Promises you can check.

A privacy policy is only words. These are the parts of Paperwren's design that make the words true, and all of them are in the public source code.

1. 01

   No permissions, enforced at build time

   The Android build script removes every permission the app template adds, including internet access, and fails the build if one is left. The app's system info page shows none.

2. 02

   No way to reach the network

   Besides having no internet permission, the app's content security policy only allows connections to itself. There is no analytics, ads or crash SDK among its dependencies: just document engines (pdf.js, docx-preview, SheetJS) and small helpers. On Windows and macOS, Tauri's updater checks GitHub for a new version only if you allow it, and installs only an update signed with the key built into the app.

3. 03

   Files are read, never changed

   The app reads documents and never changes them or runs anything in them. It writes only when you ask: a copy a tool made, saved where you pick in the system's own save screen, or a file you rename. On Windows and macOS those two writes are made by the app's native side, which checks the name; the web layer that shows documents still has read-only access. On Android, reading is limited to files you picked or shared and the app's own private copies, and saving goes through the system's save screen, which needs no permission.

4. 04

   Documents are treated as untrusted

   Markdown is sanitised with DOMPurify before display. Scripts can only come from the app itself, and plugins and form submissions are blocked outright. Spreadsheets and older Office formats are parsed off the main thread.

5. 05

   Private copies stay private

   Files are copied into storage only Paperwren can read, named by a hash of their content, and every path is validated so nothing is read or written outside that folder.

6. 06

   Nothing rides along in backups

   Android cloud backup is disabled. PDF passwords live in memory only and are never stored.

How builds are made

Releases are built by GitHub Actions from the public repository after lint, type checks, unit tests and Rust tests pass. Download them only from GitHub Releases. While the app is in testing, Android builds are signed with a test key.

Report a vulnerability

Please report security issues privately through a GitHub security advisory rather than a public issue.