Privacy and security basics

Paperwise is built so that your papers stay on your iPhone unless you choose to send them somewhere. This page explains, in plain words, what happens on the phone, what Paperwise encrypts, what leaves the phone and when, and where the limits are.

What it is

What happens on your iPhone

Your iPhone does the page work itself: finding the page edges, cleaning up the image, recognising the text, reading text from files, search, and making PDFs. It all works offline and sends nothing. There’s no automatic AI text recognition: a page is read by AI only when you ask for it.

What Paperwise encrypts

Everything Paperwise stores on your iPhone (pages, files, photos, thumbnails and the database of titles, text, notes and tags) is encrypted with its own key, kept in this iPhone’s Keychain for this device only. Readable copies exist only while you scan, view, edit or share. Hidden adds keys only Face ID, your Hidden passcode or your recovery key open.

What	How it’s protected
Your vault’s pages, originals, files, photos, thumbnails, card photos, signatures and attachments (All items, folders, shelves)	Encrypted by Paperwise, each file with its own key, wrapped by a vault key kept in this iPhone’s Keychain for this device only. Face ID guards the app when the app lock is on.
The app’s database: titles, recognised text, notes, tags, settings	Encrypted by Paperwise, with its own key that stays on this iPhone.
Hidden	Encrypted by Paperwise, each item with its own key, behind Face ID (and your Hidden passcode or pattern, if you set one).
Sync across iPhone and iPad (Pro)	Encrypted on your device before it’s uploaded, with keys we don’t have.
The iCloud backup	Encrypted on your iPhone before it goes to your own iCloud, with a key protected by your recovery key. Apple can’t open it.
Share links (Pro)	Encrypted on your device; the key is in the link itself.

On top of Paperwise’s encryption, iOS keeps the app’s files unreadable while the phone is locked. A copy of the app’s files without this iPhone’s Keychain can’t be read.

The vault’s key isn’t behind Face ID, so sync and the backup work with the app lock off. That also means something running as Paperwise on your unlocked iPhone (malware, a jailbreak) could read the vault. Turn the app lock on, and for IDs, medical papers and anything you’d hate to lose control of, use Hidden.

Your vault is locked with Face ID. IDs, medical, bank and tax papers get extra care automatically: their previews are blurred, opening, sharing or exporting them asks for Face ID, and AI never names them automatically. Anything nobody should even know exists goes in Hidden. See Protected documents, Never send to AI and Hidden.

Because the vault’s key never leaves this iPhone, your documents are left out of iPhone device backups (iCloud and Finder), and neither a device backup nor a phone-to-phone transfer can open your vault. To keep a copy and move it to a new iPhone, turn on Paperwise’s encrypted iCloud backup (or sync, with Pro). Restored and synced files are encrypted again under the new iPhone’s own key.

What leaves the phone, and when

Paperwise locks everything it keeps in the cloud for you. Readable content reaches our servers only when you choose it:

When	What leaves	Readable by us?
You turn on the iCloud backup (free, opt-in)	Encrypted copies, to your own iCloud	No
You turn on sync (Pro)	Encrypted copies, to our storage	No
You make a share link (Pro)	An encrypted copy of that document	No
You start an AI action (Pro), or add items with Name and sort new scans on	That document’s text, or a page image	Yes, in memory while it’s processed, then passed to our AI provider
You convert to Word, Excel or PowerPoint (Paperwise asks first)	That document’s text or pages	Yes, in memory for seconds, then discarded
Someone emails your Forward by email address (Pro)	The email	It arrives as normal email and is sealed to your devices’ key on arrival

AI asks first

The AI helper is Pro-only, and it’s off on a new install. Nothing goes to AI until you allow it. Before AI first reads a document we tell you it isn’t fully private. With Pro’s Name and sort new scans on, you’re told once for everything you add afterwards, and it covers only items added on this iPhone after you turn it on.

