Privacy Policy

Last updated: October 11, 2026

PaperSafeAI is built local-first: your documents, Vault Items, extracted text, and search index live in an encrypted database on your own devices, not on our servers. This page explains exactly what data the desktop app, the phone app and this website touch, where it goes, and what stays on your devices.

This policy covers PaperSafeAI only: the desktop app, the phone app and the website at papersafeai.com. Other apps from PAPERSAFEAI LABS PRIVATE LIMITED have their own privacy policies.

In short: your vault stays on your devices. Your passwords and Vault Items never leave them. Your documents leave them only if you turn on Cloud reading on your phone, and then only images of their first pages, which are read and not kept (section 5). Everything else that leaves your device is something you deliberately turn on or use yourself — Cloud reading, anonymous analytics, crash reports, email alerts, feedback you choose to send, and, if you use Pro, the licence details our licence service needs. The optional ones are off by default, and each is described below exactly as it works. Reminders you schedule stay on your device and are never sent anywhere.

1. What stays on your device

By default, everything does. When you import a document, PaperSafeAI:

• Stores the file, its extracted text, and its metadata in a local, encrypted database. The document file and its extracted text are protected by your master password (and, if enabled, biometric or PIN unlock).
• Stores a local search index and semantic embeddings so search works. Both live in the same encrypted database, whose encryption key is derived from your master password, so opening them requires your master password and not merely access to the device or its keychain. The embeddings are additionally encrypted field by field under your master password, so they become unreadable again as soon as you lock the vault. One limit worth stating plainly: the keyword search index cannot be encrypted the same way, because matching words requires storing them. It is protected by the encrypted database around it, and that database stays open until you quit the app — so locking the vault again does not re-seal the keyword index for the rest of that session.
• Stores Vault Items, including passwords, PINs, cards, identity numbers, secure notes, API keys, and Wi-Fi credentials, locally in the same encrypted vault.
• On your computer, runs OCR, metadata extraction, and semantic search entirely with on-device AI models — the desktop app never sends your document content to a cloud AI service. On your phone, a document's details are read by your desktop once it syncs, or, only if you turn it on, by Cloud reading (section 5).
• Never uploads your documents, Vault Items, vault contents, or search index to PaperSafeAI or any third party. The one exception is Cloud reading on your phone, which you turn on yourself: it sends images of a document's first pages to be read, and they are not kept. Vault Items are never sent.

On a phone, uninstalling removes the local vault, although some device identifiers may remain as described below. On a computer, uninstalling the app can leave the vault in its app-data folder so you can reinstall and open it again. To remove it, choose Settings → This Computer → Delete All Data & Quit before uninstalling. We have no copy to restore on our end: Cloud reading pages are read and discarded.

2. Optional Google Drive import

If you choose to connect Google Drive, PaperSafeAI requests Google's narrow drive.file permission scope. This means PaperSafeAI can only see and import files you explicitly pick through the app's file picker — it cannot browse or access the rest of your Google Drive. Your Google OAuth token is stored locally on your device (not on our servers) and is used only to fetch the files you select. You can revoke this access at any time from your Google Account settings or from within PaperSafeAI.

3. Backups

Backups are created only when you initiate them, and are written to a location you choose (a local folder, or a folder you happen to sync via your own cloud storage). Backups may include your documents, extracted metadata, search data, and Vault Items if you choose to back up the full vault. You can optionally encrypt a backup with a passphrase; encrypted backups use AES-256-GCM with an Argon2id-derived key. We never see or store your backups or your backup passphrase.

4. Syncing with your phone

If you install the PaperSafeAI app on your phone, you can pair it with your desktop to keep the two in step. Pairing is something you start deliberately, by scanning a code shown on your desktop.

This sync never touches our servers. Your desktop and your phone talk to each other directly over your own local network, and what passes between them is encrypted on top of that. Documents, extracted text, Vault Items and metadata are copied between your two devices and nowhere else. We operate no sync server, hold no copy, and could not read the traffic if we wanted to. If the two devices are not on the same network, they simply do not sync until they are.

