Privacy Policy

1. Who we are

Nayan is developed and published by Md Mahabubur Rahman, trading as Tulx ("we", "us"). We are the data controller for any personal data described in this policy. You can reach us at tulx.app@gmail.com.

2. Guest mode: nothing leaves your phone

You can use every core feature of Nayan without an account. In Guest mode:

• Photos you take or import, the text recognised from them, your books and pages, and your search index are stored only in the app's private storage on your device.
• Text recognition runs entirely on the device, using Google ML Kit for Latin and Devanagari scripts and Tesseract for Bengali and Arabic. No image or text is sent to us or to anyone else for recognition.
• The app makes no network requests at all, with one exception: downloading a language pack when you ask for one (see section 4).
• Exported files (PDF, text, HTML, image, CSV) are written to the app's private storage and handed to the app you choose through the Android share sheet. Nayan does not keep a copy elsewhere.

Because Guest data exists only on your phone, uninstalling the app, clearing its storage or losing the device deletes it permanently. The app tells you this before you continue as a Guest.

3. Camera and photos

Nayan asks for the Camera permission so you can scan pages and use Live text. Camera frames are processed in memory on the device; in Live text mode nothing is stored unless you tap Save page. The app never records audio.

Importing from your gallery or files uses the Android photo picker and document picker. These grant the app access only to the specific files you choose, so Nayan does not request permission to read your whole photo library.

The app also declares the ability to receive images shared to it from other apps ("Share to Nayan") and to open image files from a file manager. Those files are handled exactly like a photo you imported.

4. Language pack downloads

Bengali and Arabic recognition requires a Tesseract language model (about 11 to 14 MB each) that is not included in the app download. When you choose to download one, the app fetches it over HTTPS from the public tesseract-ocr/tessdata_best repository hosted on GitHub, or from a server we operate. That server receives the ordinary information any web request carries: your IP address, the file requested and the time. We do not attach any identifier, and the request contains nothing about you or your scans. The pack is stored on your device and can be removed from Settings → Languages.

5. Accounts and cloud backup

Creating an account is optional and free. It unlocks cloud backup and restore, sync across your devices, high-accuracy cloud recognition, and unlimited exports. If you create an account we process:

Backup is never automatic without your account. Your scans are uploaded only when you are signed in and use Back up now or have sync enabled. Signing out keeps everything on the device and stops all cloud activity.

When you upgrade from Guest to an account, your existing library is relabelled as belonging to your account on the device. Nothing is uploaded until you choose to back up.

6. Third-party services

Nayan uses the following services. Each processes data only as described here.

• Google ML Kit (on-device text recognition, language identification and document edge detection). Recognition models run on your phone. On devices with Google Play services, ML Kit may download its model files through Google Play services; that download is handled by Google under the Google Privacy Policy.
• Tesseract OCR (on-device recognition for Bengali and Arabic). Open-source software running on your phone. No data is sent anywhere.
• Firebase Authentication (accounts only). Used to create accounts, sign in with email or Google, and reset passwords. See the Firebase privacy documentation.
• Google Sign-In (optional). If you sign in with Google, Google shares your name, email address and profile picture with us as part of authentication.
• Android Text-to-Speech (Read aloud). Uses the speech engine installed on your phone. If that engine is cloud-based, its provider's policy applies.
• Cloud recognition providers (accounts only, high-accuracy mode). Google Cloud Vision or Microsoft Azure AI Vision, reached only through our server. Provider credentials never exist in the app.

Nayan contains no advertising SDKs and no third-party analytics. If a future version adds crash reporting to help us fix problems, it will collect only technical crash data (device model, Android version, app version and the error), we will disclose it here first, and it will never include the content of your scans.

7. Where data is stored and for how long

• On your device: for as long as the app is installed, or until you delete a book or page in the app or clear the app's storage.
• Cloud backup (accounts): for as long as your account exists. Deleting a page or book in the app deletes it from your backup on the next sync. Deleting your account deletes your entire cloud library within 30 days.
• High-accuracy recognition: images are processed and discarded; they are not stored on our server.
• Server logs: standard access logs (IP address, endpoint, time, status) are kept for up to 30 days for security and troubleshooting.

8. Your choices and rights

• Use Nayan without an account. Guest mode is a complete product, not a trial.
• Camera permission can be revoked at any time in Android settings. Importing from the gallery still works.
• Delete your data on the device by deleting books and pages in the app, or by uninstalling.
• Delete your account and cloud data from inside the app or by request. See Delete your account.
• Access, correct or export your data. Everything in your library can be exported from the app. For a copy of the account data we hold, or to correct it, email us.

Depending on where you live, you may have additional rights under laws such as the GDPR or the Bangladesh Personal Data Protection framework, including the right to lodge a complaint with a supervisory authority. We honour these requests regardless of where you are located.

9. Children

Nayan is not directed at children under 13, and we do not knowingly collect personal data from them. Guest mode collects no personal data at all. If you believe a child has created an account, contact us and we will delete it.

10. Security

Data on the device lives in the app's private storage, which other apps cannot read. Authentication tokens are kept in Android's encrypted key storage. All network traffic uses HTTPS. Cloud backups are stored in access-controlled storage and are only ever returned to the authenticated account that created them.

11. Changes to this policy

If we change how Nayan handles your data we will update this page, change the effective date at the top, and for significant changes tell you inside the app before they take effect.

12. Contact

Questions, requests or complaints: tulx.app@gmail.com. We reply within a few working days.