TidyPaper and your privacy

Last updated 5 November 2026 · for TidyPaper on iPhone, iPad, Mac and Windows

What stays on your device

• Your documents and everything you do to them: highlights, notes, signatures, filled-in forms, edits.
• What TidyPaper remembers about each document so it can help you next time: the page you were on, your bookmarks, your own notes, your earlier questions to the AI assistant, and the translations you made of it. Changes you haven't saved yet are kept for up to 30 days, so TidyPaper can offer to put them back the next time you open that document. Nothing at all is kept for documents that need a password.
• Your signature and initials, and "My details" (your name, address and so on, used to fill in forms). These are never sent to the AI assistant.
• Your invitation code or AI key, kept in your device's secure storage (Keychain on iPhone, iPad and Mac; Windows Credential Manager on a PC).
• Reading the words in a scanned page happens on your device (Apple's own text recognition on iPhone, iPad and Mac; the free Tesseract add-on on Windows).

You can remove all of it by deleting the app (on a computer, also the .toolkit folder in your home folder).

When you ask the AI assistant

The AI assistant is off until you turn it on or use an invitation. When you ask a question about a document:

• TidyPaper sends your question, and the text of the pages that matter to it, to the AI service. Scanned pages may be sent as pictures. The first time, it shows you exactly what will be sent, and you can ask to see it before every question.
• Pull out data (a bank statement, invoice or payslip into a table) sends every page of the document, a few pages at a time, because every row is needed. TidyPaper says how many pages it will send before it starts. Tables in a document that isn't a scan can be pulled out on a computer without the AI - nothing is sent then.
• Translate sends the pages you ask for (one page, or every page) to the AI service, a page at a time, and shows the translation beside the document. TidyPaper says how many pages it will send before a long document. On an iPhone or iPad, when Apple's own translation has both languages, the translation is done on the device instead and nothing is sent.
• With an invitation (Shared AI): this goes through a small relay run by the person who invited you, on Google Cloud in London. The relay passes it to the AI service (Anthropic for Claude, or OpenRouter for other models) and sends the answer back. It does not store your questions, documents or answers.
• The relay does keep, for the person who runs it: your name as they entered it when they invited you, how much of your monthly allowance you've used (cost and amount of text), daily totals, and a 30-day list of events such as refused requests. Your invitation code is stored only in a scrambled form (a hash) that can't be turned back into the code.
• The AI services handle what they receive under their own terms: Anthropic and OpenRouter (which passes it to the company behind the model you chose).
• With your own key (on a computer): your question goes straight to the service you chose, under its terms. The relay isn't involved.

Opening a web link

• TidyPaper fetches a web address only when you paste one into "Open a link", or (on iPhone and iPad) share a webpage to TidyPaper from Safari, Chrome or another browser. A PDF is saved on your device. Sharing hands TidyPaper only that page's address (or, from Safari, the PDF you're looking at) - nothing else from the browser.
• A webpage you turn into a PDF is loaded in a closed-off browser that keeps nothing (no cookies) and can't see your documents. If an address is on your own home or office network, TidyPaper asks you first.

Updates

• iPhone and iPad: updates come from the App Store or TestFlight.
• Mac and Windows: once a day the app asks the relay whether there's a new version, sending only the app's name and version number. A new version is downloaded straight from the app's download store and checked before it's installed. Downloads of the app are counted (how many, and which version), not who downloaded it.

Google's own records

Like any web service, the relay runs on Google Cloud, which keeps standard records of requests (such as the time, the internet address they came from, and the app version) for about 30 days, to keep the service working and secure. These don't include your questions or documents.

Your choices

• Turn the AI assistant off at any time (Settings), or remove your invitation. Start a new conversation to forget a document's earlier questions.
• Ask the person who invited you to remove you from the relay: your name and usage are deleted with you.
• For any question about your data, or to ask us to delete it, write to hello@tidypaper.io.

Children

Anyone can be invited to the Shared AI, whatever their age: the relay keeps the same small record for everyone (their name as entered by the person who invited them, and how much of their allowance they've used). The person who runs the relay decides who is invited, and can remove anyone at any time.

Changes

If this changes, we'll update this page and the date at the top. Changes that matter will also be mentioned in the app's update notes.