Unpairing from either device stops the sync. Data already copied to a device stays on that device until you delete it there or uninstall the phone app. On desktop, use Delete All Data & Quit to remove the local vault. Cloud reading, if you turn it on, is separate from sync and is described in section 5.

5. Cloud reading on your phone (optional, off by default)

The phone app can send documents you add on it to our cloud service, PaperSafeAI Cloud, so AI can read their details (such as dates, names and numbers) for you. Cloud reading is off by default. It starts only when you turn it on in Settings → Cloud reading and tap Agree and turn on under the notice shown there. Before that, the phone only asks our service whether Cloud reading is available, and that request carries no identifier. While it is off, documents you add on the phone are read by your desktop after they sync, or not at all if you have no desktop. The desktop app has no Cloud reading: it reads documents on your computer.

What is sent, and when

• Page images. For each PDF, PNG or JPEG document you add on the phone while Cloud reading is on, images of its first 3 pages. When you turn it on, the same goes for documents imported on the phone earlier that nobody has read yet (on a phone paired with a desktop, only those not yet sent to it). You do not pick the pages. Other file types, such as HEIC, WebP or Office files, are never sent; your desktop reads them.
• Photos are cleaned first. Before a photo is sent, its location (GPS), camera details and other metadata are removed; a photo the app cannot clean is not sent at all. PDF pages are turned into plain images on the phone, which carry none of the PDF's own metadata. The original file name is never sent.
• Never sent: passwords, Vault Items and other credentials, your master password or recovery key, and documents your desktop has already read.
• With each page: request numbers, the id of your consent receipt, the page number, your phone's language setting (for example en-IN), and the country your documents are from (the one you chose under “Documents from”, or the one your language setting names), so names and dates are read the way your country writes them.
• To prove the request comes from the genuine app, each session (a session lasts 15 minutes) also carries: on Android, a random install id the app makes and a Google Play Integrity token; on iPhone, an Apple App Attest proof. The app may also send a hashed Android ID or an iPhone grant id, but the free-page count is tied to the verified installation, not these device identifiers. If the phone has Pro, its licence key goes too, so the pages are counted against your licence.
• When you turn it on: the version of the notice you agreed to and your phone's language setting, which make up your consent receipt.

Everything travels over HTTPS. Our service has to see a page to read it, so Cloud reading is not end-to-end encrypted: the page is decrypted on your phone, sent, and read by our service.

Who handles it

Our service runs on Cloudflare Workers, and the AI model runs on Cloudflare Workers AI, in Cloudflare's data centres, which may be outside your country. The model is an openly published one (currently Google's Gemma) that Cloudflare runs itself; your pages are not sent to the company that made it. On Android, Google Play Integrity checks that the request comes from the genuine app on a real device; on iPhone, Apple App Attest does the same. Google and Apple receive the integrity token or proof for that check, never your pages.

What is not kept

Page images and the readings that come back are held in memory only while they are read, then discarded. They are not stored, not written to logs (our service's logging is switched off; on an error it records only an error code and a random reference number), and not used to train AI models, by us or by Cloudflare. The reading comes back to your phone and is stored there, in your encrypted vault, like any other document details; on a paired phone it then goes to your desktop with the document. A reading never replaces details you have edited yourself.

What is kept, why, and for how long

None of the following holds anything from your documents.

