Privacy Policy

Draft — COUNSEL REVIEW REQUIRED before this is relied on. It is published because an app store requires a policy at a public URL, and because saying nothing would be worse. It describes what the system actually does as of 20 September 2026, including the parts that are not finished.

Last updated: 20 September 2026

Paperwork One is operated by GlueCode ("we", "us"). This policy covers the Paperwork app, `paperworkone.com`, and the counter service where a business asks you to scan a QR code and send it documents.

The short version

You give us documents, often identity documents. That is the most sensitive thing a product can hold, and we treat it that way. Documents are private by default, never public, encrypted in transit and at rest, and never sold or used for advertising. Automated checks decide only whether a document is usable — never anything about you.

Two kinds of people use this service

Account holders. You signed in with your phone number and keep documents in Paperwork.

Counter customers. You scanned a business's QR code, typed your name and mobile number, and sent documents so that business could complete something for you. You have no Paperwork account. You are shown this policy's key points before you send anything, and we record which version you were shown.

What we collect

• Account data — your phone number (to sign you in) and a display name if you give one.
• Counter data — the name and mobile number you type at a counter.
• Documents — what you upload or photograph, which may include Aadhaar, PAN, passports or bank statements. We never fetch documents without your action. A photo can contain details saved in it by the camera, such as when and where it was taken (its precise location). The app may resize and compress a photo before uploading it but keeps those details, and we store what is uploaded without changing it; some official document requests require a geotagged photograph. We do not track where your device is. Only you and the people you share the document with can open it.
• Information read from documents — when automated checks run, fields such as the holder's name, a document number or a date. This is deleted when the document is deleted.
• Activity records — an audit trail of significant actions. It never contains document contents.
• Error reports — technical diagnostics, with personal data removed before they leave our systems.

How documents are processed

We inspect a document to answer three questions: is it the document that was asked for, is it readable, and has it expired.

• Image quality is measured by our own software.
• Nothing identifies your document or reads what it says. Earlier versions of the service sent a document image to Google's Gemini API for identification and to Google Cloud Vision for text extraction. Those paths have been removed, not switched off — the software that called them no longer exists, and there is no setting that brings it back.
• If we add document identification again, it will run in Paperwork's separate document engine rather than in this service, and this policy will name the processor before it starts.

Automated checks only decide whether a clearer copy is needed. They do not make decisions about you. A document we cannot judge automatically — which, today, is every document — goes to a person rather than being approved.

Where your data lives

• Database and document storage — Supabase, on Amazon Web Services in Mumbai, India. Documents are in private storage with no public path; access is through short-lived signed links issued after a permission check.
• Sign-in — Google Firebase Authentication processes your phone number.
• Mobile app diagnostics — Google Firebase Crashlytics (crash and error reports with device, operating-system and app-version details and a random identifier for the installation, not your account). It does not receive your documents or what they say. The mobile app does not collect usage analytics.
• Notifications — Firebase Cloud Messaging and Apple's push notification service deliver reminders to the mobile app using a device token. Reminder text is generic: it never shows a document's title, a name or anything from the document.
• These Firebase services run in Google projects that Paperwork One controls.
• Compute — Vercel, with functions in Mumbai. Some processing metadata is handled in Vercel's United States region, so limited metadata crosses borders. Document files are stored in India.

We are working through formal data-processing agreements with these providers. They are not all executed yet.

Who can see your documents

• People you add to your family can see the family's documents.
• A business you send documents to can see what you sent it, inside Paperwork. Any member of that business's team can open them.
• We do not sell personal data and do not share it for advertising.

Keeping and deleting

Documents you keep in your account. Removing one puts it in trash, where you can restore it. After 30 days trash is emptied and the file, its versions and anything read from it are permanently deleted.

Documents you send to a business at a counter. A business loses access after its retention window. We have not yet set a period after which we delete these documents ourselves. Until we do, they remain stored, and you can ask us to erase them at any time — we will, and that erasure removes the files, everything read from them, and the name and mobile number you typed. What remains is a record that the request existed and was erased.

Account deletion. Deleting your account removes your documents and personal data from the document service. Some account and billing records in our identity system are not yet covered by an automated deletion path, and we delete them manually on request.

Backups. Deletion removes data from live systems immediately. Backup copies expire on their own schedule and are not searched or restored selectively.

Your rights

You may ask for access to your personal data, its correction or its erasure, withdraw consent, or raise a grievance.

• Counter customers can raise a request from the page they scanned into.
• Anyone can write to privacy@gluecode.in.

We aim to respond within 30 days.

A grievance officer has not yet been appointed. Until one is, requests go to the founder at the address above. This is an interim arrangement and it will be replaced with a named officer and their contact details.

Children

Paperwork is not directed at children, and we do no tracking, behavioural monitoring or advertising of any kind, at anyone. A parent or guardian may keep documents for family members, including minors, as data they control. We do not currently have a way to verify parental consent, and the rules requiring one are not yet in force.

Security

Encryption in transit and at rest, private document storage, access checks in every path that reads or writes your data, and tested isolation between different families and businesses. We hold no security certification and have not had an external penetration test.

If something goes wrong

If personal data is exposed, we will tell the people affected and the regulator, as the law requires, without delay.

Changes

We will update this policy as the product changes and note the date above. Material changes will be announced in the app.

---

### Notes for review, to be removed before this is final

This draft deliberately states four things most policies omit, because they are true and the alternative is a policy that contradicts the system:

1. AI processing is off, and cannot return silently. 2. Counter documents have no automatic deletion period yet. 3. Account deletion does not yet reach every system. 4. No grievance officer is appointed.

Counsel should also settle: whether we are Data Fiduciary or Data Processor for counter documents, the retention period for them, and our position on Aadhaar. See `docs/dpdp/legal-decisions-required.md`.