Privacy Policy
PinPapers lets you keep private documents pinned to places, stored in encrypted form. This policy explains what personal data we process, why, who receives it, how long we keep it, and the rights you have. We have written it to describe only what the app actually does today.
A note on plain language: PinPapers protects your documents with strong encryption, but we do not claim your stored documents are “end-to-end encrypted” or that “only you can ever read them.” We hold a separate escrow-wrapped copy of each file’s key so that we can produce decrypted access under a strictly-limited, compelled legal process (see §3 and §10). We would rather be exact than reassuring.
1. Who we are
PinPapers (“we”, “us”, “our”) is operated by Mindslake, a partnership firm constituted under the Indian Partnership Act, 1932, which is the data controller / data fiduciary for the personal data described here.
During this private beta a single mailbox, info@mindslake.com, serves the DPO, Grievance Officer and general privacy contact. Role-specific aliases will be introduced at a later compliance review.
Interim governance: during this private beta these roles are held on an interim basis by the founder rather than by independent officers — see §10, “Interim governance during the private beta” for what that means for our safeguards and our commitment to appoint independent officers before general availability.
2. Scope
This policy covers the PinPapers mobile application (iOS, iPadOS and Android), the backend services it talks to, and the limited admin surfaces operated by Mindslake (collectively, the “Service”). It applies to the India-only Phase 1 private beta and to general availability once we launch it.
It does not cover third-party services you reach through the Service (for example, a website linked from a document you saved). Those are governed by their own privacy practices.
3. Personal data we process
3.1 Identity data
- Your email address, stored as a salted hash (we do not retain the plaintext beyond the federated sign-in callback).
- Your phone number in E.164 format, used to verify you and to enforce our one-primary-device model.
- An optional display name you may set for yourself — shown only to you, editable or removable at any time, and erased when you delete your account.
- Opaque sign-in identifiers from your identity provider (Google, and Apple on iOS) and an internal account UUID.
3.2 Device data
- A device identifier that is a random UUID generated on first launch and held in your device’s Keychain (iOS) or Keystore (Android). We do not use your IMEI or any persistent hardware identifier, and we do not request phone-state permission.
- Platform (iOS / Android), OS version and app version.
- Short-lived attestation tokens (Apple App Attest / Google Play Integrity), verified server-side and not stored long-term.
- Your app-lock preference. It is ON by default: your device’s Face ID, fingerprint or passcode is required to open the app, and you can turn it off in Settings. It only applies if your device has a biometric enrolled or a passcode set — on a device with neither, the app does not lock; the biometric check happens entirely on your device and PinPapers never receives or stores biometric data.
3.3 Content data — and how it is encrypted
Your documents, photos and voice notes are content you create. Here is exactly how we protect and hold it:
Your documents, photos and voice notes are encrypted on your device (AES-256-GCM) before they are uploaded, and we store them only in encrypted form. Each file’s encryption key is wrapped twice: once to your own device, and separately under an escrow key we manage in AWS KMS. In ordinary operation no PinPapers system and no PinPapers employee decrypts your content — there is no automated or routine decryption path, and we cannot read your files in day-to-day operation. We are, however, technically able to obtain decrypted access to specific files — only when compelled by valid legal process, and only through the governed, audited “lawful-access” procedure described in §10 (a stronger multi-party, tamper-evident model is a design target we are building toward, not yet fully in place). Because that escrow path exists, we do NOT describe stored documents as “end-to-end encrypted” and we do NOT claim that “no one but you can ever read your data.” A pin’s coordinates, title and label are not encrypted — we hold those in readable form. Encrypting them is planned work that has not shipped.
When you open a document, the app may keep an encrypted copy on your device so re-opening is fast. That cached copy is in the same encrypted form as the server copy, is size-capped, and is cleared when you sign out.
3.4 Location data
- Pin coordinates (latitude / longitude), captured only when you explicitly create or move a pin. This is precise location. Your location is not tracked continuously and we do not use background location.
3.5 Technical and diagnostic data
- Your IP address at sensitive operations (sign-in, consent capture, identity change), captured for security auditing.
- Crash reports — the app currently sends no crash reports to us or to any third-party crash service. Crash data reaches us only in aggregate through Apple (TestFlight) or Google Play, under your device’s own OS-level sharing settings with those platforms. You can also choose to share a redacted technical log with our support (Settings → Export diagnostics) — nothing is transmitted unless you explicitly share it. The optional C2 consent is retained for a possible future first-party crash channel; today, granting it transmits nothing.
