Privacy & data

• Writing and reading your journal are local file operations. No account, no network, ever.
• AI features and sync are opt-in. Nothing leaves your machine until you create an account and use them.
• We never use your journals to train models, and we never sell or share your data.
• Anonymous usage counts are on by default once you finish setup, and take one command to turn off.

Your journals are plain markdown files in your own OS data directory — one file per day — alongside the profile Paper builds and your saved coach conversations. You can read, grep, back up, or delete them with any tool you like. Paper never edits your entries; the AI only ever reads them.

If you never create an account, that is the entire story. Paper makes no network requests to write, read, search, or browse your journal.

Signing in and running paper sync uploads your journals, your profile, and your coach conversations so they reach your other devices. We also store your email address and your plan.

Synced content is encrypted at rest with AES-256-GCM before it reaches the database. To be precise about what that does and does not mean: this is not end-to-end encryption. Our servers hold the key and can decrypt your content — that is what makes the AI features possible. Treat it as “protected against a database breach,” not as “unreadable by us.”

Follow-up questions, recaps, and coaching need a model to read your writing. When you run one of those commands, the relevant entries and profile are sent to our server, which calls Anthropic's API to generate the response, and the response comes back to your terminal.

Neither we nor Anthropic use your journals to train models. If you never run an AI command, your writing is never sent anywhere.

Paper records which commands you run and whether they succeeded — the command name, the CLI version, your OS, how long it took, and a random per-install identifier. That is the whole payload. No entry text, no titles, no arguments, no file paths, no dates from your journal, not even hashed.

It is on by default after setup, where it's disclosed, and off in one command:

paper config set telemetry off

You can also set PAPER_NO_TELEMETRY=1 in your environment. Both are checked before anything is recorded or sent.

Your journals are already plain files on your disk, so export is just copying a folder — there is nothing to request and no lock-in to escape. Deleting the local files deletes them.

To have your account and everything synced to it erased from our servers, email rewrlution@gmail.com from your account address. We handle these by hand today rather than through a self-serve button, and we'll confirm when it's done.

If you are in the EU or UK, the GDPR rights of access, rectification, erasure, restriction, portability, and objection apply to you, and the same address is how to exercise them.

Paper runs on a small number of infrastructure providers: our API and database hosting, and Anthropic for the models. They process data on our behalf to run the service. We do not sell your data, and we do not share it for advertising.

Ask us anything at rewrlution@gmail.com. If this page and the software ever disagree, that's a bug — tell us and we'll fix whichever one is wrong.