What we can and can't see

This page lists, feature by feature, what our servers can see and what they can’t, and how long we keep each kind of record. It follows section 9 of our security whitepaper, which has the technical details.

What it is

Most of what you do in Paperwise never reaches us: the page work happens on your iPhone. What does reach us is either encrypted before it leaves your device (sync, share links), sealed the moment it arrives (email), or something you chose to send in readable form for a moment (AI and Office conversions). On top of that we keep some records about accounts, devices and usage, so the service can work.

What our servers can and can’t see

Feature	We can see	We can’t see
Page processing (edges, clean-up, text recognition, file text, PDF export, PDF and capture tools)	Nothing. It all runs on your iPhone.	Your pages, their text, your files.
AI helper (Pro: Ask, Extract, Translate, Read handwriting, Name and file with AI, Keep the layout, Count objects, and automatic naming with Name and sort new scans)	The text of that document, or a page image for Read handwriting, Extract, Keep the layout and Count objects. It’s processed in memory and passed to our AI provider without any user or install identifier.	Hidden items and documents marked Never send to AI: they’re never sent and no request is made. We don’t store the content after the answer.
Office conversion (Word, Excel, PowerPoint)	For Word and Excel: the title, your language setting (Word), the recognised text of each page, and a page image only for a page without recognised text. For PowerPoint: the title and the full page images. Processed in memory for seconds, then discarded.	Anything, once the file has been sent back.
Your account	A scrambled form of your Apple identifier (we don’t ask Apple for your name or email); Apple’s sign-in token, stored sealed; your devices (name, which is your iPhone’s model by default and is reset to it at each sign-in; platform; public keys; install ids; notification tokens; when each was added; when each was last seen, updated at most once a day; removed devices); sign-in sessions; your account’s public signing key; whether you have Pro.	Your Apple email address; your keys.
Purchases	Apple and RevenueCat, our subscription provider, see your purchases and your install id. RevenueCat’s SDK also sends a device identifier, your device model, iOS version, language and App Store country. We only ask RevenueCat “is this install Pro?”.	Your documents.
AI usage counts	How many AI actions (per day and month) and automatic namings (per day) each paying install used, and its estimated AI cost per day, under a scrambled form of its id. How many emails reach each Inbox per day.	What the actions were about.
Sync (Pro)	How many encrypted items and files you have, hidden ones included, their sizes, versions and times; which files belong to which item (so roughly how many pages a document has); deletions and when they happen; which device made each change.	Titles, text, folder names, images, file names. We can count your synced hidden items, not open them.
Forward by email (Pro)	That a message arrived and when, its size and number of parts; your approved-senders list, in readable form so the server can check it; your current and past addresses.	The sender, subject, file names and contents: they’re sealed to your devices’ key on arrival.
Share links (Pro)	Sizes, expiry, number of opens, number of wrong-password tries, which install or account made the link. IP addresses are used for a moment to limit abuse and aren’t stored.	The document, its title, the link’s key, the password. (Whoever opens the link sees the document with its title and file name.)
Server logs	For each request: an id, the kind of request (with ids removed), the result, timing, a short fragment of a scrambled install id, and whether limits or quotas applied. For each email: its size, number of parts and what happened to it. Error names; a few error lines also include the error’s message.	Request contents, document contents, email addresses, names or subjects.

Privacy: Email isn’t end-to-end encrypted on its way to us. The sender, their email provider and our mail server see a message as it arrives; it’s sealed straight away, and only your devices can open it afterwards.

How long we keep things

Record	How long
Email waiting to be downloaded (sealed)	Until your app downloads it, at most 30 days (plus up to about a day for the daily clean-up). Mail that arrives while your account doesn’t have Pro is discarded unread.
AI usage counts and the daily email count	35 days, also after you delete your account.
Whether you have Pro	Cached for 10 minutes; the last known answer is kept for 30 days.
Sign-in sessions	Until 90 days without use. Revoked sessions are deleted 30 days after they’re revoked.
Records of synced items you deleted	For as long as the account exists.
Past email addresses	Forever, without any link to your account after deletion, so they’re never given to anyone else.
Share-link files	Deleted at once when you turn a link off; about 3 minutes after the last allowed open or a lock; up to about a day after expiry.
Your account, when you delete it	At once when you delete it from a device that has your account key. Otherwise after 7 days (plus up to about a day), so your devices can cancel a deletion you didn’t ask for.
Notification tokens of removed devices	30 days after removal, used only for account-security notifications.
Failed background tasks	30 days, so we can retry them by hand. A failed Apple sign-in revocation is kept at most 3 days.
Database history	About 30 days of history of everything above. Deleted records can be restored from it during that time; encrypted ones stay encrypted.
Server logs	As long as our hosting provider (Cloudflare) keeps logs for our plan.
Purchase records	Under RevenueCat’s policy. They aren’t deleted with your Paperwise account.
Our AI provider (OpenAI)	Up to 30 days for abuse monitoring, under its standard API terms. We don’t have a zero-data-retention agreement yet.

When to use it

Read this before you turn on sync, share links, Forward by email or the AI helper, or if you’re deciding what to keep in Hidden.

Privacy

What this page doesn’t cover: the iCloud backup goes to your iCloud, not to us. It’s encrypted on your iPhone first, so Apple sees how many records there are, their sizes and dates, but can’t open your documents. We don’t see it at all.

Tips

If your approved-senders list would say too much about you, use domains (such as lydec.ma) instead of full addresses, or don’t use the list.
Leave Show the sender off in Forward by email so notifications only say “New item in your Inbox”.
Mark a document Never send to AI if it should never reach AI.

What if…

What if your servers are broken into?

An attacker could delete or hold back what we store and see the records in the table above, but couldn’t read your synced items, sealed email or share links, or forge changes signed with your account key. The copies on your devices aren’t affected.

What if I delete my account?

We delete the account, the synced copies on our servers, your share links and email that hasn’t been downloaded, and retire your email address (it’s never given to anyone else). AI usage counts expire within 35 days and database history within about 30 days. Apple and RevenueCat keep purchase records. Your documents stay on your iPhone, signed out, and your iCloud backup stays in your iCloud, unless you turn on Also erase everything on this iPhone or Also delete your iCloud backup when you delete. See Delete your account.