• Your consent receipt — a random id, the notice version, your language setting and the time you agreed — so every page can be checked against your agreement. Kept until you turn Cloud reading off or delete your cloud data.
• An install record, so the genuine app can sign in. On Android: the time the install was first seen, under a scrambled (hashed) form of the app's random install id. On iPhone: the App Attest public key, the app id, a counter and the time first seen. Today it has no expiry, and “Delete my cloud data” keeps it.
• Your free-page count. Each eligible verified app installation gets 5 free cloud pages. The count (pages used and pages being read right now) is kept under that installation's identifier. Reinstalling the app can start a new five-page allowance. Today the old count has no expiry, and deleting your cloud data does not reset the current installation's count.
• Your Pro page count — the pages used each month — under your licence id, shared by every device on the licence. Today it has no expiry.
• The last Pro check — your licence id, a scrambled (hashed) form of your licence key, the plan and when it was checked — so the licence is not checked on every page. Kept until a newer check replaces it, or until you delete your cloud data.
• Short-lived records that stop the same page being read twice and a sign-in being replayed: request markers for 10 minutes, one-time sign-in challenges until they expire (5 minutes), and a count of requests in the current minute.
• Per-allowance counters for pages refunded after unusable reads and for new free grants from one network. These counters do not contain document contents.

Your IP address

Our service sees your IP address, as any internet service does. It uses it only to limit abuse: to cap how many requests one address can send in a minute (Cloudflare's rate limiter counts them over 60 seconds), and to cap how many new free-page grants one network can open in a day. That second count is kept under a keyed, scrambled form of the day and the network, never the address itself, and is deleted at the next midnight (UTC). We do not store your IP address and do not use it to find your location.

Turning it off, and deleting your cloud data

Turning Cloud reading off stops new pages at once, stops a page that is being sent, and withdraws (deletes) your consent receipt — at the next connection, if the phone is offline. On a paired phone, documents still waiting to be read go to your desktop instead. Pages already read stay read: the readings are part of your vault, and you remove them by editing or deleting the document.

Settings → Cloud reading → Delete my cloud data turns Cloud reading off and erases your consent receipts, the last Pro check and the request markers. It does not delete the install record (so the app can still sign in), the one-time sign-in challenges until they expire a few minutes later, the free and subscription page counts. The free count belongs to this verified installation, and the subscription count belongs to the licence. Reinstalling can start a new free allowance.

6. Crash reports (optional, off by default)

PaperSafeAI can send crash reports to our error-monitoring provider, Sentry, which processes them in the European Union on our behalf, so we can fix bugs. This is off by default — it's only ever turned on if you explicitly enable "Automatic Crash Reports" during setup or later in Settings → Security & Privacy → “What PaperSafeAI shares” (on the phone, Settings → Privacy & Diagnostics), and you can turn it off again at any time. When enabled, a crash report includes the error type, a stack trace, your app version, and OS/device information. Before anything is sent, we strip your home directory path and local variable values from the report. Crash reports never include your documents, Vault Item names or values, passwords, card numbers, API keys, secure notes, vault contents, search index, or master password. If this setting is off, no crash data ever leaves your device — it stays in a local log file only.

7. Analytics (optional, off by default)

PaperSafeAI can send anonymous product-usage analytics to our analytics provider, PostHog, which processes them in the United States on our behalf, so we can understand which features are used and improve the app. This is off by default — it's only ever turned on if you explicitly enable "Anonymous Analytics" during setup or later in Settings → Security & Privacy → “What PaperSafeAI shares” (on the phone, Settings → Privacy & Diagnostics), and you can turn it off again at any time. When enabled, we record coarse product events (for example, that a document was imported, a search was run, or a backup completed) together with a randomly generated anonymous ID and basic device context (platform, OS version, app version, device model, device architecture, locale). The anonymous ID is random and means nothing outside our analytics: your desktop generates one for your vault and shares it with the phones you pair, so your own devices count as one user; devices that are not paired each use their own random per-install ID. We never record your document content, file names, search queries, Vault Item names or values, secrets, notes, passwords, card numbers, API keys, or any other identifying information about your vault. If this setting is off, no analytics data is ever sent.

8. Feedback

If you use the in-app feedback form, the message, category, and star rating you submit — along with basic device context (app version, platform) — are sent to PostHog so we can read and act on it. Submitting feedback is its own explicit action and is sent regardless of whether Anonymous Analytics is turned on. Providing a contact email in the feedback form is optional and used only to follow up with you about that submission.

