We can't read your data. Because it never leaves your device.

PaperMind is a desktop application that runs every model and every file operation on your own machine. We do not collect personal data, telemetry, document contents, prompts, or model outputs. There is no account, no login, and no server-side processing of any kind.

Documents you open are processed in memory by local models bundled with the app. Extracted text, embeddings, summaries, and translations are written only to files inside the workspace folder you choose. Nothing is uploaded.

Vaults you create are encrypted with AES-256 keys derived from your passphrase. The ciphertext is stored as files in your workspace. We have no ability — technical or legal — to recover your data if you lose that passphrase.

Recipient shares generated through the Legacy Vault are Shamir secret-shared fragments. They are produced locally and are only delivered to the recipients you explicitly choose, through channels you control.

The following list is exhaustive — PaperMind does not collect any of it:

• closeDocument contents, file names, or file metadata
• closePrompts, queries, or model outputs
• closeIP addresses, device identifiers, or geolocation
• closeUsage analytics, crash reports, or performance metrics
• closeEmail addresses, names, or any other personal information
• closeWallet addresses, transaction history, or on-chain activity

By default, PaperMind makes no outbound network requests after installation. The application is fully functional offline.

Three optional, user-initiated actions involve a network — each one is explicitly triggered by you and clearly labeled in the UI:

• cloud_downloadModel downloads — the first time you choose to download a model (LLM, OCR, Bergamot NMT, TTS), PaperMind fetches the model weights from their original public hosts (e.g. Hugging Face, GitHub Releases). After that, models live on your disk.
• system_updateApp updates — if you click “Check for updates,” the app contacts GitHub Releases to fetch the latest installer.
• linkSolana devnet anchoring — vaults can be optionally anchored to the Solana devnet for tamper-evidence. Only a content hash and a public key are submitted; no document content, no personal data.

The marketing site you are reading right now is static HTML and CSS served from a CDN. It does not use cookies, fingerprinting, or third-party analytics. Fonts are loaded directly from Google Fonts; if you would rather they weren't, the open-source repository includes them as self-host bundles you can compile yourself.

Your IP address is briefly visible to the CDN that delivers this page — that is unavoidable for any web request. No PaperMind-side logs are kept.

Every claim on this page is verifiable. The full source code is released under Apache 2.0 on GitHub. You can inspect every network call, every disk write, and every cryptographic operation. You can also build and run the application from source if you prefer not to trust our binaries.

If you find any behavior that contradicts this policy, please report it as a security issue on the public repository.

Because we hold no data about you, there is nothing to request, export, correct, or delete. You are in sole possession of your documents, vaults, and recovery keys. Uninstalling the application and deleting your workspace folder permanently removes all PaperMind-related data from your device.

If this policy ever changes, the updated date at the top of the page will reflect that, and the previous version will remain in git history forever. For questions or security disclosures, open an issue on the public repository.