Our AI provider is OpenAI. Requests are sent with storage turned off and without any user or install identifier, and OpenAI doesn’t train on them. Under its standard API terms, OpenAI may keep requests for up to 30 days for abuse monitoring; we don’t have a zero-data-retention agreement yet. Hidden items and documents marked Never send to AI are never sent. Documents that used AI show a small AI badge. See What AI sees and keeps.

An account is optional

You can scan, use Hidden, keep the encrypted iCloud backup and use everything on the phone without an account. An account (Sign in with Apple) is needed only for sync across devices and Forward by email. We don’t ask Apple for your name or email address.

No ads, no analytics, no crash reporter

Paperwise contains no advertising or analytics SDKs and no crash reporter. Purchases go through Apple and RevenueCat, our subscription provider, which receive purchase data and identifiers.

Your keyboard

Inside Paperwise only Apple’s keyboard works: third-party keyboards are switched off for the whole app, so what you type can’t reach a keyboard maker. In Hidden, autocorrect, spell check and predictions are off too, so words you type there don’t come back as suggestions in other apps.

Step by step

Check your privacy settings

Tap your avatar on the Vault to open Account.
Under Lock and privacy, check that the Face ID lock is on, and pick Lock after.
Under Back up my stuff, turn on the iCloud backup and save your recovery key.
Under AI helper, see whether the AI helper and Name and sort new scans are on.
Move anything nobody should even know exists into Hidden (••• → Move to Hidden on a document).

Free and Pro

The on-device work, the app lock, Hidden (one space), the encrypted iCloud backup and the encryption of everything Paperwise stores are free. Pro adds sync, share links, Forward by email, extra Hidden spaces, the emergency passcode, the disguised icon and the AI helper. See Free and Pro.

Privacy

The recovery key trade-off

The keys that open your synced, backed-up and Hidden content exist only on your devices. We keep a copy of your account key only locked with your recovery key, which we never see. That’s what stops us, or anyone who breaks into our servers, from opening your data. The price: if you lose every device and your recovery key, nobody can recover your data, including us. Write the key down or print it, and keep it away from your phone. See Your recovery key.

Honest limits

The vault’s key is on the iPhone, not behind Face ID: something running as Paperwise on your unlocked iPhone could read the vault. Readable copies also exist while you scan, view, edit or share. Keep your most private papers in Hidden.
By default Hidden opens with Face ID alone. Add a Hidden passcode or pattern for a second lock.
Screenshot blocking in Hidden is best effort; iOS can’t stop every capture.
Email isn’t end-to-end encrypted on its way to us.
Anyone with a whole share link can open it until it expires, is used up or is turned off, and can save a copy.
We can see some metadata, such as sizes, counts and times. See What we can and can’t see.
An independent security audit is planned, not done yet. Certificate pinning isn’t on yet in current builds.

The full technical details are in the security whitepaper, and a shorter overview is on the Security page.

Tips

Turn on the app lock if you skipped it at first run: Account → Lock and privacy.
Mark a document Never send to AI (•••) if it should never reach AI, even by accident.
Keep your recovery key somewhere other than your iPhone.

What if…

What if I lose my iPhone?

If your backup or sync was on and you have your recovery key, you can get your documents back on a new phone. See If you lose your phone.

What if I don’t want anything to leave my phone?

Don’t turn on sync, share links, the AI helper or Forward by email, and don’t convert to Word, Excel or PowerPoint. Everything else stays on the iPhone. Think about the iCloud backup anyway: it’s encrypted before it leaves, and without it a lost phone means lost documents.

What if I want to remove everything from this iPhone?

Signed in: Sign out and choose Remove this account’s documents from this iPhone. Hidden isn’t touched; erase it from Hidden with Forgot passcode? → Erase Hidden on this iPhone…. See Sign out.
Deleting your account: turn on Also erase everything on this iPhone, Hidden included, and Also delete your iCloud backup if you want that gone too. See Delete your account.
Deleting the app: iOS removes the app and its documents, and if you install it again, Paperwise first deletes the keys it left in the Keychain, so nothing comes back by itself. See Install Paperwise.

What if I find a security problem?

Write to security@paperwise.app with the details and steps to reproduce.