9. App updates

If you installed PaperSafeAI directly (not through the Mac App Store or Microsoft Store), the app checks our release server at downloads.papersafeai.com — hosted on Cloudflare — when it starts and about once an hour after that, so it can download and install new versions. The check shares the standard technical request information that any file download involves, such as your IP address and your operating system, plus your app version and a plain “counted” flag so we can count how many installs are active (see section 10). No install id or other identifier is sent. No document, Vault Item or vault data is included, and we do not use this check to build a profile of you.

Updates install themselves, so that every install stays on the current version. You can postpone the restart for 24 hours from the moment an update is first offered; after that the app asks you to restart before carrying on. If a download fails, it never locks you out of your own vault. If you installed PaperSafeAI through the Mac App Store or Microsoft Store, updates are handled entirely by Apple or Microsoft instead and this check does not run. The licence status check (section 10) still runs in those installs, on the same schedule, once a licence key is entered.

10. Every connection the desktop app makes

This is the complete list of what the desktop app sends over the internet. Sync between your own desktop and phone stays on your local network (section 4) and is not listed, because it never reaches us.

• Update check — direct-download installs only, at start and about hourly, to downloads.papersafeai.com. Sends the app version and, on the first check of each day and of each month, a plain “counted” flag, in the request headers rather than the address. That is how we count active installs: we add up the flags, with the platform, release channel and version, and store nothing else — no identifier of any kind, not your IP address, not your browser or device details. (Your IP address is used for about an hour, only to rate-limit requests, and is not stored.) Your install has a random id generated on your computer; it is not sent to us, is kept apart from everything in your vault, and is not derived from your hardware, computer name, user name or email.
• AI model downloads — when a feature first needs an on-device model, the app downloads a fixed file from downloads.papersafeai.com. The request names the file and nothing else.
• Licence activation — when you enter a licence key, or release or remove a device, to billing.papersafeai.com. Sends the licence key, a random device id, a device label made of your operating system and the start of that id (for example darwin-3f9a2c, never your computer’s name), the device type (desktop), and which seat it uses — yours, or a family member’s together with the name you gave that member.
• Licence status check — only once a licence key is entered, at start and about hourly, to the same server, in every install (including Mac App Store and Microsoft Store ones). Sends the licence key and the random device id, so this device learns if it was removed from your licence elsewhere. A paid licence needs one of these checks to succeed at least every 14 days to stay Pro offline (terms).
• The licence service’s second address — if billing.papersafeai.com cannot be reached, any of the licence requests in this section (and in section 11) is sent once more, unchanged, to papersafeai-billing.papersafeaiapp.workers.dev: the same service, run for us by Cloudflare at its own address. Nothing else is sent there.
• Prices and device limits — only while the Upgrade window is open, to the same server. Asks for the current plans, prices and how many devices a licence covers; sends nothing about you or your device.
• Collecting a purchase — after you pay in the app, to the same server, until your licence key arrives (for up to a week). Sends a random purchase reference the app made for that checkout, or Paddle’s transaction id, so the app can install the key itself.
• Manage billing — only when you open it, to the same server. Sends your licence key and the email address on your licence, to open your billing page.
• Google Drive import — only when you choose to import from Google Drive, to Google (accounts.google.com, www.googleapis.com). You sign in with Google in your browser and pick the files; the app downloads only those files. See “Google Drive” above. Disconnect it any time in Settings.
• Buying Pro — checkout opens Paddle (Paddle.com), our reseller and merchant of record, in a window inside the app that shows our checkout page and Paddle’s payment form. Paddle collects your payment details, email and billing address, handles tax and invoices, and tells our billing server that the purchase completed so we can email your licence key. We never see or store your card details. Paddle’s own privacy notice covers what it does with them.
• Crash reports — only if you turned them on (section 6), to Sentry.
• Analytics — only if you turned it on (section 7), to PostHog.
• Feedback — only when you submit the feedback form (section 8), to PostHog.
• Email alerts — only if you turned them on (section 12), to our alert service.

