Privacy Policy

Effective 24 September 2026

Papers is a Mac app that scans paper documents and files them on your own computer. It is made by Andrei Rozhkov, an individual developer, who is the data controller for the limited processing described here.

Your documents

Everything you scan is processed on your Mac and written to a folder you choose. The app has no back end and no storage of its own.

Recognition happens locally

The text on each page is recognized by macOS on your own computer. The page is then read by the Apple Intelligence model on your Mac, from its image and that text.

When your Mac cannot read a page

The model on your Mac cannot always read a page. While it is still downloading it cannot read any, and now and then it gives up on a page or stops answering. Such a page is read by Apple Intelligence on Apple Private Cloud Compute instead, and it is sent the way your Mac would have read it: its image together with its recognized text. This is the only time an image of your documents leaves your Mac. Apple does not store the request or use it to train models, and we never see it.

Grouping happens on Apple Private Cloud Compute

Deciding which pages belong to which document requires a model too large to run on a laptop. For that step, the recognized text of a session is sent to Apple Intelligence running on Apple Private Cloud Compute.

• For grouping, only text is sent — never the images the text was read from.
• Apple does not store the request, and does not use it to train models.
• The request goes to Apple, not to the developer. We never see it.

Apple describes this processing in its own Apple Intelligence privacy notice. If Apple Intelligence is turned off on your Mac, this step does not run, and the app tells you so.

What is deleted

Scans and the page images prepared for analysis are deleted when the session that made them ends. What remains is the finished PDFs, in your folder, on your disk. Deleting the app does not delete those — they are your files.

Your subscription

Recognition is a paid subscription. Payment is handled entirely by Apple through the App Store; the developer never sees your payment method, billing address, or Apple Account.

Subscription status is managed with RevenueCat, a service that keeps track of whether a purchase is currently active. When you buy, restore, or renew, the following reaches RevenueCat:

• A randomly generated identifier for your installation, not linked to your name or email
• Purchase and renewal history for this app, as reported by Apple
• The device model, operating system version, and country of the store account

This is used to answer one question — whether your subscription is active — and to show basic sales figures to the developer. It is not used for advertising, is not sold, and is not combined with data from other apps or websites to track you. RevenueCat acts as a processor on the developer's behalf; see the RevenueCat privacy policy.

How the app is used

To know which parts of the app are worth improving, Papers counts what happens to a stack of paper. The count goes to TelemetryDeck, the same service the pages of this website use, and you can turn it off at any time in Settings; nothing further is sent from that moment on.

What is counted:

• That the app was opened, and how long it was in use — sent by the analytics library itself rather than by Papers
• Whether a scanner was found and how many, and whether they all went away again
• When looking for a scanner failed outright, or a second copy of the app was already running
• When a scan failed, which of a fixed list of reasons it was — another app or another computer holding the scanner, no scan sources, not ready in time, nothing scanned, a PDF that could not be made
• How many pages were added, and whether they came from a scanner or from files; how many files could not be imported
• Whether this Mac can organize a session at all — Apple Intelligence turned off or still setting itself up, the Mac not eligible, the monthly limit reached or nearly reached — along with the state Apple Intelligence reports for its models on your Mac and on Apple Private Cloud Compute, and whether the limit options were opened
• How many pages the model on your Mac could not read, whether they were then read on Apple Private Cloud Compute or not at all, and which of a fixed list of reasons it was
• That a session was organized, how many pages and documents were involved, how many duplicate sheets were found, and how long it took
• When organizing failed or was called off, which of a fixed list of reasons it was
• That documents were saved, how many, whether it was the whole grouping or one document, whether folders per category were used — and, when a save failed or the confirmation would not let it through, whether the folder refused the write, the disk was full, the destination had gone, or the grouping had changed underneath it
• When a saved session could not be reopened after a restart, or could not be written to disk in the first place
• How much the proposed grouping had to be corrected first: pages moved, rotated, reordered or deleted, documents renamed, recategorised, created or deleted — counted as totals, and sent when the session is saved, thrown away, or the app is closed on it
• That the subscription screen was shown or closed, whether a purchase was started, completed, cancelled or restored, and when a subscription became active or lapsed on its own

What is never counted:

• Anything recognized on a page, in whole or in part
• Document names, file names, folder names, or any path on your Mac
• Which categories your documents were filed into
• Your name, email address, Apple Account, or any advertising identifier

Each count carries a random identifier for your installation, which the app hashes before anything leaves your Mac: TelemetryDeck receives the hash and never the identifier itself. It exists so that ten runs by one person are not read as ten people. It says nothing about you, is shared with no other app, and is gone when you delete Papers. Alongside it travel the same technical details an App Store page already reports to the developer: the app version, the version of macOS, the model of Mac, and the language and region it is set to.

What the app does not do

• No account, no sign-in, no email address collected
• No usage data that identifies you, and nothing about your documents in the count described above — which one switch in Settings turns off
• No advertising, no advertising identifiers, no cross-app tracking
• No crash reporting service — crash reports reach the developer only if you choose to share them with Apple
• No selling or sharing of personal information, under any definition

This website

papers.rip is a set of static pages hosted on Cloudflare Pages. It sets no cookies and stores nothing in your browser, so there is no banner asking you to agree to any. Cloudflare processes standard server logs, including IP addresses, to deliver the site and protect it from abuse.

The pages do count visits, using TelemetryDeck, an analytics service run by TelemetryDeck GmbH in Augsburg, Germany, on servers in Germany. Loading a page sends the address of that page, the page you arrived from, and the language your browser asks for. Your IP address and browser are used to work out a one-way hash, together with today's date, so that two visits on the same day can be told apart — and then discarded; the IP address itself is not written to a log or a database, and tomorrow's hash for the same visitor is a different one. There is no profile and no advertising. Visits to this site and counts from the app are reported under one account with TelemetryDeck, so they appear in the same dashboard; nothing links a visit here to a copy of the app on your Mac, and neither side carries anything that could. See the TelemetryDeck privacy policy.

On the pages that lead to the App Store, a press of Send to your Mac is counted the same way. The only things sent are the address of the page and what became of the link: shared, copied or not sent after all.

Legal basis and retention

For visitors in the European Economic Area and the United Kingdom, processing your subscription data rests on performance of a contract — it is what makes the subscription you bought work. Subscription records are kept while your subscription is active and for as long afterwards as tax and accounting rules require. Counting visits to this website, and how far a stack gets inside the app, both rest on legitimate interest — knowing whether anyone is finding the site, and which parts of the app are worth improving — which is a light thing to weigh against, since nothing identifying is kept either way and the app's count is turned off in Settings by anyone who would rather it were not sent at all. Your documents are not retained at all, because they are never collected.

Your rights

Depending on where you live, you have the right to access, correct, export, or delete the personal data held about you, to object to or restrict its processing, and to complain to your local data protection authority. Residents of California have equivalent rights, including the right to know and to delete; note that no personal information is sold or shared for cross-context behavioural advertising.

In practice there is very little to exercise these rights against: the only record tied to you is a subscription identifier. Write to the address below and it will be found and deleted.

Children

Papers is not directed at children and collects nothing that would identify one.

Changes

If this policy changes in a way that affects what happens to your data, the date at the top changes with it, and the previous text is replaced here. Material changes will also be noted in the app's release notes.

Contact

Questions about this policy, or a request about your data: hello@papers.rip.