4. Why we process it, and our lawful basis
For each purpose we name the lawful basis under both the EU GDPR and India’s Digital Personal Data Protection Act, 2023 (DPDP).
| Purpose | GDPR basis | DPDP basis |
|---|---|---|
| Create your account and sign you in | Art. 6(1)(b) contract | §4 — consent |
| Verify your phone number (OTP) | Art. 6(1)(b) contract | §4 — consent |
| Account recovery and identity updates | Art. 6(1)(b) contract | §4 — consent |
| Store your encrypted documents | Art. 6(1)(b) contract | §4 — consent |
| Security audit logging | Art. 6(1)(f) legitimate interest | §4 — legitimate use (security) |
| Prevent account takeover (one email / one phone) | Art. 6(1)(f) legitimate interest | §4 — legitimate use |
| App-lock (biometric / device credential) — on by default, you can turn it off | Art. 6(1)(f) legitimate interest | §4 — legitimate use |
| Optional display name (personalisation you invoke) | Art. 6(1)(b) contract | §7 — voluntary provision |
| Optional periodic re-verification (C1) | Art. 6(1)(a) consent (withdrawable) | §6 — consent (withdrawable) |
| Optional crash & analytics reporting (C2) — held for a possible future channel; currently transmits nothing | Art. 6(1)(a) consent (withdrawable) | §6 — consent (withdrawable) |
| Lawful admin access (compelled legal process) | Art. 6(1)(c) legal obligation | §4 — per legal compulsion |
5. Who receives your data
We rely on the processors below. Each is bound by a written data-processing agreement limiting use to the named purpose. We do not sell your personal data, and we do not share it with anyone for advertising purposes.
| Processor | What they do for us | Based in |
|---|---|---|
| Google LLC | Federated sign-in (Sign in with Google) | United States |
| Google Maps Platform | Map display and place search — the map area you view and any place-search text you type are sent to Google to render the map and return search results | United States |
| Apple Inc. | Federated sign-in (Sign in with Apple, on iOS) | United States |
| Amazon Web Services | Encrypted storage, key management (KMS), database, authentication and logging — primarily in AWS Mumbai (ap-south-1) | India (control-plane metadata may transit other AWS regions) |
| Twilio Inc. | SMS one-time-passcode delivery | United States |
5.1 Sharing a pin with another PinPapers user
When you share a pin, sharing is encrypted end-to-end in the normal case: your own device re-wraps each shared file’s key directly to the chosen recipient’s device (using ECIES), and our servers only relay that recipient-sealed key envelope without being able to open it. Two facts stop us from claiming end-to-end in every case, so we don’t. First, if the direct path cannot serve a share — for example, the recipient changed devices after you shared — the share simply fails and you re-share; an owner-consented, audited “escrow-assisted” re-wrap for those cases is designed but is not built, and the share service holds no access to the escrow key at all. Second, the underlying stored file itself remains escrow-wrapped, so it stays subject to the same lawful-access process described in §10 — a process currently operated by one person; the independent multi-approver model is a design target and is not yet in place. A file you add to a pin you have already shared is not sent to that person automatically — share the pin again to include it. You choose the recipient (an existing PinPapers user), set an expiry, and can revoke at any time — revocation deletes the recipient’s key copies and denies further access. We keep an internal record of each share carrying only a hashed reference to the recipient, never disclosed to any third party (making that record append-only and tamper-evident is a planned hardening, not yet in place).
6. Where your data is processed
PinPapers primarily processes your data in AWS Mumbai (ap-south-1, India), and the Phase-1 closed beta is India-only. Some data still crosses borders. Our sub-processors Google (federated sign-in), Google Maps Platform (map display and place search), Apple (Sign in with Apple, iOS), and Twilio (SMS OTP delivery) are US-headquartered, so limited data (for example a salted email/phone reference used for sign-in and OTP) may transit US infrastructure; AWS control-plane metadata may transit other AWS regions per the AWS Customer Agreement. If you share a pin with a recipient whose access is served from a different region, that pin’s encrypted files may transit across regions so the recipient can open them, recorded in our internal disclosure log. Legal transfer mechanism: for India residents, DPDP §16 (“Processing of personal data outside India”), which permits transfer to all countries except any the Government of India notifies as restricted — none are notified-restricted as of the effective date; for EU/EEA residents, the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) supplemented by the technical measures in our records of processing.
7. How long we keep it
Account deletion is a crypto-shred: when the 30-day window closes we destroy the keys that wrap your files. From that moment nothing in PinPapers can open your documents and we will not restore them on request; for a short period afterwards a copy of those keys remains inside our encrypted database backups, and once those roll over the stored ciphertext cannot be opened by anyone, including us. A small set of immutable, attributed audit records is retained for the legal periods below.