The update check, model downloads and licence calls never send your documents’ content, their file names, how many documents you have, or your contacts. What crash reports, analytics, feedback and email alerts include is described in their own sections. The phone app's Cloud reading is described in section 5, and what it sends for Pro in section 11.

11. Pro on your phone: store purchases, licence and device identifiers

Buying Pro in the app. Pro bought in the phone app is sold and billed by Apple (App Store) or Google (Google Play), which collect your payment details; we never see or store your card details. To give you a licence, the app sends our licence service (billing.papersafeai.com) the store's proof of purchase (Apple's signed transaction, or Google's purchase token), a random purchase account id the app made and gave the store with the purchase, and the phone's licence device id (below). Our service checks the purchase directly with Apple or Google, which tell it the product, its status and when it ends, and then issues your licence key. Apple and Google also tell our service when a purchase renews, is cancelled or is refunded. We keep a record of each store purchase with its licence: scrambled (hashed) purchase identifiers, the product, the plan, its status and its expiry. A licence bought in a store has no email address attached. Refunds for store purchases are handled by Apple or Google (see our Refund Policy), and Apple's and Google's own privacy policies cover what they do with your purchase.

Licence and device identifiers. Whenever the phone has Pro — from a store purchase, a licence key you enter, or pairing with a computer that has Pro — it sends our licence service the licence key and a device id, and, when it activates, the phone's model name (for example “Pixel 8”, not the name you gave your phone) and the device type (mobile). This is how a licence's device limit and moves between devices work, and the service keeps the device id in the licence's device list. On iPhone the device id is random and kept in the phone's keychain. On Android it is made from the Android ID, scrambled with SHA-256 so the Android ID itself is not sent, which keeps your place after a reinstall; with no Android ID it is random. With Cloud reading on, the licence also goes with each Cloud reading session (section 5).

The Pro trial on Android. When an Android phone starts its free Pro trial, it asks our licence service whether this phone has had the trial before, so that reinstalling the app does not start a new one. It sends a reference made from the device id above — scrambled again with SHA-256, so neither the Android ID nor the device id is sent — and our service keeps that reference with the trial's start and end dates. On iPhone the trial is checked on the phone alone and nothing is sent. Apart from this, a phone without Pro sends none of the identifiers in this section.

12. Optional email alerts

PaperSafeAI reminds you about upcoming expirations inside the app. It can also email those alerts to you, which is optional and off until you turn it on in Settings → Notifications and confirm your address with a code we email once.

When it is on, your device sends our alert service your email address, and for each alert the type — an expiry, a renewal, or a reminder you set — the date, and a random identifier. If you have paid Pro it also sends your licence key, which the service checks and does not keep, so your alerts are counted against your plan. It never sends the document's name, type, contents, or anything you typed, and the emails themselves say only that something is due and when. The service runs on Microsoft Azure (United States) and delivers through Azure Communication Services, or through Resend, which we keep as a backup email provider. It keeps a scrambled (hashed) copy of your address so it can honour unsubscribes and avoid emailing you the same alert twice; it keeps no list of users and nothing it holds can be turned back into your address. Turning the setting off, choosing Remove in Settings, or clicking Unsubscribe in any alert email stops it.

SMS and WhatsApp delivery are not enabled in the current release. If we introduce them, sending that way will require you to connect your own account with that provider, and delivery will happen directly between your device and that provider using the credentials you supply.

13. Who processes data for us

These companies process data for us, on our instructions, only for the features described above and only when you use them. We do not sell your data or share it with anyone for advertising.

