BumuStudios·Türkçe sürüm·ImageToPdf policy·Grid Smash policy

Who this policy is from

This policy covers the Android application PdfShrink, distributed through Google Play under the package name com.bumustudios.pdfshrink. It is written by the app's independent developer. Questions can be sent to the address in Contact.

The controller of the personal data described in this policy — the party responsible for it under data protection law, including the GDPR and Türkiye's KVKK — is Burak Gökgöz, who publishes the app as BumuStudios, in Türkiye. Contact: bumustudios@gmail.com.

What the app does

PdfShrink makes a PDF smaller. You open a document and choose either a size limit (for example 200 KB) or a quality level; the app re-encodes the pictures inside the PDF, or for the strongest setting renders the pages as pictures, and saves the result as a new document you can share. There is no watermark, no subscription and no page limit.

Your documents stay on your device

This is the most important section, so it is stated plainly:

• Documents are never uploaded. The app has no backend of its own. It does not transmit your PDFs, their contents, their text, their file names or their metadata anywhere, and the usage statistics and crash reports described below never contain them: a crash report shows where in the code a crash happened, not your files.
• Documents are read through the Android document picker. You pick the specific file you want. The app is granted access only to that file and does not browse your storage.
• A working copy is made in the app's private cache. To draw a preview of the first page and to compress the document, the app copies what you open into its own sandbox at cache/pdfshrink-work/. Each compression attempt starts again from this copy, and attempts are written to cache/shrink-attempts/ and deleted as soon as the result is saved. The copy is deleted when you finish with the document, when the cache is cleared, or when the app is uninstalled. Android may also reclaim it at any time.
• Your original file is never modified. Saving always writes a new document, normally through MediaStore into Documents/PDF Shrink on your device's own storage. The file you opened is left exactly as it was.
• No storage permission is requested on any Android version. The document picker and MediaStore make one unnecessary. On Android 9 and older, and whenever the shared folder refuses a file, the app saves into its own folder on your device instead, which needs no permission; files there are removed from the device if the app is uninstalled, but a copy can remain in your Android backup (see below).

The app builds its output with PdfBox-Android, an open-source library bundled inside the app. It runs entirely on your device and has no network access of its own; it is a piece of local code, not a service.

What the app stores locally

The app keeps a small amount of state in its own private storage on the device. None of it is personal information, and none of it is sent anywhere:

• your theme, text size and language choices;
• whether the one-time "remove ads" purchase is active;
• when a one-hour ad-free period earned with a rewarded ad ends;
• a counter of how many interstitial ads have been shown, used to keep ad frequency low.

This local state is excluded from Android cloud backup and from device-to-device transfer. The rest of the app's private storage is not: the app allows Android backup, so if backup is turned on on your phone, Android's backup to your Google Account and a transfer to a new phone can also include the files the app saved into its own folder (see above) and the files that the Google Firebase and ad components keep in the app's storage. Google's advertising and consent components also keep their own settings on the device, under Google's control, and the Google Firebase components described below keep three random identifiers in the app's private storage: a Firebase installation ID, the Analytics app-instance ID and a Crashlytics installation ID. Unlike the list above, these identifiers travel with the usage statistics and crash reports, and they can be in your Android backup. Uninstalling the app or clearing its data removes everything the app has stored on the device, these identifiers included; a copy in your Android backup stays in your Google Account under Google's backup rules and can be restored if you reinstall the app.

Advertising — Google AdMob and its mediation partners

The app is free and is supported by ads served through Google AdMob (Google Ireland Limited / Google LLC, depending on your region). AdMob is embedded in the app as a software development kit, and it does collect data, independently of the developer. When ads are served, AdMob and Google's advertising partners may collect and process:

The app does not request GPS or precise location permission, and it does not send your documents, file names or page contents to AdMob or to any of its mediation partners (below). The developer receives no personal data from AdMob or the partners — only aggregated, anonymous reporting such as impression and revenue totals.

