Help shape Platypus.
Keep your documents private.

Your choice, from the first launch

The welcome screen offers a usage-data toggle. Leave it off and select Start reading to continue without sharing. Turning it on saves your agreement immediately. Core features work with reporting off, and we remember your choice without asking on every launch.

No usage counts, reporting ID, uploads, or analytics launch heartbeat start before you agree. Only new activity after you agree is counted. You can review or change your choice in Settings → Privacy, where the main reporting details are also available offline.

Development builds and builds without a reporting connection can save your preference but create no usage counts or reporting ID and send no analytics. Configured internal test builds use a separate test service after you opt in. A later configured build can use your saved choice under the same consent policy. Earlier unreported activity is never backfilled.

Basic counts that help us improve

When reporting is available and you opt in, counts are grouped by UTC day. Updated summaries are sent to our Cloudflare service after you opt in, when the app starts, and about once an hour while it is running. Uploads can be delayed while offline or retrying.

These summaries help us understand whether people reach their first cited answer, return to read, and use features such as annotations and document chat.

• Presence on a day you launch the app, and whether you actively read or use reader features.
• Counts of successful and failed PDF opens.
• Counts of questions submitted, completed answers (including answers with citations), and failed or cancelled questions.
• Whether you use search, highlights, notes, or exports.
• Counts of update checks, including completions, failures, and cancellations.
• Counts of attempts to set up chat resources or prepare a document, including completions, failures, and cancellations.
• App version, operating system and architecture, and whether your device is eligible and ready for local chat.

What “de-identified” means here

Usage summaries contain no name, email address, or document content. A randomly generated app-profile ID links visits so we can measure return use. This makes the data pseudonymous, not fully anonymous: we can connect activity from the same reporting profile, but it is not a verified count of people. We do not match profiles across devices or accounts.

Counts tell us which features get used. They do not tell us what your documents are about, why you are reading them, what your questions say, or whether an answer is correct.

Your reading content stays out of analytics

Reports exclude PDF content, filenames, file paths, document hashes, notes, selections, search terms, questions, answers, raw error messages, and provider credentials. There is no session recording, screen capture, advertising ID, or automatic recording of every click.

As with any internet request, Cloudflare receives network information such as your IP address. Our collector does not log IPs or request bodies or link network information to usage profiles. Short-lived abuse prevention and Cloudflare’s infrastructure security processing still apply. U.S. launch availability does not mean all processing takes place in the U.S.

Optional AI-provider requests and resource downloads are separate product functions. See where document context goes when you use chat. Website download-start counts are also separate from app reporting and use no app ID or tracking cookies; read about website data.

Where data lives, and for how long

We store usage records in our Cloudflare database and keep reports in private Cloudflare storage. Cloudflare also maintains automatic database recovery history. We do not create additional raw usage data backups. Access is restricted to authorized operators. Reports show totals and trends for opted-in profiles; they do not represent everyone who uses Platypus.

Credentials for an active reporting profile remain on your device while needed for reporting. The 130-day period applies to retained deletion credentials for former profiles and server deletion safeguards.

Daily server cleanup can add up to a day at an expiry boundary. Expired local deletion credentials are removed when the app next runs. Safeguards prevent deleted profiles from returning if we restore the database from its recovery history.

Stop sharing or delete earlier data

Turn off Share usage data in Settings → Privacy to stop collection, clear queued counts, and cancel uploads. A request already received by the server may have completed. Turning sharing off does not by itself delete previously received data.

Choose Delete usage data and turn off reporting to request deletion for the current and former reporting profiles whose deletion credentials this app still holds. If you are offline, the request stays visibly queued and retries when Platypus next connects, even while sharing is off.

Verified deletion removes linked records and prevents further uploads for those profiles. Provisional reports update within seven days; final aggregate totals remain, and database recovery history expires on its schedule. Turning sharing on again creates a fresh reporting ID.

Uninstalling is not a server deletion request. If the local app profile or its deletion credentials are lost, we may no longer be able to identify the earlier reporting profile for deletion. Analytics files are excluded from document exports.

Privacy questions or deletion help

Platypus is operated by RidingWaves LLC. For privacy questions or help with a deletion request, email support@ridingwaves.io.