Privacy Policy

Last updated: September 18, 2026

How It Works

PaperFit is a client-side web application. Processing for PDFs, images, and supported privacy-scanner file types happens entirely in your browser using JavaScript libraries such as pdf-lib, pdf.js, and related local parsing utilities.

Your files are read into browser memory and processed locally for preview or export. PaperFit has no server endpoint that receives documents — at no point is file content uploaded to us for processing.

Files do not simply vanish when you close the tab: opening a file in a tool writes a short-lived copy into your browser's own storage on this device so you can resume your work. That copy is deleted automatically on a retention timer, and you can delete it sooner. See Local Storage below for exactly what is kept and for how long.

Pro Features — Client-Side Processing

All PaperFit Pro features — including batch processing, OCR of documents you already have, permanent redaction, tool chains, and saved presets — run entirely in your browser. Document contents are not sent to PaperFit servers.

Status: the Pro feature panel is currently switched off in the shipped app, so the features described in this section are not reachable by any user today. The disclosures below describe how they behave, and will apply as soon as they are enabled.

OCR is powered by Tesseract.js. Its recognition engine (WebAssembly) and English language model are hosted on paperfit.app itself, not a third-party CDN, and cached in your browser for subsequent use after the first download. No document content, text, or images are sent to any server during OCR processing — recognition runs entirely on your device. The same self-hosted engine also powers Scan to PDF's "Make text searchable" option, which is free and not part of Pro.

Accounts & Sign-In

You can use PaperFit's local tools with no account at all. An account is only needed for optional cloud features (Google Drive) and, later, Pro. Accounts and authentication are handled by Supabase, our authentication and database provider. When you create an account we store, in Supabase:

• Your email address (your account identifier).
• An optional display name you choose.
• Your plan / subscription status (Free unless you upgrade).
• Your saved tool presets, if you are a Pro subscriber and preset sync is active — these are tool settings (margins, paper size and similar), not document content.
• A cloud save history — see "Cloud save history" below. This is file metadata, including filenames; it is not document content.

Supported sign-in methods are email + password, a one-time email sign-in link (magic link), and Google. Passwords are handled entirely by Supabase — PaperFit never sees them. You can edit your display name or permanently delete your account (and its profile data) at any time from your Account page.

Google Sign-In

If you choose "Continue with Google," Google shares your email address, name, and profile picture with PaperFit. We use these solely to create and display your account identity and to sync your settings across your devices. We never receive your Google password, and we request no Google data beyond basic profile and — only if you connect it — the Drive scope described below.

Google Drive

Google Drive is optional and only activates when you connect it. PaperFit uses the least-privilege drive.file scope, which grants access to only the files you create with PaperFit or explicitly open through the Google Picker — never the rest of your Drive.

• Import: you pick a file in the Google Picker; PaperFit reads just that file's bytes and processes it locally in your browser.
• Save / backup: PaperFit writes files you create into a "PaperFit" folder in your Drive. It can only ever see files it created.

In both cases the file transfers directly between your browser and Google — it never passes through or is stored on PaperFit's servers. The OAuth access token is held in memory for the session only, is never written to disk, and is dropped when you sign out or disconnect. You can revoke PaperFit's Drive access at any time from your Google Account permissions.

Dropbox and OneDrive

Alongside Google Drive, PaperFit supports Dropbox and Microsoft OneDrive for the same two optional jobs — importing a file you pick, and saving a file you produced. Each provider appears in the app only when it has been configured for the deployment you are using, so you may not see all three.

These work the same way as Drive: you choose the file in the provider's own picker, and the bytes travel directly between your browser and that provider. PaperFit operates no intermediary server for these transfers, and the access tokens are held in memory for the session only. Revoke access from the connected apps settings of the provider in question.

What can be imported: cloud import is not limited to PDFs. Depending on the tool you are using, it accepts PDFs, images, Word .docx files, and Markdown or plain-text files. Each of these is validated and then processed locally in your browser in exactly the same way.

Cloud save history

If you are signed in as a Pro subscriber and save a file to a connected cloud account, PaperFit records a pointer row in its Supabase database so the app can show you what you processed and where it now lives. That row contains the filename, the file size, which tool you used, which provider it went to, and the provider's file id and link. It does not contain the document, and PaperFit cannot read the file it points at.

This is the one place where a filename you chose is stored on infrastructure PaperFit controls. Rows are scoped to your account, expire after 30 days, can be deleted individually from the app, and are removed entirely when you delete your account. If you never save to a connected cloud account, no such row is ever created.

Google API Services — Limited Use

PaperFit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google is used only to provide the features you request; it is not sold, not used for advertising, and not used to train generalized AI/ML models, and it is not transferred to others except as necessary to provide those features or as required by law.

