PaperPilot AI Privacy Policy

Effective Date: October 18, 2026

This Privacy Policy explains how Sacred Pathway LLC ("Sacred Pathway," "we," "us," or "our") handles information when you use the PaperPilot AI app for iOS ("PaperPilot" or "the app"). Please read it together with Apple's privacy practices for the App Store and Sign in with Apple.

Summary

• Your documents, scans, recognized text, folders, signatures and receipts are stored on your device. Scanning and text recognition run on your device.
• Cloud AI is optional and off by default. When you turn it on and use an AI feature, only the extracted text you choose to analyze is sent to our server, which uses OpenAI to generate the result. Document images and original files are never sent.
• PaperPilot does not ask for your name or email address. Cloud AI uses Sign in with Apple and a pseudonymous account identifier.
• Our server does not store your document text or AI results. It keeps limited technical logs for 14 days.
• We do not use advertising or analytics SDKs, do not track you across other apps or websites, and do not sell your personal information.
• You can delete your Cloud AI account in the app at any time: Settings › Cloud AI Account › Delete Cloud AI Account.

Information stored on your device

Documents, pages, recognized text, folders, signatures, receipts and other content you create or import are stored locally on your device. They stay there until you delete them in the app or delete the app. PaperPilot does not sync your documents to our servers.

App settings, such as onboarding status, appearance, your Cloud AI preference and a cached copy of your subscription status, are stored on your device using Apple platform storage, including an app group shared with the PaperPilot widget. If you sign in for Cloud AI, your session token and Apple user identifier are stored in your device's Keychain.

Camera, photos and files

Camera access is used only when you start a scan. Photo library or file access is used only when you choose to import content. PaperPilot does not access your camera, photos or files in the background.

Cloud AI (optional)

Cloud AI is off unless you turn it on in Settings, and it requires Sign in with Apple. When Cloud AI is off, or when you are signed out, offline or temporarily rate-limited, supported features run on your device and no document text is sent.

When you use a Cloud AI feature (such as a summary, key terms, flashcards, a study guide or document Q&A), the app sends the following to the PaperPilot server operated by Sacred Pathway LLC, over an encrypted HTTPS connection:

• the extracted text you chose to analyze;
• the type of task requested and basic options, such as language; and
• your short-lived session token.

Document images and original files are never sent. Our server forwards the text and task instructions to OpenAI, receives the result and returns it to the app. Our server processes the text and the result in memory only. It does not write them to disk or to a database, and it does not log them.

Cloud AI is subject to fair-use limits, including per-minute and daily usage caps.

OpenAI

We use OpenAI to generate Cloud AI results. OpenAI receives the text you submit and our task instructions. We do not send OpenAI your name, email address, Apple identifier or PaperPilot account identifier.

Under OpenAI's API data policies, as of the Effective Date:

• OpenAI does not use data sent through its API to train its models unless the customer opts in. We have not opted in.
• We ask OpenAI not to store responses (the API's "store" setting is turned off), so results are not kept for later retrieval.
• OpenAI keeps abuse-monitoring logs, which can include the submitted text and the results, for up to 30 days. It may keep them longer where required by law or where reasonably necessary to protect its services or others from harm.
• OpenAI may hold encrypted, temporary cache data for up to 24 hours to process requests efficiently.

We do not control OpenAI's retention and cannot delete data held by OpenAI on your behalf. OpenAI's own practices are described in its privacy policy and API data usage documentation.

Sign in with Apple and your account identifier

PaperPilot does not request your name or email address from Apple. When you sign in, Apple provides an identity token. Our server verifies it with Apple and derives a pseudonymous account identifier from Apple's user identifier using a one-way hash. Earlier versions of the app may have requested an email address; if Apple includes one in the identity token, our server does not store or log it.

Our server then issues a session token that is valid for about one hour. The app stores this session token and your Apple user identifier in your device's Keychain. Our server does not keep a database of accounts. Your pseudonymous identifier appears only in session tokens, in the temporary in-memory counters described below, and in our service logs.

Service logs

To operate, secure and troubleshoot Cloud AI, our server writes a limited technical log entry for each request. Each entry may contain:

• your pseudonymous account identifier;
• a request ID and timestamp;
• the type of task requested (for example, "summary" or "flashcards");
• the result status and any error code;
• the response time and the number of AI tokens used; and
• a shortened one-way hash of your network (IP) address.

These logs never contain document text, AI results, your email address, or your Apple or session tokens.

Our hosting provider, Render, also automatically records a request log for each connection to our server. It includes the client IP address, the requested path, the user agent, the response time and size, and a timestamp. These request logs do not contain your account identifier, document text or AI results.

Both kinds of logs are retained in Render's systems for 14 days and are then deleted automatically. We do not forward these logs to any other logging or analytics service.

Temporary, in-memory data

To enforce fair-use limits and keep the service secure, our server keeps a small amount of data in memory only. It is never written to disk.

