PAPERLEAF

Privacy policy

Effective date: 8 September 2026.
Developer: Cherish Studio, operated by Aymane Cheracher in Morocco.
Contact: paperleaf.support@gmail.com

YOUR DOCUMENTS Paperleaf keeps documents, page images, recognized text, corrections, visual signatures, folders, tags and settings in private storage on your device. Scanning, image editing and OCR run on-device. We do not upload document images or recognized text to our servers. Sharing and saving send files only to destinations you choose; those services have their own privacy policies.

SIGN-IN AND ACCESS Outside complimentary closed testing, Google sign-in activates the five-export allowance and restores website purchases. Google provides a signed identity token that may contain your account identifier, name and email. We verify it and derive a pseudonymous account identifier; the access database does not store your Google name, email or raw identity token. It stores the account identifier, hashes identifying exported document revisions, timestamps, checkout/order identifiers and purchase/refund status. These records support the allowance, activation, restoration and fraud prevention. Clearing app data does not reset the server allowance. Documents cannot be reconstructed from revision hashes. Closed-test installations can receive temporary complimentary access without Google sign-in.

INSTALLATION SECURITY The app generates an installation key in Android Keystore. Our service verifies signed requests and Google Play Integrity verdicts, including app package/version, signing certificate, Play licensing and device integrity. Short-lived challenges prevent replay. We use a rotating pseudonymous IP-based counter to limit abusive requests. Cloudflare hosts our website and access service and processes network/request information, including IP addresses, to deliver and protect them. Access-service application logging is disabled; Cloudflare may retain operational information under its own policies.

GOOGLE COMPONENTS Google Play services delivers the scanner, which needs an initial download. Bundled ML Kit text recognition runs on-device. Google's SDKs can collect device/app information, installation identifiers, feature usage, performance information and error codes for diagnostics and usage analytics. Play Integrity processes security information to verify the installation and device. These components use encrypted network connections. Paperleaf includes no advertising SDK or separate custom analytics service. On-device document processing does not mean that Google services never use the network.

PURCHASES Lifetime access is sold separately through our website using Polar as merchant of record. Polar and its payment providers process checkout information, billing/contact details and payment information under their policies. Paperleaf does not receive full payment-card details. Our backend receives order identifiers, account associations and payment/refund status to activate or revoke access. Activated lifetime access is cached as a signed installation-bound license for offline use. Reinstallation requires online restoration. Complimentary test access expires and requires periodic online renewal. Real sales may be unavailable during testing.

LOCAL STORAGE AND BACKUPS Library backups contain documents, images, recognized text, organization information, completed exports and saved visual signatures. They exclude access credentials, allowance records, app-lock state and passwords. Backups are unencrypted. Store them securely. Deleting a document from the library does not delete copies you exported or backed up elsewhere. Uninstalling removes private local storage but not external copies or server records. Recently deleted documents remain recoverable for the recovery period shown in the app.

PASSWORDS AND APP LOCK PDF passwords are used for the requested operation and are not intentionally stored. App lock uses Android's biometric or device-credential system. We do not receive biometric templates or your device PIN. Visual signatures are images, not biometric authentication or cryptographic digital signatures.

RETENTION AND DELETION We retain access and export-allowance records while the account is used, and purchase records while needed to restore access or handle refunds, disputes and legal obligations. Expired request challenges, nonces and rate-limit records are cleared during service activity. You can request deletion of your Paperleaf account and associated server data from Settings > Request account deletion, or through https://cherish-studio-apps.pages.dev/paperleaf/delete-account/. Send the request from the Google email used for Paperleaf. We may ask you to verify ownership and aim to complete verified requests within 30 days. We remove or anonymize access records unless a specific retention obligation applies, which we will explain. Deletion ends account-based access and is not itself a purchase refund. Contact support separately about refunds. Polar may retain transaction information under its own legal obligations. Local documents and external backups must be deleted separately using the app or destination controls.

SUPPORT We process information you send to support to answer your request. Do not send passwords, card details or sensitive documents. Routine support correspondence is deleted within 12 months after resolution, except for ongoing disputes or legal obligations. Service providers may process information outside your country. Depending on applicable law, you may have rights to access, correct or delete information; contact paperleaf.support@gmail.com.

PROVIDER INFORMATION Google: https://policies.google.com/privacy ML Kit disclosures: https://developers.google.com/ml-kit/android-data-disclosure Cloudflare: https://www.cloudflare.com/privacypolicy/ Polar: https://polar.sh/legal/privacy

Changes will be published at this policy's permanent address: https://cherish-studio-apps.pages.dev/paperleaf/privacy/.