Privacy Policy
Effective date: September 26, 2026
Paper ("Paper," "we," "us," or "our") provides an AI-assisted workspace designed to help people develop and establish their intent before handing work to AI.
This Privacy Policy explains what information Paper processes, why we process it, and how it is handled.
1. Information you provide
Documents and workspace content
Documents you create in Paper, including document history, checkpoints, Review results, corrections, answers, and related workspace information, are stored in your browser's local storage.
Paper does not routinely synchronize your documents to a Paper-operated server.
Your local documents remain on your device until you delete them, clear the relevant browser storage, or otherwise remove that browser data.
AI Review
When you explicitly use Review, Paper sends relevant document content and contextual information needed to perform the Review through Paper's server infrastructure to the Google Gemini API.
Paper uses Google's paid Gemini API. Google states that prompts and responses submitted through its paid services are not used to improve its products. Google may nevertheless retain and process API content for limited purposes such as abuse monitoring, security, and legal compliance according to its own terms and policies.
You should not enter passwords, API keys, authentication tokens, or other secrets into content that you submit for Review.
Actions that do not require an AI request may be performed locally without sending another request to Gemini.
Access and signup information
Paper is currently available through limited early access.
Depending on how access is provided, we may process information such as:
- your email address;
- an invitation or operator label;
- invitation and session identifiers;
- timestamps relating to signup, access, expiration, and revocation.
Paper stores hashes of access and session tokens rather than the raw tokens in its access database.
2. Information processed automatically
When you interact with Paper, certain technical information may be processed automatically by Paper or its infrastructure providers.
This may include information such as your IP address, request information, timestamps, authentication information, rate-limit information, and operational or security events.
Paper does not currently include an advertising system, tracking pixels, session-replay software, or a dedicated third-party analytics SDK.
3. How we use information
We process information as reasonably necessary to:
- provide and operate Paper;
- authenticate early-access users;
- perform AI Review when requested;
- maintain the security and reliability of the service;
- prevent abuse and enforce rate limits;
- diagnose technical failures;
- administer early-access and future Beta participation; and
- comply with applicable legal obligations.
We do not sell your personal information.
4. AI processing and Google Gemini
Paper uses the Google Gemini API to provide Review functionality.
When you choose to use Review, relevant content is transmitted to Google for processing. Paper does not send a request to Gemini merely because you are typing in the editor.
Google's processing of API requests is also governed by Google's applicable terms and privacy/data-processing practices.
At the time this policy was prepared, Google's documentation for its paid Gemini API states that submitted prompts and generated responses are not used to improve Google's products. Google's documentation separately describes limited retention associated with abuse monitoring and other operational purposes.
Because provider practices can change, Google's current documentation should be consulted for the most current details.
5. Service providers
Paper relies on third-party service providers to operate parts of the service.
These currently include:
Cloudflare — hosting, serverless infrastructure, database infrastructure, security functionality, and related network services.
Google — Gemini API processing and web fonts.
These providers may process technical or other information according to their own terms, privacy policies, and data-processing practices.
6. Data retention
Different information is retained for different periods depending on its purpose.
Documents stored in your browser remain there until they are deleted through Paper, removed by clearing browser data, or otherwise removed from the device.
Authentication and early-access records may remain in Paper's database after an invitation or session expires or is revoked. Expiration and revocation prevent continued use where applicable but do not necessarily cause immediate physical deletion of the underlying record.
Paper may retain limited information where reasonably necessary for security, abuse prevention, troubleshooting, operation of the early-access program, or legal obligations.
Information processed by third-party infrastructure or AI providers may be retained according to those providers' applicable policies and systems.
7. Deleting your information
You can delete documents stored in Paper through the application's document controls. You can also remove locally stored Paper information by clearing the relevant browser/site data.
Deleting a local document removes it from Paper's locally saved document collection on that browser. It does not automatically delete independent copies you previously exported or copied, nor does it issue deletion requests for information previously processed by third-party providers.
If you want to ask about personal information held by Paper's server-side systems, contact us using the information below.
Because Paper's current Alpha access system does not operate as a conventional user-account system, we may need information sufficient to identify the relevant access records before acting on a request.
8. Security
We use reasonable technical measures intended to protect Paper and information processed through it.
These include authenticated access to protected functionality, expiring invitations and sessions, hashed access/session credentials, request-size limits, rate limiting, and restricted handling of application diagnostics.
No internet service or storage system can guarantee absolute security.
9. Children
Paper is not intended for children under 13.
If we learn that we have collected personal information from a child in circumstances where consent or other authorization is legally required, we will take appropriate steps to address it.
10. International processing
Paper's service providers may process information in countries other than the country where you live.
As a result, information processed through Paper may be subject to the laws of jurisdictions outside your province, state, or country.
11. Changes to this policy
Paper is an early-stage service and its functionality may change.
We may update this Privacy Policy as Paper's features, data practices, service providers, or legal obligations change.
When we make material changes, we will update the effective date displayed at the top of this policy and provide additional notice where appropriate.
12. Contact
Questions, concerns, or requests relating to privacy can be sent to:
Paper
Operated by: Vishnuvarman Kalyanasundaram, operating as Paper
Email: varmanvishnu96@gmail.com
Location: Ontario, Canada