Your papers, your progress.

Apple account and cloud library

Guests can use saved papers locally. Cloud AI processing requires Sign in with Apple and explicit administrator approval. Apple verifies your identity; PaperTrail never receives your Apple password. The service verifies Apple's signed identity token and stores a hashed account identifier. A device-specific PaperTrail session is stored in the iPhone Keychain. PaperTrail does not request your Apple email address or full name, and does not use your account for advertising or cross-app tracking.

Signing in links this device's existing guest library to that Apple account. Your original photos, cleaned pages, question images, questions, answers, edits, practice snapshots, drafts, scores, reading progress, visits, optional learner name, folders and archive status are saved privately on Cloudflare. Signing in to the same account on another device restores your library. Changes sync while the app is open and online. Offline changes remain on your device until a successful sync; Settings shows sync status. Simultaneous changes to different records and fields are merged. For simultaneous changes to the same field, the device uploading the change takes precedence.

Photo processing

When you process a paper, photos pass through this Cloudflare service to the configured image service (Azure or Claude Proxy) to remove handwriting. Original and edited photos are sent to Copilot Proxy to transcribe questions and produce brief answers. Image editing may alter printed content, so compare results with originals. Syncing existing papers and practice history does not call the model providers. Learner names and practice records are not sent to the model services.

These providers may process or retain submitted data under their applicable policies. The proxy's additional retention practices have not been independently verified. Provider credentials stay on the service and are never included in the app.

Storage, archive and deletion

Signed-in libraries, including archived papers and attachments, remain in Cloudflare without an archive expiry. Archiving organizes your library; it does not delete account data. Data is protected by HTTPS in transit, private account access checks and the storage provider's encryption at rest. It is not end-to-end encrypted.

Signing out immediately hides that account's local library. Unsynced changes remain on this device and resume uploading after signing in to the same account again. Settings also offers permanent account deletion, which revokes PaperTrail sessions and deletes the account's cloud library, attachments and linked processing copies. Failed cleanup is retried by the service. Other devices lose access when their session is next checked; offline copies can remain on those devices and in device backups. A later sign-in creates a separate empty cloud library so old device caches are not automatically uploaded again. No Apple access or refresh tokens are retained; you can also remove PaperTrail from Sign in with Apple in your Apple account settings.

For guests, a random installation identifier in the Keychain separates processing copies on the service. Unarchived processing copies are retained. Guest archiving starts a 7-day retention period; restoring before the deadline cancels removal. Guest practice history remains local until sign-in. Previously expired processing files can only be backed up if a device still has its local copy. Deleting the app before a successful sync may lose unsynced records.

Recent usage counts and processing status help operate the service. They do not impose a daily paper limit. Small deletion and migration records prevent old requests or installation secrets from recreating deleted or migrated data.

Unreferenced attachments

Files referenced by your current cloud library, including saved practice history, remain available. Files no longer referenced by the library are removed after a 30-day grace period. Uploading or reading an unreferenced file restarts that period. Existing files receive a complete grace period when first enrolled in cleanup.