Lectorium
Legal document
Privacy Policy
Lectorium is local-first: your documents stay on your device and in your Google Drive or Dropbox account. We do not operate servers that store your working files.
Quick summary
| What we collect | Why | Legal basis (LGPD) |
|---|---|---|
| Name, email, profile photo (Google OAuth) | Identify and authenticate your session | Contract performance — art. 7, V |
| Google OAuth token | Operate Google Drive on your behalf | Contract performance — art. 7, V |
| File metadata (name, size, type) | Display your library and sync | Contract performance — art. 7, V |
| Connection logs (IP, timestamp) | Security and legal compliance | Legal obligation — art. 7, II (Marco Civil, art. 13) |
| Aggregated technical metrics (Cloudflare Web Analytics) | Understand page traffic and performance without cookies, advertising, or profiling | Legitimate interest — art. 7, IX |
1Who we are
Data controller: Lectorium, operated by the party responsible for this service and for decisions on personal data processing in this application.
Data Protection Officer (DPO): To exercise your rights or ask privacy questions, contact our dedicated channel: contato@lectorium.com.br. We respond within 15 business days as required by LGPD art. 18 §5.
2Data we collect and why
2.1Google account (optional for Google Drive)
When you sign in with Google, Lectorium receives from Google OAuth:
- Display name, email address, and profile photo — to create and identify your account.
- OAuth access token — to perform Google Drive operations on your behalf during the session.
Legal basis: contract performance (LGPD art. 7, V). These data are necessary only for authentication and Google Drive-connected features; the local workspace can be used without connecting a Google account.
Retention: while your account is active. The OAuth token is stored locally, encrypted on your device, and deleted on sign-out.
Google Drive scopes: drive.file (only files created or opened by the app) and drive.appdata (private library manifest).
2.2Files and content
Editing, annotation and document storage happen locally on your device. For AI features — including OCR of scanned PDFs — content travels directly from the app to Google APIs (Gemini); it does not pass through Lectorium servers and we have no access to it.
Legal basis: contract performance (art. 7, V).
Retention: local cache stays in app storage until you clear data or sign out.
2.3Dropbox (optional integration)
If you connect Dropbox, Lectorium accesses only files you explicitly select. The Dropbox token is stored locally, encrypted. No Dropbox data is transmitted to our servers.
Legal basis: contract performance (art. 7, V).
2.4Connection logs
Our infrastructure (Supabase) records access logs containing IP address and timestamp, as required by Brazil's Marco Civil da Internet (Law 12.965/2014, art. 13). These logs are retained for 12 months and disclosed to third parties only by court order.
Legal basis: legal obligation (LGPD art. 7, II).
2.5Technical metrics and telemetry
We use Cloudflare Web Analytics for aggregated technical metrics about traffic and performance on public pages. According to Cloudflare, this feature does not use cookies, localStorage, or user identifiers to collect metrics. We do not use Google Analytics, behavioral advertising, retargeting, or profiling.
Internal technical events used for in-app diagnostics are not sent to Lectorium servers.
Legal basis: legitimate interest (LGPD art. 7, IX), limited to security, performance, and service improvement.
3Who we share with
We do not sell, rent, or pass your data to data brokers or advertisers. We share only with the following sub-processors, strictly to operate the service:
- Google LLC (United States) — OAuth authentication and Google Drive API. International transfer covered by the European Commission's Standard Contractual Clauses (SCCs), accepted by Google in the Google Cloud Data Processing Addendum.
- Supabase Inc. (United States / European Union) — database and authentication infrastructure. Transfer covered by Supabase's SCCs and Data Processing Agreement.
- Cloudflare Inc. (United States / global network) — hosting, security, CDN, and aggregated technical metrics for public pages through Cloudflare Web Analytics.
- Dropbox Inc. (United States) — only if you voluntarily connect Dropbox. Transfer covered by Dropbox's SCCs.
4International data transfers
Our sub-processors (Google, Supabase, Cloudflare, Dropbox) are based in the United States or operate global infrastructure. International transfers are made using Standard Contractual Clauses (SCCs) adopted by the European Commission — a safeguard recognized under LGPD arts. 33–36. Each provider maintains publicly available DPAs on their websites.
5Automated decision-making
Lectorium does not use automated decision-making that produces legal effects or significantly affects you (LGPD art. 20). AI features generate suggestions that always require human review and action.
6Security
- Access tokens are stored encrypted on your device (AES-GCM via the WebCrypto API).
- All communication with external APIs uses HTTPS/TLS.
- Our Supabase infrastructure uses Row-Level Security (RLS) — each user accesses only their own data.
- In the event of a security incident that may affect your data, we will notify you and Brazil's ANPD within the timelines required by LGPD art. 48.
7Your rights (LGPD art. 18)
You may exercise the following rights at any time:
- Confirmation and access: confirm whether we process your data and obtain a copy.
- Correction: correct incomplete, inaccurate, or outdated data.
- Anonymisation or deletion: request anonymisation or deletion of data processed under consent or legitimate interest.
- Portability: receive your data in structured format to transfer to another service.
- Objection: object to processing based on legitimate interest.
- Information on sharing: know which entities we share your data with.
- Withdrawal of consent: where consent is the legal basis, withdraw it at any time without affecting prior processing.
To exercise any right, contact our DPO: contato@lectorium.com.br.
We respond within 15 business days as required by LGPD art. 18 §5.
8Revoking Google access
At any time, you can:
- Sign out in app settings — this deletes the local token.
- Revoke Lectorium's access on your Google Account permissions page.
- Clear app data via Android settings.
Your files in Drive remain in your Google account. Only you can delete them there.
9Cookies and local storage
Lectorium does not use tracking or advertising cookies. We use local app storage to maintain your session and offline work cache. Cloudflare Web Analytics, when active in the infrastructure, provides aggregated metrics without cookies or localStorage. Local workspace data stays on your device and is not accessed remotely by us.
10Children and adolescents
Lectorium may be used in educational contexts, including by underage students, when guided by parents, guardians, teachers, or educational institutions. Processing data from children and adolescents must observe the student's best interests and any authorizations required by applicable law.
If you believe a child used Lectorium without the required authorization, contact contato@lectorium.com.br. Because the app is local-first, we will help with guidance for deleting local data, revoking permissions, and removing data under our control.
11Changes to this Policy
We will notify you of significant changes at least 30 days in advance via the app interface or email. The effective date at the top of this document indicates the current version. Continued use after the effective date constitutes acceptance of the updated version.
12Contact and DPO
General questions: contato@lectorium.com.br
Privacy and LGPD rights: contato@lectorium.com.br