Because ads require an advertising identifier, the app declares the com.google.android.gms.permission.AD_ID permission. Ad formats used are a banner, an occasional interstitial and, only if you choose it, a rewarded ad: on the result screen after a save or in Settings you can tap "Watch one ad, get 1 hour ad-free", watch one ad, and the app then shows no banner or interstitial ads on that device for the next hour. It never unlocks or gates any feature.

How Google handles this data is governed by Google's own policies, not by this one:

• Google Privacy Policy
• How Google uses information from sites or apps that use our services
• AdMob and third-party advertising

Mediation partners

The app also contains the software of two other ad networks, which AdMob can call on through its mediation feature. When the app requests an ad, AdMob may pass that request to one of these partners, and the partner that serves the ad then receives the same categories of data listed in the table above (advertising ID, approximate location derived from your IP address, device information and ad interaction events) and processes it under its own privacy policy:

• Unity Ads — Unity Game Player and App User Privacy Policy
• Liftoff Monetize (formerly Vungle) — Liftoff Privacy Policy

In the answers they publish for Google Play's data safety section, Unity Ads says its software may also collect purchase history, user IDs, app interactions (such as taps inside its ads), app usage times (only when Unity's optimisation features are turned on) and diagnostics, for advertising, analytics, fraud prevention and app functionality; Liftoff Monetize says it collects approximate location, for analytics, app functionality and advertising. The app's data safety section on Google Play includes these answers.

Which partner, if any, serves a given ad is decided by AdMob. Your choices in the consent form described under "Your advertising choices" are passed to these partners through the standard consent signal that Google's consent tool stores on the device.

Usage statistics and crash reports — Google Firebase

To see how the app is used and to find and fix crashes, the developer has built two Google Firebase services into it: Google Analytics for Firebase and Firebase Crashlytics. Google provides them as the developer's data processor, and they are active only in the version of the app distributed through Google Play. The app adds nothing of its own to what they collect — no custom events, no user ID or user properties, no custom keys or log messages — so only their automatic collection applies:

Analytics records that a screen was shown and for how long, not what you do on it, and a crash report shows where in the code the crash happened, not your content. Neither service receives your name, your email address or any account details.

When they run. Both services start on the first launch of the app, in every region, before any consent form has been answered: the app does not hold them back until you answer. Outside the EEA, the UK and Switzerland, Analytics runs by default. In the EEA, the UK and Switzerland, once you answer the consent form described below under "Your advertising choices", Analytics follows your answer, both for storing its identifier on your device ("analytics storage") and for using the data for advertising ("ad user data") and ad personalisation; those two advertising uses stay off there until you agree. You can change your answer at any time from Settings → Privacy options; the entry appears where it is required. Crash reports are sent whatever you answer: Crashlytics relies on the developer's legitimate interest in finding and fixing crashes.

The app has no separate switch for the usage statistics or the crash reports. To object to them, write to the address in Contact; uninstalling the app stops both.

Analytics keeps data linked to an installation's identifiers for no longer than 14 months; aggregated reports that contain no identifiers may be kept longer. Crashlytics keeps crash reports for 90 days.

Google processes this data on the developer's behalf, as its data processor, under the Firebase and Google Analytics data processing terms. It may be processed on Google's servers outside your country, including in the United States, and it is encrypted in transit (TLS).

Google describes these services here:

• Privacy and security in Firebase
• Google Privacy Policy

Purchases — Google Play Billing

The app offers one optional, one-time, non-consumable purchase that permanently removes ads. There is no subscription and nothing recurring.

The transaction is handled entirely by Google Play Billing. The developer never sees or receives your card number, bank details, billing address or full name. Google Play reports only aggregated sales figures, and Google Analytics for Firebase records that a purchase was made — product, name and price, with no payment details (see above). Inside the app, the purchase is recorded as a single true/false flag on your device, restored from your Google Play account when you reinstall or move to a new device.

Your handling of payment data by Google is covered by the Google Privacy Policy and Google Play's terms.

Updates — Google Play

The app uses Google Play's In-App Updates library. It asks Google Play whether a newer version of the app is available and, when there is one, lets Google Play offer it to you, download it and install it. It is covered by the Google Privacy Policy.

