Privacy
Last updated: 2026-10-31
paper-inbox reads your PDFs to propose a file name. This page says where that happens, what is kept, and what the tool asks Google for.
Your documents
- The PDFs you open are read in your browser, in memory. Text recognition (OCR) also runs in your browser, using files served by this site.
- There is no paper-inbox server that receives your documents, their text or their names: the application is a set of static files.
- No remote artificial-intelligence service is called.
What is kept in your browser
- The issuers you accepted (for example “EDF”), to recognise them better next time.
- The Drive destination folder you chose (its name and identifier).
- The address of the Google account you last connected, so that Google's window can skip its account chooser next time.
This data stays on your device (the browser's local storage) and is sent nowhere. The “Forget learned issuers” button (“Shortcuts” menu) erases the first; clearing the site's data in your browser erases everything.
Google Drive
Connecting Drive is optional: without it, you can open files from your computer and copy rename commands.
- The tool asks for a single permission:
https://www.googleapis.com/auth/drive.file. It only gives access to the files you choose in Google's picker, and to the destination folder you choose. paper-inbox cannot list or read the rest of your Drive. - On those files the tool can: download them to read them, rename them, move them to the chosen folder and, if you leave the option ticked, replace their content with the same pages plus the recognised text as an invisible layer. Drive keeps the previous version in its history for a limited time.
- The phone scanner (guide) works on your photos in the browser and sends nothing until you save. Saving to Drive creates a new PDF in the folder you chose, and creates that folder only if you ask. Photos themselves are not uploaded.
- The Google access token is kept in memory during your session (about an hour). It is not written to browser storage, and there is no refresh token.
- You can remove access at any time in your Google account, “Security” then “Third-party apps”.
paper-inbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What a modified PDF contains
When recognised text is added to a PDF, the document properties state that this text was produced by paper-inbox, with its version, the recognition engines used, the date, the pages concerned and the original file name. That text is the result of an automatic reading and may contain errors.
Third parties
- Google: its sign-in and picker scripts are loaded only when you click to use Drive.
- Cloudflare hosts the site and, like any host, sees the IP address, the requested address and the time of requests for the site's pages and files, never the content of your documents.
- No cookies, no ads, no audience measurement.