What We Don't Collect

• Document contents: the contents of your files are not uploaded to, transmitted to, or stored on a PaperFit server. There is no PaperFit endpoint that accepts a document. If you use cloud import or cloud save, the file moves between your browser and the cloud account you connected, not through PaperFit's servers.
• Beyond your account: if you don't create an account, PaperFit collects no names or personally identifiable information. If you do sign in, we store your email and optional display name to run your account (see Accounts & Sign-In above). If you subscribe to Pro, Stripe stores the email you provide at checkout (see Payments below); if you join the waitlist, your email is sent to WaitlistWiz. We do not build advertising profiles, and we do not sell personal data.
• File names or content, in analytics: analytics and crash reports never receive your document's contents. Neither carries a filename: analytics event fields are a fixed, closed list (route, tool name, and similar), and crash reports replace the original error text with a fixed classification code rather than forwarding it. The one exception anywhere in the product is the cloud save history described above, which stores a filename you chose — that is a feature you trigger, not analytics.

Optional Anonymous Analytics

Analytics is opt-in, and a build can ship without it entirely. When a build has no analytics, no consent banner appears and no analytics code loads or collects anything, whatever you chose before. When a build does have it, nothing loads until you accept. Either way, the list below is the complete set of what analytics can ever receive.

We use Google Analytics 4 (GA4) — only if you opt in — to understand how people use the app, so we can prioritize improvements and fix bugs. If you accept, GA4 sets a single first-party analytics cookie (_ga) to count visits; it is never used for ads or cross-site tracking. Decline, and no analytics loads and no cookie is set.

What we track (if you consent, and analytics is switched on):

• Where visits come from — the page's route (never a document-derived title, and never the query string, so a search you typed cannot travel with it), the referring site's address without its path, and a campaign label from a list we approve in advance
• Which tools are opened, and whether you arrived from the home page, the tools list, or another tool
• Whether a task finished — that one started, that it produced a result, and that the result was exported. Individual clicks are not tracked
• What broke — a fixed category (for example "network" or "storage") plus your browser and device type, never the error's original text
• Whether people come back, as an aggregate count, from the analytics cookie described above

We never collect file names, file content, or any file-derived statistics (page count, file size, scanned-or-not). None of your document ever reaches our analytics.

Your choice: On your first visit, you'll see a consent banner. You can accept or decline analytics. Your choice is saved locally and is not reset unless you explicitly choose to clear your analytics consent in Settings → Privacy.

We also respect the "Do Not Track" browser setting and will not initialize analytics if it's enabled.

Managing Local Data

In Settings → Privacy (and Files & Storage), you can clear local data. Clear data removes temporary files, tool drafts (including scan drafts), and export history while keeping your saved files, preferences, and consent; Delete everything removes all of it, including saved files, scan drafts, and settings.

Local Storage

We store minimal data in your browser's localStorage:

• Theme preference — whether you've chosen light or dark mode
• Analytics consent — your decision to allow or decline analytics
• Session data (temporary) — your current document settings so you can recover your work if the page refreshes

Separately, when you open a file in a tool, PaperFit keeps a short-lived copy of it in your browser's IndexedDB storage, along with its filename, so it appears in My Files → Temporary and you can pick up where you left off without re-uploading — opening the file in a tool is what creates this temporary copy. These copies stay on your device, are deleted automatically after your chosen retention window (24 hours by default, configurable from 30 minutes up to 48 hours), and can be removed immediately from Settings. A file only becomes a permanent saved item when you choose Keep (or Save to My Files). If you turn session persistence off (the in-app prompt's No thanks, or Settings → Privacy), no document content or filenames are kept.

Scan drafts. Scan to PDF keeps an editable draft of your scan in IndexedDB so you can recover it and re-crop or re-enhance pages later. A draft contains the captured or imported source images (the full frame, including areas outside the crop you chose), the photo file names when you upload photos, your crop and enhancement settings, and the rendered pages. Drafts stay on this device only. They are kept for seven days after their last change and are removed the next time the scanner opens after that (not at an exact moment while the app is closed); Start Over in the scanner, Clear data, or Delete everything removes them immediately. A PDF you download or keep in My Files is a separate file and is not affected by draft cleanup. If session persistence is off, no scan drafts are stored.

Your theme preference, analytics consent and temporary document copies stay in your browser, and can be cleared at any time through browser settings or via the controls in Settings.

Two things stored locally can be copied elsewhere, and only if you ask for it: saved tool presets sync to your account so they follow you between devices (Pro), and files you explicitly save to a connected cloud account are uploaded to that account. Both are your own settings and your own storage — neither puts document contents on a PaperFit server.

Service Worker (PWA)

PaperFit includes a service worker that caches static assets (HTML, CSS, JS, fonts) so the app works offline after your first visit. The service worker does not intercept, store, or transmit any user files or data.

Payments

Payments for PaperFit Pro are processed by Stripe. PaperFit does not store credit card numbers or payment details. All payment data is handled directly by Stripe and is subject to Stripe's Privacy Policy.

The email address you provide at checkout is stored by Stripe to identify your customer account and enable cross-device Pro activation. PaperFit does not independently store this email.

WaitlistWiz

Waitlist signups are processed by WaitlistWiz (a third-party service). Email addresses submitted via the waitlist form are sent to waitlist-wiz.vercel.app. PaperFit does not independently store waitlist emails.