• Cloudflare — runs Cloud reading and its AI model (section 5), our licence service at billing.papersafeai.com (sections 10 and 11), and our release server at downloads.papersafeai.com (section 9), in its data centres around the world.
• Google — on Android, Play Integrity for Cloud reading (section 5), and Google Play billing for Pro bought in the app (section 11). Google Drive only if you connect it (section 2).
• Apple — on iPhone, App Attest for Cloud reading (section 5), and App Store billing for Pro bought in the app (section 11).
• Sentry — crash reports, only if you turn them on (section 6), in the European Union.
• PostHog — analytics, only if you turn them on, and feedback you send (sections 7 and 8), in the United States.
• Microsoft Azure (Azure Communication Services), with Resend as a backup — email alerts, only if you turn them on (section 12), and the email carrying your licence key after a purchase on our website.
• Paddle — our reseller and merchant of record for purchases on our website (section 10).

Apple and Google, for store purchases and their device checks, and Paddle, for website purchases, also handle that data under their own privacy policies. Some of this processing happens outside India, including in the United States, the European Union and Cloudflare data centres in other countries.

14. This website

This marketing website (the page you're reading now) does not use analytics or advertising trackers. If you submit your email to receive product updates, we use it only to send you release notes and will never sell or share it. Our hosting provider may log standard technical request information (such as IP address and browser type), consistent with any website on the internet.

15. Your rights and choices

Most of your data never reaches us, so you control it directly in the app:

• Access & export: use the in-app backup feature at any time to export a full copy of your vault, including Vault Items if you choose a full-vault backup.
• Delete: delete individual documents and Vault Items in the app. On desktop, use Settings → This Computer → Delete All Data & Quit before uninstalling to remove the local vault, models, settings and logs. Uninstalling desktop alone may leave that data for a later reinstall. On a phone, uninstalling removes the local vault; device-level identifiers and any backup you saved elsewhere are separate.
• Disconnect integrations: disconnect Google Drive (or any future integration) from within Settings at any time.
• Turn off crash reports or analytics: both are off by default and can be toggled independently at any time from Settings → Security & Privacy → “What PaperSafeAI shares” (on the phone, Settings → Privacy & Diagnostics).
• Turn off Cloud reading, or delete your cloud data: on the phone, Settings → Cloud reading (section 5). Turning it off withdraws your consent as easily as you gave it, and stops any further sending; it cannot undo pages already read.
• Stop email alerts: turn them off, choose Remove in Settings, or click Unsubscribe in any alert email (section 12).

If you are in India

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we process about you, what we do with it, and who we have shared it with;
• have it corrected, completed or updated;
• have it erased, unless we must keep it to comply with the law;
• withdraw your consent at any time, as easily as you gave it; this stops processing based on that consent, but does not undo processing already done;
• have a grievance about how we handle your personal data heard and answered by us; and
• nominate another person to exercise these rights for you if you die or become unable to act.

If you are not satisfied with our answer to a grievance, you may complain to the Data Protection Board of India.

If you are in the United States

Depending on the state you live in, you may have the right to know what personal information we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or its use for targeted advertising. We do not sell personal information, do not share it for targeted (cross-context behavioural) advertising, and do not use it to profile you. We will not treat you differently for using any of these rights.

How to use these rights

Email [email protected]. Because we hold so little, and most of it under random ids rather than your name, tell us what your request is about — for example your licence id, or the email you bought with on our website. For Cloud reading, “Delete my cloud data” in the app is the quickest way: we cannot connect an email address to a phone's cloud records. We may ask you to confirm that the request comes from you. We will reply as soon as we can.

16. Children's privacy

PaperSafeAI is meant for adults and is not directed at, or knowingly used to collect information from, anyone under 18 (the store listings declare an 18+ audience).

17. Changes to this policy

If this policy changes, we'll update the "Last updated" date above. Material changes will be noted in the app's release notes. If we change what Cloud reading sends or keeps, we will change its notice too, and the app turns Cloud reading off until you agree to the new one.

18. Contact us

Questions about this policy or your data? Email PaperSafeAI Team at [email protected].

Grievances about how we handle your personal data, including under India's Digital Personal Data Protection Act, 2023, go to the same address: [email protected].

PaperSafeAI is operated by PAPERSAFEAI LABS PRIVATE LIMITED.