your device model and the app’s language.
• A crash report never contains your PDFs or their content, file names or paths, form values, signatures, email addresses, licence keys, your IP address or location, an install ID, or anything else that identifies you.

4. Why we use it, and our legal basis

5. Who processes data for us

• Cloudflare: runs our server and our database (Cloudflare D1, in our Cloudflare account) for trial records, licence records, desktop sign-in and the download list.
• Lemon Squeezy: sells website licences and manages licence keys and activations.
• Apple: DeviceCheck and App Store purchases (iPhone, iPad, Mac App Store).
• Google: Play Integrity and Google Play purchases (Android).
• Sentry (EU region, Frankfurt, Germany): crash reports, only if you turn them on. We’ve turned off the storage of IP addresses and location.
• Amazon Web Services (Amazon SES), region EU (Ireland): sends sign-in codes and download-link emails.

Apple and Google also process store data under their own privacy policies.

6. International transfers

We're based in the USA. Our processors also process data in other countries: Amazon SES sends our emails from the EU (Ireland), Sentry processes crash reports in its EU region (Frankfurt, Germany), and other processors may process data in the USA and elsewhere. When we transfer personal data from the EU, the UK or other places with transfer rules, we use the safeguards the law requires, such as standard contractual clauses.

7. How long we keep it

• Download-list email addresses: the confirmation link expires after 48 hours, and unconfirmed sign-ups are deleted after 7 days. Once you confirm, we keep your email until you unsubscribe, or until 30 days after we send your platform's download link, whichever comes first.
• One-time sign-in codes: expire after 10 minutes and are deleted once used.
• Trial records (Apple, Android and desktop, including the desktop hashed install ID): hold only device or install identifiers and dates, and are kept for 12 months after the trial starts, then deleted.
• Licence records and desktop sign-in emails: kept while the licence exists, and deleted on request.
• Crash reports: kept for up to 30 days, then deleted.

8. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you;
• correct it;
• delete it;
• receive it in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time (turn off crash reports in the app, or email us about the download form);
• complain to a data protection supervisory authority.

To use these rights, email [email protected]. We may need to confirm it's you first.

9. Children

JSCodeArt PDF isn't directed at children, and we don't knowingly collect children's personal data. If you think a child has given us personal data, contact us and we'll delete it.

10. Security

We collect as little as we can, and your documents stay on your device. Sign-in codes work once, and trial tokens are signed and checked by the app.

11. Changes to this policy

If we change this policy, we'll post the new version on this page and update the effective date.

Effective date: 27 October 2026

12. Contact

Aqar Lagta LLC · [email protected]