• Per-minute request counters, keyed to your pseudonymous identifier and to the hashed network address. These refill continuously within about a minute.
• Daily and monthly AI usage totals, keyed to your pseudonymous identifier. These reset at the start of each day and month.
• A short-term retry cache. Where a request is marked as a retry, the server can keep a copy of the AI result for up to 60 seconds so the same result is returned without a second AI request.
• A deleted-account list containing the pseudonymous identifier and time of each account deletion. It is kept for about 65 minutes so that sessions issued before the deletion are refused.

All of this in-memory data is also erased whenever our server restarts.

Data linked and not linked to you

Consistent with PaperPilot's App Store privacy label:

• Data linked to you: your pseudonymous User ID; product interaction data (which Cloud AI tasks you request and how many AI tokens they use); and diagnostic data (request status, error codes and response times). All are used only for app functionality, including security, fair-use limits and troubleshooting.
• Data not linked to you: the document text you submit for Cloud AI. We do not send it with any account identifier, and we do not store it.
• Data not collected: your name, email address, contacts, location, photos or videos, payment information, browsing or search history, and device advertising identifiers.
• Tracking: none of this data is used to track you across other companies' apps or websites.

Subscriptions

PaperPilot Premium is an optional auto-renewing subscription billed through your Apple Account:

• Monthly: US $4.99 per month. Eligible new subscribers receive a 7-day free trial.
• Annual: US $39.99 per year. No free trial. Family Sharing is available.

Prices vary by country or region and are shown in the app before purchase. Apple processes all payments, and we never receive your payment card details. Your subscription status is provided to the app by Apple on your device and is not sent to our server.

Payment is charged to your Apple Account at confirmation of purchase, or when the free trial ends. Subscriptions renew automatically unless canceled at least 24 hours before the end of the current period. You can manage or cancel your subscription in your Apple Account settings, and Restore Purchases is available on the subscription screen.

Premium unlocks unlimited scanning (the free plan includes 5 scans per day), document Q&A, flashcards and study guides.

How we use information

We use the information described above only to:

• provide the features you request;
• authenticate Cloud AI sessions;
• enforce fair-use limits;
• prevent abuse and keep our services secure;
• diagnose and fix errors; and
• comply with legal obligations.

We do not use your information for advertising, profiling or cross-app tracking.

How information is shared

We share information only as needed to provide PaperPilot:

• Apple: for Sign in with Apple and subscription purchases.
• OpenAI: the text you submit to a Cloud AI feature, through our server, to generate results.
• Render: hosts our server in the United States and stores the service logs described above.
• Legal and safety: if required by law, or to protect the rights, safety or security of our users, our services or others.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Deleting your Cloud AI account

If you have used Cloud AI, you can delete your Cloud AI account at any time in the app: Settings › Cloud AI Account › Delete Cloud AI Account. You confirm with Sign in with Apple, and an internet connection is required. When you delete your account:

• Immediately on our server: we revoke PaperPilot's Sign in with Apple access with Apple. We erase the usage totals, request counters and any cached results held in memory for your account. We refuse every session token issued before the deletion.
• Immediately in the app: your session token and Apple user identifier are removed from your device's Keychain, and Cloud AI is turned off.
• Within 14 days: service logs that contain your pseudonymous identifier expire and are deleted automatically by Render. They cannot be used to identify you by name or email.
• Within OpenAI's retention period (up to 30 days, or longer where OpenAI is legally required): any abuse-monitoring copies of text you previously submitted expire under OpenAI's policies. These copies are not linked to your account, and we cannot delete them.

Deleting your Cloud AI account does not cancel a subscription purchased through Apple; cancel it in your Apple Account settings. It also does not delete documents on your device. You can delete documents in the app, or delete the app to remove all locally stored data.

You can also email us at support@sacredpathwayllc.com with privacy questions or deletion requests.

Data retention at a glance

Security

The app communicates with our server only over encrypted HTTPS connections. Session tokens are signed, short-lived and stored in your device's Keychain. Our OpenAI key is kept only on our server and is never included in the app. Our logging is restricted to the fields listed above. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your privacy rights

Depending on where you live, you may have the right to:

• ask whether we process your personal information and to access it;
• correct it;
• delete it;
• receive a portable copy of it;
• object to or restrict certain processing;
• withdraw consent; and
• not be discriminated against for exercising these rights.

If you are in the European Economic Area, the United Kingdom or Switzerland, we process Cloud AI data:

• to provide the service you request (performance of a contract);
• for our legitimate interests in securing and maintaining the service, preventing abuse and fixing errors; and
• to comply with legal obligations.

You may also lodge a complaint with your local data protection authority.

To exercise your rights, use the in-app account deletion described above or email support@sacredpathwayllc.com. We keep information only under a pseudonymous identifier, so we may ask you to verify your request by signing in with Apple from the app. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California law.

Children

PaperPilot is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will take appropriate action.

International processing

Our server and its logs are hosted by Render in the United States. OpenAI may process Cloud AI requests in the United States and other countries where it or its service providers operate. If you use Cloud AI from another country, the text you submit and the related technical information are transferred to and processed in those locations.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page and revise the Effective Date above. If a change materially affects how we handle information already collected, we will provide additional notice where required.

Contact us

Sacred Pathway LLC
Email: support@sacredpathwayllc.com