Your advertising choices

If you are in the EEA, the UK or Switzerland

Before personalised ads are requested, the app shows a consent form built with Google's User Messaging Platform, where you choose what you allow, including for the ad partners listed above. Your choice is stored on your device by Google's component and is respected on later launches.

You can change your decision at any time: open the app, go to Settings → Privacy options, and the same form reappears. You may withdraw consent there. Withdrawing consent does not disable the app; you will still be able to compress your documents, and ads may still be shown in a non-personalised form. Your answer there also applies to Google Analytics for Firebase, as described above; it does not switch off the crash reports.

If you are in a US state with a privacy law

Where a US state privacy law applies (for example in California), the same Google consent tool can show a notice about the use of your information for targeted advertising and let you opt out of its sale or sharing. Where it applies, the Settings → Privacy options entry appears and opens your choices again. Your rights there are described under Privacy rights in US states below.

Everywhere else

The privacy options entry appears only where a consent choice is legally required, so you may not see it. You can still control advertising at the operating-system level: open Android Settings → Privacy → Ads (the exact path varies by manufacturer and Android version) to reset your advertising ID, or to delete it entirely, which stops apps from receiving a stable advertising identifier.

Removing ads completely

Buying the one-time ad removal stops ad requests from the app altogether. A one-hour ad-free period earned with a rewarded ad stops the banner and interstitial ads for that hour.

Permissions the app requests

These are the permissions the app declares itself. The Google and ad-network components built into it add a few more that Android grants at installation without asking you, such as Google Play's billing permission and Android's advertising-services permissions; but the app requests no storage, camera, contacts, microphone, precise location or account permissions on any Android version.

Children

This app is a general-purpose utility. It is not directed at children under 13 (or the equivalent minimum age in your country), it is not listed in a children's category, and it is not designed for or marketed to children. The developer does not knowingly collect any personal information from children. If you believe a child has provided personal information through the ad, analytics or crash-reporting services in this app, contact the address below and contact Google, whose services would hold it.

Data retention

The developer runs no server and keeps no user data of its own. The usage statistics and crash reports are held by Google on the developer's behalf: Analytics data linked to an installation's identifiers for no longer than 14 months (aggregated reports without identifiers may be kept longer), and crash reports for 90 days. Data held on your device stays there until you clear the app's data or uninstall the app. Data collected by Google through AdMob and Google Play is retained according to Google's own retention schedules, described in the Google Privacy Policy, and data collected by a mediation partner according to that partner's policy, linked above.

Legal bases and your rights

Where the GDPR (EU/UK) applies, the legal basis for personalised advertising, including by the mediation partners, is your consent, collected through the form described above and withdrawable at any time. Non-personalised advertising, fraud prevention and the security of the ad services rely on legitimate interests. Processing your purchase is necessary to perform the contract you enter when you buy ad removal. The usage statistics and crash reports rely on the developer's legitimate interest in keeping the app working and understanding, in aggregate, how it is used; in the EEA, the UK and Switzerland, Analytics' storage of its identifier on your device and any advertising use of the data rely on your consent (GDPR Art. 6(1)(a)) once you answer the consent form; until you answer, Analytics already runs from the first launch.

Under the GDPR you have the right to ask whether your personal data is processed, to access it, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time, and you may lodge a complaint with the data protection authority of your country. Users in Türkiye have the rights described under Users in Türkiye (KVKK) below.

The usage statistics and crash reports are pseudonymous: they carry random identifiers, never your name or email address, so the developer cannot tell which records are yours. Where the consent form is shown, you can withdraw consent at any time in Settings → Privacy options, and you can object to this processing, or ask about it, by writing to the address below. Uninstalling the app or clearing its data ends the link to the old identifiers, and data already sent then expires on the schedule above. Requests concerning advertising data must be directed to Google, or to the mediation partner concerned, as the party that holds it, using the tools in the policies linked above. For anything else, or for help finding the right route, write to the address below.

Transfers outside Türkiye and the EEA

The developer works from Türkiye and has no server. The data described in this policy goes from your device directly to the providers below, which process it outside Türkiye and outside the European Economic Area, notably in the United States. The developer reads the usage statistics and crash reports in the Firebase console from Türkiye.

