Privacy policy
This is a translation for your convenience. The Czech version is the binding one.
Papeer is a Markdown notes editor. Papeer stores notes on its own server in Papeer Cloud, encrypted with your account’s key. You can turn on Google Drive sync; then a copy of your notes is also saved to the Papeer folder in your Google Drive. It is operated by Dmitry Meiner, company ID (IČO) 71492780, Prague (the “operator”). This page describes what data Papeer works with and why.
What Papeer stores
- Papeer stores your notes on the Papeer server: documents, folders, attachment files, 30 days of version history (you can view and restore it from the document menu) and the trash. They sit on an encrypted disk and are also — names included — encrypted with your account’s key. That key is wrapped with a master key that only the Papeer server and the operator (in their password vault) have. This protects against a leak of the disk or the database; backups are protected by encryption before sending, with a key only the operator has in their password vault. It does not protect against someone who takes over the running server, nor against the operator — technically the operator can get to your notes, just as Google can get to the files you keep with it. The operator doesn’t do that.
- Trash and emptying it: the trash keeps items until you empty it; nothing is deleted from it on its own. Emptying it deletes the items, their files and older text versions from the server straight away. They stay in the hourly dumps on the server for up to 24 hours, in backups for at most 30 days and in snapshots for up to 6 months; after that they are gone from there too.
- Backups: every hour a database dump on the server (kept for a day), every night an encrypted copy of the database and attachment files on the operator’s backup server (30 days) and from there into their snapshots outside the data centre (up to 6 months).
- Deleting your account deletes from the server, straight away and for good, the account, the key to its content, all documents, versions, the trash, attachment files, devices and Claude access. Content stays in the hourly dumps on the server for up to 24 hours, and encrypted together with the wrapped key in backups for at most 30 days on the backup server and up to 6 months in snapshots; after that it is gone from there too. Nobody looks into backups without your request.
- Google Drive sync: if you turn it on, the Papeer server uses your access to Google Drive to write documents as .md files and attachments as ordinary files into the Papeer folder in your Google Drive, in the background. For this it stores only the encrypted access to Google Drive and which files in Google Drive belong to which documents. It never permanently deletes anything from Google Drive; what you delete in Papeer it moves to the trash in Google Drive. A file changed in Google Drive by another program is saved to the document’s version history and then overwritten.
- Papeer account: your email address and signed-in devices (for each, only a fingerprint of the sign-in, a short description of the device and app, and when it was last used). You sign in to Papeer with a one-time code sent to your email, no password.
- Connected Google Drive (only with sync turned on): the email and ID of the Google account, the ID of the Papeer folder in Google Drive and the access (refresh) token, encrypted. The encryption key is stored separately from the database.
- Server tasks: for Google Drive sync (and later other long tasks) only the status, counts, times and a short log of events from the last 30 days — no names and no content. After sync is turned off, the date it was turned off stays with the account; it is deleted with the account.
- Emails about long tasks: when the first Google Drive sync takes longer than 10 minutes and finishes, or when sync has been interrupted for more than a day, Papeer sends an email with one sentence via the Brevo service — without the content of notes and without a link. You can turn them off in Settings → Account.
- Claude access (MCP connector): for each allowed connector only a fingerprint of its access key, the connector’s name, and when it was allowed and last used. The connector connects by signing in to your account (code by email, or the sign-in from the browser); you see and revoke access in Settings → Security.
- Sharing by link: for a document you share, only which document it is and the encrypted link; the password only as a fingerprint. For a visitor of the link, the server reads the document and its files from your Papeer Cloud and hands them over — only in the response to their request, storing nothing for it. Turning sharing off ends this.
- Reporting content: when a visitor of a shared document uses the “Report content” link, only the reason, their note, a fingerprint of the link and the time are stored (never their address or the content of the document), and the operator gets an email with the link, reason and note to review the document. A suspended account learns about the suspension when signing in and can write to support@papeer.online.
- Support requests: when you contact support from the app, the text of your messages and the replies is stored (encrypted), a screenshot only if you attach one yourself (encrypted), and technical details: the app version, a description of the device, the language and your plan. Nothing from your notes is attached to a request on its own. The operator gets the text of your message by email and the support reply comes to you by email — both through the Brevo service. Requests are kept while the account exists; deleting the account deletes them from Papeer. Emails that have already been sent stay in the recipients’ mailboxes.
- Subscription (Paddle): when you subscribe, the seller is Paddle — you enter your payment details in its window and Papeer never sees your card. Papeer stores with the account only the customer and subscription identifiers at Paddle, the subscription status, plan, period and the date of the next payment or end, and a list of events received from Paddle (only their identifier, type, time and result, 90 days). Paddle issues and sends the receipts.
- Signing in: to prevent guessing codes, Papeer remembers for at most a day a fingerprint (not the value itself) of the email address and of the IP address you request a code from.
- Use through Claude (MCP connector): Claude reads and writes directly to your Papeer Cloud; the time, tool and document path are recorded — never its content; the record is continuously overwritten (only about the last 2 MB are kept). What Claude overwrites stays in the version history for 30 days. Like any website, the server also keeps an ordinary access log (IP address, time).
- Export everything: you can download your whole account as a ZIP any time, in the same form it would have on a disk (documents as .md files, attachments in _assets folders).
- This data is only on the Papeer server, which the operator manages, and in its backups.
- On your device Papeer (the app or the page in the browser) keeps a copy of your notes so that it works fast and offline. This data does not leave your device; signing out deletes it.
Google Drive and the scope of permissions
Only when you turn on Google Drive sync: Papeer asks for the drive.file permission. This means it sees and edits only files it created itself. It has no access to the rest of your Google Drive. It also uses the openid and email permissions to show which Google account is connected.
The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What Papeer doesn’t do
- It collects no analytics and uses no tracking cookies or ad networks.
- It shares no data with third parties except those that are necessary: Brevo (sends emails with codes), Paddle (the seller of the subscription — it gets your email, country and the payment details you enter with it yourself; see Paddle’s privacy policy) and — only when you turn on Google Drive sync — Google. Brevo carries the email with the sign-in code and notifications about long tasks, unless you turn those off (so Brevo sees your email address). These emails contain no links and no content of notes. Brevo also carries the emails about support requests: a confirmation with the request number, the support reply with its text and a link to the app, and the text of your message to the operator.
- It does not use your data to train any models or for any purpose other than running the editor.
Cookies
Papeer uses only cookies needed for it to work: the sign-in identifier (papeer_sid), valid for at most 180 days since last use, and when turning on Google Drive sync a short-lived cookie (papeer_oauth, 10 minutes) to protect that step. After signing in, Papeer also sets the marker papeer_device (value 1, one year), by which the main address papeer.online sends you straight to the app; signing out deletes it. The website remembers the language you last viewed in papeer_lang (cs or en, one year). None of them track anything.
Signing out and deleting the account
In the app, in Settings → Security, you see your signed-in devices and can sign out of this device, any other one, or all of them at once. Signing out everywhere deletes the copy of notes on the other devices too as soon as they connect to the internet (unless unsent changes are waiting on them). In Settings → Storage you can turn off Google Drive sync: Papeer asks Google to revoke its access; the files in the Papeer folder in Google Drive stay. In Settings → Data and privacy you can delete your account. Deleting the account also deletes your notes in Papeer Cloud (dump and backup periods above). The Papeer folder in Google Drive, if you turned sync on, stays unchanged; Papeer asks Google to revoke its access, and if Google doesn’t confirm the revocation, the app tells you. You can also remove Papeer’s access any time in your Google Account settings (Security → Third-party apps).
Contact
Privacy questions: support@papeer.online.