What we store, and what we don't

On this device

Files you scan or import, and the text read from them, are stored on your iPhone and protected by iOS Data Protection. If your iPhone has a passcode, they are encrypted on the phone with keys tied to that passcode, and readable again once you unlock your phone.

The app does not add encryption of its own on top of that: it has no separate key of its own for the files and database on your phone.

The app lock (Face ID or your device passcode) controls who can open the app. It does not add encryption.

Scanning, reading the text, search, editing and deleting work without an internet connection. Syncing, Email to archive, share links and suggestions need one.

When Listen reads a document aloud, the voice is made on your iPhone and no audio is saved or uploaded. While it plays, the document’s title and chapter show on your lock screen, in Control Centre and on a connected car or headphone display, as with any audio app. Bill reminders, by contrast, do not name the bill.

When you sign in

If you sign in, your documents sync to your account so your other devices show them: titles, tags, the details you add (see below), page edits, deletions, and where you are in Listen, with your speed and bookmarks.

Signing in with Google stores the email address of your Google account, the ID Google gives us for you, and a record of each device you sign in on: the device name iOS reports, a key made on that device, and when it was added. Sign in with Apple, when it comes, stores the email address Apple gives us (this can be a private relay address that hides your real one) and the ID Apple gives us for you. Your IP address is not stored with your account.

The sync service is hosted by Amazon Web Services in the EU.

For each request from the app, the service logs which kind of request it was, whether it succeeded and how long it took, with no IP address, account or document, for 30 days.

Requests from the app pass through Amazon CloudFront and its firewall, which counts the requests from each IP address over a few minutes and blocks an address that sends too many, or one on Amazon's list of addresses known for abuse. It holds an address only while it counts, for a few minutes, and keeps no record of it. As for the website, CloudFront may handle a request at one of its servers outside the EU; the legal page says where, and the safeguards that apply.

If you sign in, the page images you scan are also uploaded to our storage in the EU, so your other signed-in devices can download them. The text read from those pages is uploaded with them, so those devices can search it and read it aloud.

That cloud copy is encrypted while stored, with encryption keys we manage, and every connection to it is encrypted. Amazon Web Services keeps it across at least three availability zones within one EU region: separate groups of data centres, each with its own power and network.

Document details. If you add details to a document (who issued it, its date, a reference number, an amount, a due date, whether it is paid, its type and category), these are sent to our sync service with the document so your other devices show them. Like titles and tags, they are not written to the service's logs.

Share links. If you share a document with a link, it is encrypted on your device. The key is in the part of the link your browser never sends to us, so the copy we store cannot be opened without the link. The page that opens the link comes from us, so this is not end-to-end encryption. A link lasts at most 30 days and 25 opens, can be protected with a password (ten wrong tries revoke it), and you can revoke it; it is also revoked when you delete the document. The encrypted copy is deleted about a month after the link is made. Once revoked, it cannot be opened again, though a download address it had already handed out can keep working for up to five minutes.

Email to archive. If you turn on Email to archive, you get a private address. Mail sent to it is received by Amazon Web Services in the European Union and checked automatically: that it passes the virus scan, is within the size limit, passes the sending domain's authentication check (DMARC), and comes from an address you allow. Only then do its attachments become documents in your archive. The whole message is deleted as soon as it has been processed, and otherwise removed automatically about a day later. We keep the list of addresses you allow, a count of messages per day, and each message's identifier for about two days, to recognise a repeat delivery. From mail that fails a check, nothing is filed.

When a message is not filed, we keep when it arrived, why, and, if its sender passed the authentication check, the sender's address, for 30 days, so the app can show it to you under Email to archive. If the sender's address is not one you allow, or your storage was full, that sender gets one automatic notice a day saying the message was not filed, unless the message was itself sent automatically. Mail whose sender could not be verified is listed without a sender, so you know it came, and is never answered.

Deletion

Deleted documents can be restored for 30 days on this device. After that they are removed from the device.

If you are signed in, a deleted document's titles, tags, page images and their text are removed from our servers 30 days after you delete it. A device of yours that was offline keeps its copy until it next connects, and our backups of the records keep them for up to 35 more days. A shared link to the document is revoked at once, though a download address it had already handed out can keep working for up to five minutes; its encrypted copy is deleted about a month after the link was made.

You can delete your account in Settings. You are signed out at once, and your account and everything synced with it are deleted from our servers after 30 days; signing in again before then cancels the deletion. Our backups of the records keep them for up to 35 more days. Documents on your iPhone stay on it.

A received email is deleted once processed, and otherwise removed automatically about a day later. Suggestions, and what you did with each, are kept with the document and removed when the document is, 30 days after you delete it, or with your account; our backups keep them for up to 35 more days.

Export

You can export your whole archive at any time in Settings › Export: a PDF of each document, its original pages, the text read from it, and a spreadsheet of every document's details, saved where you choose in the Files app. It is made on your iPhone and nothing is sent to us, so it works with no connection, even if you are over your storage limit or your paid plan has ended. A document whose pages are not on this iPhone yet is listed, and is exported once you have opened it here.

Today, you can send a whole document as a PDF or as pictures (JPEG or PNG), at the quality you choose, or only the pages you pick, using the iPhone share sheet.

AI suggestions

Built and tested; not yet in an App Store release.

AI suggestions (only if you turn them on). Suggestions are off until you turn them on for your account. If you allow them, we send the text recognised on your document's pages, never the page images, to Anthropic's Claude model through Amazon Bedrock, processed in AWS regions inside the European Union. That text can include health information, for example from a medical bill. While suggestions are on, the text is sent each time Papers reads a document's text, including after a page is scanned again, if the document still has details left empty. We use it only to fill in the document's empty details, each marked as suggested until you keep, change or reject it. Our service sends it only for this, and does not write it to its logs. We keep the proposals, and what you did with each, with the document: they are removed 30 days after you delete it, or with your account, and our backups keep them for up to 35 more days. You can turn suggestions off at any time in Settings. That stops further sending, though a document already being processed may still be sent and get its suggestions, and text already sent is not recalled.

Sign-in

You sign in with your Google account. Sign in with Apple comes with the first release.

Problem reports

When you send a report from Settings › Report a problem or share an idea, it carries what you write, the screen you were on, the app and iOS version, your iPhone model and, if you are signed in, your account's ID. You can add a screenshot, which shows whatever was on screen, documents included, and the app's log, which lists what the app did, such as launches, sync progress and the kinds of errors it met; you can read the log before you send. Reports go to our support desk, Zoho Desk, in Zoho's EU data centres. We keep a report until the problem it describes is closed, and delete it 12 months after that.

What we will not do

• We will not sell your data.
• Our sync service does not write your document titles or tags to its logs, and an automatic test checks this. Page images, and the text read from them, reach our service only if you sign in.
• This website sets no third-party trackers, no advertising pixels, and no cookies.

Website data

We keep no log of visits to this site. To protect it from attacks, Amazon CloudFront's firewall counts the requests from each IP address over a few minutes and blocks an address that sends too many, or one on Amazon's list of addresses known for abuse. It holds your address only while it counts, for a few minutes, and keeps no record of it or of what you asked for.

If you join the waitlist, we store your email, country, and any comment you leave, together with which version of this page you saw. We keep this until 31 December 2027, then delete it.

The waitlist is run by Daniel Man, at Kamerunská 4/601, 160 00 Praha, Czech Republic.

You can withdraw at any time using the unsubscribe link in any email we send you, or by writing to hello@pocketaurora.com.

Read the full waitlist and website notice on our legal page.