What PaperDusk keeps to itself.

1. Reflections, letters and insights — to Anthropic, through PaperDusk's relay

Switch: Settings → Reflections and letters. Off, and nothing you write leaves the device: the app uses questions and letters written in advance instead, and everything else about it stays the same.

With it on, a language model run by Anthropic writes for you, and to do that the app sends the following — only the following — to PaperDusk's own relay server, which passes it to Anthropic and returns the reply:

• A reflection: the text of that one entry (up to 8,000 characters), its mood, and the conversation so far.
• The safety check: whenever you open a reflection, that entry's text is sent once to decide whether to offer a helpline. It is a separate request from the reflection itself, and it is made even when no reflection is written — if you have used up the free conversations for the day, the check still runs, because a person who needs a helpline needs it either way. Nothing about it is kept.
• Your weekly letter: that week's entries — the text of each (up to 4,000 characters, 16,000 for the week), with each entry's date and mood. On a day you only chose a mood and wrote nothing, roughly when in the day you marked it goes too — “in the evening”, “after midnight” — because on a week like that it is the only thing there is to write a letter from. Never the clock time. If that day has a voice note that was never written down, the letter is told only that one exists — never the recording, and never a word of it.
• Your year letter: counts for the year — entries, days and months written, how often each mood — and up to six short excerpts (280 characters each) with their dates and moods.
• The weekly insight: counts only — which mood you recorded on each day, the names of themes and how often they came up, and how many entries you made. No writing at all.
• Patterns: counts only — days and entries written in the window, days per mood, which themes tended to lift or weigh, your brightest and hardest weekday, and the time of day you usually write. No writing at all.

Your photos, the audio of your voice notes and your name are never sent. Neither is your Apple ID, your location, or any identifier that names you. When the app has written a voice note down as text — which happens on your device, see below — those words are part of the entry's text and travel with it.

PaperDusk's relay stores none of it. It is a small program on Cloudflare's network that holds the key to Anthropic so the app does not have to, checks that the request comes from a genuine copy of PaperDusk, passes the text on, returns the reply, and forgets it. It has no database and does not log what you wrote — when a request fails it records that it failed, never its content, and that record is kept for a few days and then gone. Cloudflare, which hosts it, sees the internet address the request came from in order to deliver it and to limit how many requests one device may make, and keeps its own operational records under Cloudflare's privacy policy.

Anthropic receives the text to write the reply. Under its commercial terms, Anthropic does not train its models on what is sent through its service. It deletes inputs and outputs from its systems within 30 days, and keeps them longer only if a request is flagged for breaking its usage policies — see how long Anthropic keeps data and Anthropic's privacy policy. Nothing that names you accompanies the text, so there is nothing at Anthropic to look you up by.

2. Cloud Backup — to your own iCloud

Switch: Settings → Privacy & backup → Cloud Backup. Off unless you turn it on; part of PaperDusk Plus.

With it on, PaperDusk uploads a complete copy of your journal — entries, photos, voice notes, their transcripts, and letters — to the private part of your own iCloud account, in a container that only PaperDusk on your devices can open. It is not sent to us and we cannot read it: iCloud's private database belongs to you, and Apple encrypts it in transit and at rest. One backup is kept; each new one replaces the last. Restore in the same screen brings it back onto a phone.

Turning the switch off stops further uploads and leaves the last backup in place. To remove it, delete PaperDusk's data from iCloud in your iPhone's Settings (your name → iCloud → Manage Account Storage). It is held under Apple's privacy policy and your iCloud terms.

3. Buying Plus — Apple, and RevenueCat

Payment is handled entirely by Apple's App Store; PaperDusk never sees your card, your Apple ID, or your billing details. To know whether Plus is active — on this install, after a reinstall, a restore, a refund, or through Family Sharing — the app uses RevenueCat, a subscription service, which receives:

• the App Store receipt and transactions for PaperDusk;
• an anonymous ID that RevenueCat's software makes for this install, and your device's vendor identifier — a number Apple gives PaperDusk for your device that no other developer's app shares;
• your device model and iOS version, the app's version, your language and region, and — as with any internet request — the address it came from;
• a note that PaperDusk has not asked you for permission to track, which is true and never changes.

Never your name, your email, your Apple ID, or a word you write. PaperDusk sets no user ID on RevenueCat, so a purchase is tied to a receipt and an install, not to a person. RevenueCat keeps this for as long as it needs to manage the subscription, under RevenueCat's privacy policy.

4. Usage counts — Google Analytics for Firebase

Switch: Settings → Privacy & backup → Share usage data. On unless you turn it off — except in the European Union, the EEA, the United Kingdom and Switzerland, where it is off unless you turn it on.

PaperDusk counts a fixed list of moments — a screen opened, a feature used, an entry saved and what kind, a choice made in onboarding or in Settings, a reflection opened, the paywall shown, a purchase made — each marked with the plan (free or Plus) and whether reflections are on, so the counts can be read by kind of reader. A mood is counted, never which; a name is "given", never what. That list is written into the app and cannot include any text you write. The counts go to Google, with: an app-instance ID that Firebase makes for this install; your device model, iOS version and the app's version; and the address the request came from, from which Google derives an approximate location such as a country or region. PaperDusk does not use, ask for, or send your location itself.

No advertising identifier is collected — the app is built without that part of Firebase — the vendor identifier is switched off, and no user ID is ever set. There is no advertising in PaperDusk and these counts are not used to advertise to you anywhere. Google processes them on PaperDusk's behalf under Firebase's privacy and security terms and Google's privacy policy.

5. Proving the app is genuine — Apple App Attest

Once, on first launch, the app asks Apple to vouch that it is a real copy of PaperDusk running on a real iPhone. Apple's answer is sent to PaperDusk's relay, which checks it against Apple's certificates and hands back a token that later requests carry. The token identifies this install to the relay — so one device cannot flood it — and holds nothing about you. The relay does not store it. See Apple's privacy policy above.

6. Speech, photos, notifications and the lock — all on your device

• Voice notes are written down with Apple's on-device speech recognition, only with your permission, and only on devices and languages where that works entirely on the phone. The audio is never sent anywhere — if on-device recognition is not available, PaperDusk simply does not transcribe rather than send your voice away.
• Photos are chosen through Apple's photo picker, which shows PaperDusk only the photos you pick; the app has no access to your library. Saving a share card asks permission to add one image to it, nothing more.
• Reminders are scheduled on the device. PaperDusk has no push-notification server.
• App Lock asks iOS to check it is you with Face ID, Touch ID or your passcode. PaperDusk never sees, sets or keeps any of them.
• Export and the keepsake are made on your phone and go only where you send them with the share sheet.
• Helplines are listed inside the app. Tapping a number uses your phone; "Find a helpline" opens an outside website in your browser, under that site's own policy.