This policy explains what personal data Paperwise collects, why, how long we keep it, who else processes it, and the rights you have. It covers the Paperwise app for iPhone and iPad, the share-link viewer and this website. The technical details are in our security whitepaper.
Who we are. Paperwise is provided by [Company legal name], [Address], [Company registration number]. We are the controller of the personal data described here. Contact: support@paperwise.app; for privacy requests, [privacy contact email, e.g. privacy@paperwise.app]. [EU/UK representative, if required.]
The short version
- Your documents are processed on your iPhone. Your vault is stored on your device, and everything Paperwise stores is encrypted with its own key, kept in that iPhone’s Keychain for that device only. Readable copies exist only while you scan, view, edit or share.
- What Paperwise keeps in the cloud for you (sync, the iCloud backup, share links, forwarded email) is encrypted on your device or sealed on arrival, with keys we don’t have. We can’t read it.
- We see a document’s content only while an AI action or a Word, Excel or PowerPoint conversion you started is running, and we don’t store it.
- We collect a small amount of account, device, purchase and usage data to run the service. We don’t use advertising or analytics SDKs, we don’t track you, and we don’t sell data.
What we collect, and why
We collect personal data only to provide the app’s features (in App Store terms, “App Functionality”). We don’t use it for advertising, analytics or profiling.
| Data | What exactly | Why | Legal basis |
|---|---|---|---|
| Account identifiers | If you sign in with Apple: a keyed hash of your Apple account identifier (never the identifier in clear), Apple’s sign-in refresh token (stored sealed), session tokens (stored as hashes), an account id. We don’t ask Apple for your name or email address. | To run your account, sync and Forward by email | Contract |
| Device data | For each device on your account: its name (your iPhone’s model by default), platform, public keys, an install id, a push token if you turned notifications on, when it was added and when it was last seen (about once a day) | To sync between your devices, notify them and protect your account | Contract; legitimate interest (account security) |
| Purchases | Your subscription status and purchases, handled by Apple and RevenueCat with an app user id (your install id); RevenueCat’s SDK also sends the device’s IDFV, model, OS version, locale and App Store storefront | To provide Pro | Contract |
| Usage counts | How many AI actions (per day and month) and automatic namings (per day) a paying install used, and an estimated daily AI cost, keyed by a hash of the install id; a daily count of forwarded emails per account | To apply the AI and email limits | Contract; legitimate interest (preventing abuse) |
| Email you forward | That a message arrived, when, its size and number of parts. Its contents, sender, subject and file names are sealed to your devices’ key on arrival; we can’t read them after that. Mail that arrives while your account doesn’t have Pro is discarded unread | To deliver Forward by email | Contract |
| Approved senders | The list of addresses you approve for Forward by email, stored readable so our server can check incoming mail; your current and past forwarding addresses | To deliver Forward by email and keep addresses from being reused | Contract; legitimate interest |
| Encrypted content | Synced items, share-link files and forwarded email, as ciphertext we can’t open, with their sizes, versions, dates and which device made each change | To provide sync, share links and Forward by email | Contract |
| Content you send to AI or for conversion | The text or page images of a document, only when you start an AI action, have turned on “Name and sort new scans” (Pro), or start a Word, Excel or PowerPoint conversion. Processed in memory and not stored by us | To provide the feature you asked for | Contract; your request |
| Server logs | Per request: a request id, the route, status, timing and a short prefix of a hash of the install id; per forwarded email: size, part count and outcome. No request bodies, document contents, email addresses, names or subjects | To keep the service running and secure | Legitimate interest |
| Network addresses | IP addresses, used briefly for rate limiting and not stored by us | To protect the service from abuse | Legitimate interest |
| Support messages | What you write to us and your email address | To answer you | Legitimate interest; contract |
What we don’t collect: your documents, photos or notes as readable data (except while an AI action or conversion you started runs), your contacts, location, health or financial data, browsing or search history. Your Apple email address and name aren’t requested. This website uses no cookies and no analytics.
AI
Nothing goes to AI until you allow it, and the app tells you first. AI requests are sent by our server to our AI provider, OpenAI, with storage turned off and without any user or install identifier. OpenAI doesn’t use API data for training, but under its standard API terms it may keep requests for up to 30 days for abuse monitoring. We don’t have a zero-data-retention agreement yet. Hidden items and documents marked “Never send to AI” are never sent.
Who processes data for us
| Processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting our servers, database, storage, email routing and this website | [Regions / transfer mechanism] |
| OpenAI, L.L.C. | AI features you choose to use | [United States; transfer mechanism] |
| RevenueCat, Inc. | Subscription management | [United States; transfer mechanism] |
| Apple Inc. | Sign in with Apple, in-app purchases, push notifications, and your iCloud backup (stored in your own iCloud account, encrypted on your device) | [Regions] |
We don’t sell or share personal data with anyone else, except where the law requires it. [Describe international transfers and safeguards, e.g. Standard Contractual Clauses.]
How long we keep it
| Data | Kept |
|---|---|
| Account and device records | Until you delete your account (deletion requested without your account key is scheduled for 7 days later) |
| Sessions | Until 90 days without use; revoked sessions are deleted 30 days later |
| Push tokens of removed devices | 30 days after removal, for account-security notices only |
| Pro status cache | 10 minutes; last known value 30 days |
| AI usage counts and the daily email count | 35 days, also after account deletion |
| Forwarded email (sealed) | Until your app downloads it, at most 30 days |
| Share-link files | Deleted at once when you turn a link off; otherwise up to about 24 hours after expiry |
| Sync deletion records | For the life of the account |
| Past forwarding addresses | Kept, without a link to you after account deletion, so they’re never given to someone else |
| Database history | Our database provider keeps about 30 days of point-in-time history |
| Server logs | Cloudflare Workers Logs’ retention for our plan |
| RevenueCat and Apple purchase records | Under their own policies; not deleted with your Paperwise account |
| OpenAI | Up to 30 days, under OpenAI’s API terms |
Your rights
Depending on where you live, you have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to a data-protection authority. To delete your account and the data we hold for it, use Account → Plan & account → Delete account in the app (see Delete your account). For anything else, write to [privacy contact email]. We’ll answer within [one month].
Because your content is encrypted with keys only you hold, we can’t read, export or recover it for you. Documents on your devices stay there until you delete them or the app.
Deleting your account
Deleting your account deletes the account, the synced copies on our servers, your share links and any forwarded email still waiting, and retires your forwarding address. Usage counts expire within 35 days and database history within about 30 days. Apple and RevenueCat keep their purchase records, and deleting your account doesn’t cancel an App Store subscription. Documents on your iPhone and your iCloud backup stay where they are until you delete them.
Children
Paperwise isn’t directed at children under [13/16]. [Adjust to the applicable law.]
Security
We describe our security measures, and their limits, in the security whitepaper. Report vulnerabilities to security@paperwise.app.
Changes
We’ll post changes to this policy here, with a new date, and tell you in the app if they matter.