Sentry Crash Diagnostics

Crash diagnostics are sent to Sentry to help us identify and fix bugs. An error report carries a fixed classification code (for example network or storage_quota) plus the exception type and stack trace — never the original error message text, and never file content or document text. Breadcrumbs (the trail of clicks, requests and console output leading up to a crash) are dropped entirely and are not sent. The report's URL is reduced to the page's route (e.g. /merge), with no query string. No user-identifiable information beyond browser and device type is included.

Crash reporting respects the "Do Not Track" and "Global Privacy Control" browser settings — it does not initialize if either is enabled.

A signed-in user's email or identity is not attached to error reports — Sentry runs with personally identifying data disabled.

Third-Party Services

PaperFit uses the following third-party services. Each service's own privacy policy applies to data processed by that service:

• Supabase — account authentication and profile storage (email, optional display name, plan status)
• Google — Sign-In identity (email, name, profile picture) and, if you connect it, Google Drive access via the least-privilege drive.file scope
• Google Analytics 4 (GA4) — optional anonymous analytics; off by default in this pilot build. When switched on, it loads only if you opt in (sets a first-party _ga cookie to count visits; no ads, no cross-site tracking)
• Stripe — payment processing for Pro subscriptions
• WaitlistWiz — waitlist management
• Sentry — crash diagnostics (fixed error code + stack only, no message text, no breadcrumbs, route-only URL, no document content; respects Do Not Track)
• Dropbox — optional file import and save, if you connect it
• Microsoft OneDrive — optional file import and save, if you connect it
• Google Fonts — web fonts used by some pages, including this one; Google receives your IP address when a font is fetched
• Vercel — hosting. As with any web host, its servers process the network requests needed to deliver the site

No advertising networks or data brokers are used.

Children's Privacy

PaperFit's tools can be used without an account, and used that way they collect no personal data. Creating an account does involve personal data (your email address, and a display name if you provide one), so accounts are intended for users old enough to enter into these terms in their jurisdiction. We do not knowingly collect personal data from children. If you believe a child has created an account, email us and we will delete it.

Changes to This Policy

If this privacy policy changes, we will update this page with a new "last updated" date. The policy will always be accessible at this URL. We do not currently send notification emails about policy changes, so please check back here.

Account Deletion — what it does and does not remove

Deleting your account from the Account page permanently removes, from PaperFit's infrastructure:

• Your sign-in record and your profile (email, display name, avatar).
• Your plan and subscription status, and your synced tool presets.
• Your cloud save history rows.
• Any stored cloud connection record for your account.

Deletion does not reach three things, which you must handle yourself:

• Data in your browser — saved files, temporary copies, preferences and consent live on your device. Clear them from Settings → Privacy (or your browser's own settings) before or after deleting the account.
• Files already in your cloud account — anything PaperFit saved to your Drive, Dropbox or OneDrive belongs to you and stays there. Delete it from that provider.
• Records held by third parties — in particular, Stripe retains payment and invoice records it is required to keep, and any waitlist email you submitted sits with WaitlistWiz. Revoking PaperFit's access to your cloud provider is likewise done at that provider.

Your Rights & Choices

You can access and update your profile, and permanently delete your account and its profile data at any time from your Account page. You can disconnect Google Drive, Dropbox or OneDrive, or revoke access from your Google Account permissions, decline analytics, and clear locally stored data from Settings → Privacy. To make any other data request, email us.

Because your documents are processed in your browser and are not uploaded to us, most of your content never becomes data we hold. The rights below apply to the limited account data we do process (sign-in identity, profile, plan/subscription status, presets, cloud-save history) and to any diagnostics.

If you are in the EEA or UK (GDPR)

Our lawful bases are: contract (running your account and any Pro subscription), legitimate interests (keeping the app secure and working, via scrubbed crash reporting), and consent (analytics, which you can decline or withdraw at any time). You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data (edit your profile, or ask us).
• Erase your data ("right to be forgotten") — delete your account from the Account page.
• Restrict or object to processing, including profiling.
• Portability — receive your account data in a portable format.
• Withdraw consent at any time (e.g. turn off analytics) without affecting prior processing.
• Lodge a complaint with your local data-protection supervisory authority.

If you are in California (CCPA/CPRA)

In the past 12 months we have not sold or shared your personal information, and we do not use sensitive personal information beyond what is needed to provide the service. You have the right to:

• Know what personal information we collect and how it is used.
• Delete the personal information we hold (delete your account).
• Correct inaccurate personal information.
• Opt out of sale/sharing — not applicable here, as we do neither.
• Non-discrimination for exercising any of these rights.

To exercise any right, use your Account page or email support@paperfit.app. We will not discriminate against you for making a request, and you may use an authorized agent where the law allows.

Contact

PaperFit is operated under the name "PaperFit." Questions about this privacy policy, a data request, or PaperFit's privacy behavior? Email support@paperfit.app.