Paperheld privacy policy
Draft: the words in [brackets] are still to be filled in.
Last updated: 3 October 2026
The short version
- Your writing is yours. You can read, export and delete any entry, or your whole account, at any time.
- I store your writing so your reflections can build on earlier Moments. It is encrypted with a key that belongs to your account alone. When you delete your account, that key is destroyed, and within 7 days no copy of your writing can be read, including backups.
- An AI model reads your writing to write your reflection. Your writing goes only to providers that keep nothing and train on nothing. It is never used to train models, never sold and never used for advertising.
- Paperheld has no ads and no third-party analytics.
- This is private by design, but it is not "zero knowledge". The service must be able to read your writing to reflect on it, so it is protected by encryption, strict access limits, and no logging of content.
Who is responsible for your data
Paperheld is run by Christopher Atkinson, a sole trader trading as Paperheld, of c/o Sable International, 5th Floor, 18 St Swithin's Lane, London EC4N 8AD. He is the data controller.
- Email: hello@paperheld.app
- ICO registration number: [number, after the data protection fee is paid]
What is collected, and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Your Google account ID (not your name or email) | To sign you in and keep your history together | Contract | Until you delete your account |
| Your writing, follow-up answers and reflections | To show your history and write reflections that can draw on earlier Moments | Contract, and your explicit consent for anything sensitive you choose to write | Until you delete them or your account |
| Photos of your pages | To read your handwriting | Contract | Not kept: each photo is read, then deleted |
| Moment numbers, dates, whether a reflection finished, "Was this close?" answers and reports | To show your history, count your monthly reflections and improve reflections | Contract; legitimate interest in improving the service | Until you delete the entry or your account |
| Your pass status from Google Play | To know whether you have a pass | Contract | Until you delete your account |
| Your settings | To respect your choices | Contract | Until you delete your account |
| Technical logs: random request IDs, error codes, timings, model names and costs | To keep the service running and affordable | Legitimate interest | 30 days |
| Security audit records: a scrambled form of your account ID, and the time, each time the key that protects your writing is used | To detect misuse of that key | Legitimate interest | [13 months] |
Your writing, reflections, notes, photos, sign-in tokens and purchase tokens never go into logs or analytics.
Sensitive information. What you write may reveal things about your health, beliefs or relationships. You choose what to write. When you first sign in, you are asked for explicit consent to the processing of anything sensitive in your writing. You can withdraw that consent at any time by deleting your entries or your account.
Your notes: what Paperheld remembers about you
After each Moment, Paperheld writes a short summary and updates a few notes about themes that keep coming up.
- Your notes are kept on your phone. They are sent along with each Moment so your reflection can use them, and no copy is kept on the server.
- If you uninstall the app or change phone, your notes are gone.
- You can read them under "What I remember about you", correct them, delete any part of them, or turn them off.
- With notes off, each reflection uses only that day's writing.
Who processes your data for Paperheld
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Storing your encrypted writing and running the service | Ireland (eu-west-1) |
| OpenRouter, and the AI model providers it routes to | Reading your pages and writing reflections, with zero data retention on every request | OpenRouter is in the United States. Today the models run on Google Cloud (Gemini), Amazon Bedrock (Claude) and Microsoft Azure (a backup reader for pages). Their regions can include the United States and the EU |
| Sign-in, and Google Play for subscriptions | Google's own terms apply | |
| Cloudflare | Serving paperheld.app, and forwarding email sent to hello@paperheld.app | Global |
Some providers may process data outside the UK, including in the United States. When they do, the transfer is protected by the UK's adequacy regulations, such as the UK–US data bridge, or by the UK International Data Transfer Addendum.
Payments and the printed deck
Google Play handles subscriptions, and Paperheld receives only the status of your pass. The printed deck, when it goes on sale, will be sold through a separate shop under its own privacy notice. A card's QR code only opens a Moment in the app, and the shop and the app share no data about you.
Your rights
You can access, export, correct and delete your data in the app at any time. Under UK data protection law you also have the right to:
- object to processing;
- restrict processing;
- move your data to another service;
- withdraw consent.
To use any of these, email hello@paperheld.app. You can also complain to the Information Commissioner's Office at ico.org.uk.
Deleting your account
- In the app: go to Settings, then Delete my account.
- By email: email hello@paperheld.app from the address of the Google account you use with Paperheld, with the subject "Delete my account". paperheld.app/delete-account explains the steps.
Deleting your account does not cancel a subscription. Cancel the subscription in Google Play.
Age
Paperheld is for adults. You confirm you are 18 or over when you first sign in.
If something you write worries you
Paperheld is not a crisis service, and nobody reads your writing. If your writing sounds heavy, your reflection will point you to people you can talk to. In the UK, Samaritans are there any time on 116 123. Elsewhere, findahelpline.com lists free, confidential services.
Changes
If this policy changes, you'll be told in the app before the change takes effect.