• Google (Google Ireland Limited / Google LLC): AdMob, Google Analytics for Firebase, Firebase Crashlytics and Google Play Billing — Google's data transfer frameworks, Privacy and security in Firebase;
• Unity (Unity Ads) — Unity Game Player and App User Privacy Policy;
• Liftoff (Liftoff Monetize, formerly Vungle) — Liftoff Privacy Policy.

These providers state in their policies that, for transfers from the EEA, the UK and Switzerland, they rely on safeguards such as the European Commission's Standard Contractual Clauses and, where they are certified, the EU–US Data Privacy Framework. The details are in their policies linked above.

Users in Türkiye (KVKK)

The controller is Burak Gökgöz (BumuStudios), Türkiye. Under Law No. 6698 on the Protection of Personal Data (KVKK) you may apply to the controller to learn whether your personal data is processed and to request information about it; to learn the purpose of the processing and whether the data is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to have it corrected if it is incomplete or inaccurate, and erased or destroyed under the conditions of KVKK Article 7; to have those corrections and erasures notified to the third parties it was transferred to; to object to a result against you that arises solely from automated analysis of the data; and to claim compensation for damage caused by unlawful processing (KVKK Article 11). You may also withdraw your explicit consent at any time.

Apply first to the controller, by email to bumustudios@gmail.com. Your application is concluded within 30 days at the latest and, as a rule, free of charge (KVKK Article 13). If it is refused, if you find the answer insufficient or if no answer comes in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning the answer, and in any case within 60 days of your application (KVKK Article 14). The full information notice in Turkish (KVKK Aydınlatma Metni) is in the Turkish version of this page.

Privacy rights in US states

This section is for residents of California and of the other US states with a consumer privacy law, to the extent those laws apply to the developer.

• What is collected, and from where: identifiers (the advertising ID, the Firebase, Analytics and Crashlytics installation identifiers, and your IP address); internet or other electronic network activity (usage events and ad interactions); approximate geolocation (country or region, derived from the IP address); commercial information (the one-time "remove ads" purchase: product, name and price); device information and crash reports. All of it comes from your device, through the app and the software components in it. No sensitive personal information is collected.
• Why: the purposes described above — serving and measuring ads and preventing fraud, keeping the app working and finding crashes, understanding in aggregate how it is used, and processing your purchase.
• Sale and sharing: the developer does not sell personal information for money. The ad components in the app — Google AdMob, Unity Ads and Liftoff Monetize — receive identifiers, network activity and approximate location to serve and measure ads, which can include cross-context behavioural (targeted) advertising. Under California law this counts as "sharing", and other state laws can treat it as a "sale" or as targeted advertising. The developer does not knowingly sell or share the personal information of consumers under 16.
• Your choices: you can opt out of the sale or sharing of your personal information and of targeted advertising: where Google's privacy message applies, through Settings → Privacy options in the app; on any phone, by deleting your advertising ID in Android's Settings → Privacy → Ads; or by writing to us.
• Your rights: to know what personal information is collected, used and disclosed, to access it, and to have it deleted or corrected. Send requests to bumustudios@gmail.com. The records carry only random identifiers, so we may ask for information that lets us find the ones concerned. You may use an authorised agent. If we refuse a request, you can appeal by replying to our answer.
• No discrimination: using these rights does not change how the app works for you or what it costs.
• Retention: as described under "Data retention" above.

Security

What the app keeps is stored in its private storage on your device, which Android isolates from other apps. The app has no account and no server; the only copies elsewhere are the ones you make yourself by saving or sharing and, if backup is on, Android's backup described above. Data sent to Google and to the ad partners travels encrypted (TLS). No method of storage or transmission is perfectly secure; keep your device locked and up to date.

Changes to this policy

If the app's data practices change — for example if a new third-party service is added — this page will be updated and the "last updated" date at the top will change. Material changes will also be reflected in the app's Google Play listing.

This policy was first published with the first version of PdfShrink, on 8 November 2026.

Contact

For any question about this policy or about privacy in this app, write to: