Privacy
Controller
Felix Polyudov, Kranewitterstr. 20, 6020 Innsbruck, Austria. Contact: hello.didaktiq@gmail.com. These notices cover OCR Flash.
What happens during recognition
File selection starts recognition immediately; collected camera pages are sent only after Start recognition. PDFs and HEIC files are converted locally in your browser; original files and filenames are not transmitted. Your browser resizes each page to at most 1024 pixels on its longest side and converts it to JPEG. That image passes through our Vercel server to OpenRouter and then Google Gemini for recognition. OCR Flash stores neither images nor recognized text in its database or file storage. Active processing uses memory. The basis for the tool you request is Article 6(1)(f) GDPR, our and your legitimate interest in providing the requested recognition.
AI providers and data use
For every request the application requires an OpenRouter route classified as Zero Data Retention and disallows data collection by the model provider. Recognition fails if no eligible route is available. Google Gemini is used through OpenRouter, without web search or external tools. This routing requirement does not promise that no operational metadata is processed. OpenRouter does not classify temporary in-memory caches as persistent retention. Provider data-use terms are linked below.
Images you may use
Upload only images you have authority to process. Remove personal details where possible, especially from children's work. Do not use the beta for health records, other particularly sensitive personal data or confidential documents. AI results can contain mistakes.
Abuse protection and database
Supabase in Frankfurt stores salted truncated IP hashes, random browser identifiers, image checksums, time-window counters and security/block states where needed. These data are pseudonymised. Our application database does not store raw IPs, User-Agent strings, images or OCR text. Counters, associations and processing references are cleaned hourly after 25 hours, normally within about 26 hours. Security states are deleted at the next cleanup after seven days without activity; manual network allow entries remain until revoked. Identifier-free daily aggregates remain for operations and cost control. The basis is Article 6(1)(f) GDPR.
Browser storage and security checks
A signed random browser identifier stays in localStorage for up to 30 days solely for abuse prevention. Results and language preference stay in the tab's sessionStorage. Images and filenames are not stored there. Clear all removes the result; browser session restoration may keep tab contents after closure. People with browser access can see local results. When a security check is required we load Cloudflare Turnstile, which processes connection and browser data. Checks may limit requests and do not make decisions with legal effect. These protections serve the secure tool you expressly request (Article 6(1)(f) GDPR).
Hosting, error logs and transfers
Vercel hosts the site and application functions run in Frankfurt. Vercel and Cloudflare process technical data, including IP addresses, to connect and secure requests. Our application error events contain only a fixed category, without images, OCR text, filenames, form values or browser identifiers. Vercel lists one day of Runtime Log retention on Pro; separate security/provider metadata follows the linked provider terms. OpenRouter, Google, Vercel, Cloudflare and Supabase may also process technical data outside the EEA, especially in the USA. Providers publish processing/transfer terms including standard contractual clauses. Frankfurt server hosting does not mean every service processes data exclusively in Europe.
Cookie-free usage statistics
We use Vercel Web Analytics for aggregated page views and fixed events such as recognition, copying, sharing or an accepted waitlist request. No analytics cookies, persistent browser analytics identifiers, advertising profiles or session recordings are created. Vercel processes technical connection data and counts visits using a hash derived from the request, discarded after 24 hours. Statistics may include time, public page path, a non-sensitive referrer, approximate region and browser/device type. Events contain only language and, where relevant, a fixed single/batch/page value. Images, OCR text, filenames, names, email addresses, form values and our abuse-prevention identifier are not passed to analytics. URL queries, fragments and email-action pages are excluded; collection is suppressed for potentially private referrers. Do Not Track and Global Privacy Control are respected. The basis is our legitimate interest in understanding usage and reliability of the tool (Article 6(1)(f) GDPR); you can object. Fonts are served directly by this site.
Contact and your rights
If you email us, we process your details to handle your request. Subject to legal requirements, you may request access, rectification, erasure, restriction or portability and object to legitimate-interest processing. Contact: hello.didaktiq@gmail.com. Because images and OCR text are not retained, we may be unable to identify individual requests without further details. You may complain to the Austrian Data Protection Authority at dsb.gv.at.
Provider information
Optional waitlist
These details apply to the waitlist form when enabled and to confirmation and withdrawal links. Existing links remain usable during a temporary signup pause.
With your consent (Article 6(1)(a) GDPR), we process your name, email, selected interest, language, consent wording and consent/confirmation times. Updates require email confirmation. You can withdraw at any time using the email link or by contacting us; your enrollment is then deleted. Unconfirmed requests are deleted after 48 hours and confirmed enrollments at most 12 months after the latest confirmation. Hourly cleanup may delay deletion by up to one hour. Confirmation links expire after 24 hours.
Supabase stores waitlist data in our Frankfurt database. Resend processes the recipient address and confirmation message for email delivery. Cloudflare Turnstile checks submissions for abuse and receives technical connection data. For abuse protection we store a signed random browser identifier in localStorage for 30 days and use truncated, salted IP hashes. IP associations and counters are cleared after 25 hours; delivery status after 48 hours. The basis for these necessary protections is Article 6(1)(f) GDPR. Providers may process technical data outside the EEA. No image upload is required to join.