Deleting your account also reaches beyond your own files. If you created any companion accounts (additional devices that share your storage), deleting your account deletes those companion accounts too — their devices lose all access, and the copies saved on them are removed the next time they connect. Deletion also revokes anything you have shared: the people you shared with lose access, and the item simply disappears from their “Shared with me” — they are not separately notified, and any copy a recipient already downloaded to their own device is outside our reach. Companion accounts are not available in the current private beta.
| Category | Retention |
|---|---|
| Identity data (email hash, phone) and display name | Account life + 30-day deletion window |
| Encrypted documents, photos, voice notes | Account life + 30-day window, then keys crypto-shredded |
| Immutable legal / disclosure audit records (attributed) | 7 years (DPDP §8(7) / GDPR Art. 17(3)(b)) |
| Routine authentication audit events | 90 days |
| Diagnostics logs you explicitly share with support | Deleted within 30 days after your support case closes |
| Encrypted database backups | Rolling 1-day window, encrypted at rest. This window will be longer once PinPapers leaves beta; we will update this table before it changes. |
| Inert encrypted file bytes under storage Object-Lock | Until each object’s lock expires (inert once keys are shredded; unreadable by anyone once our encrypted backups have also rolled over) |
8. Your rights
You have rights under the GDPR and the DPDP Act. During the private beta, exercise every right by email to info@mindslake.com — there is no in-app privacy-request form. Please send your request from the email address registered to your account so we can verify ownership. We acknowledge any request within 48 hours; formal grievances are acknowledged within 7 days and resolved within 30 days (DPDP §13).
- Access (GDPR Art. 15; DPDP §11) — a copy of your personal data, within 1 month.
- Correction (GDPR Art. 16; DPDP §12) — you can change your email and phone in-app; other corrections by email, within 1 month.
- Erasure (GDPR Art. 17; DPDP §12) — within 1 month; your files’ keys are crypto-shredded when the 30-day window closes (see §7). Certain immutable audit records are retained attributed for the periods in §7.
- Portability / export (GDPR Art. 20) — within 1 month. In-app export is hidden during the closed beta; email us and we will provide your export. In-app export becomes available at general availability.
- Restriction (GDPR Art. 18) — within 1 month.
- Objection (GDPR Art. 21) — within 1 month; applies in particular to the optional C1 periodic re-verification.
- No solely-automated decisions (GDPR Art. 22) — the only automated decision we make is rejecting a duplicate email/phone at sign-up; manual review is available on request within 1 month.
- Withdraw consent — you can withdraw any optional consent (C1, C2) at any time; withdrawal does not affect your ability to use the Service.
- Nominate another person (DPDP §14) — you may nominate someone to exercise your rights on your behalf in the event of your death or incapacity; email us to record a nominee.
Account deletion during the beta is also handled by email — see our Account & Data Deletion page for the exact steps.
9. Consent
At sign-up we present granular, per-item choices. Factual notices about how the Service works (for example, that stored documents are escrow-wrapped and that deletion is irreversible after the window) require your acknowledgement; optional items (C1 periodic re-verification, C2 crash and analytics reporting) are true consents you may grant or decline independently, and declining does not affect your ability to use the Service. You can review your consent history in the app, and withdraw any optional consent at any time. If we make a material change to this policy, you will be asked to acknowledge the new version before continuing.
10. Lawful admin access
Because a separately-held escrow key exists (see §3.3), PinPapers is technically able to produce decrypted access to specific user data. We do this only when compelled by valid legal process (for example, a court order or lawful demand under applicable Indian law), never for our own purposes.
How this works today. We treat every such request as a governed, documented and audited internal process: the request is recorded; it is reviewed by our Data Protection Officer — and, as those roles are established, our Grievance Officer and legal advisers — for validity, scope and necessity; the decryption is logged; and we disclose only the specific data the lawful request covers, for no longer than it requires. Your protection here is audited access governance and legal process — not a claim that decrypting your data is technically impossible for us or for our cloud provider.
Where we are heading. We are building a stronger, cryptographically-enforced authorisation model — designed to require a multi-party approver quorum (with the Data Protection Officer as a mandatory approver) before any time-bound, scope-limited decryption is possible, and to record every access in an append-only, tamper-evident audit trail. These controls are a design target and are not all in place yet; until they are, lawful access is governed by the documented internal procedure described above.
Interim governance during the private beta. We want you to know this before you sign up: PinPapers is operated by a solo founder, and during the current private beta the Data Protection Officer, Grievance Officer, and the lawful-access approver roles are all held by that one person. The independent, multi-party separation described above is therefore not yet in effect — a single individual currently performs roles that are designed to check one another, which is a real limitation of these safeguards today. We will appoint independent officers before general availability. If this interim arrangement matters to you, please take it into account in deciding whether to use the beta, and you can always reach us at info@mindslake.com.
Notifying you. We notify affected users of a lawful-access event unless we are legally prohibited from doing so — certain directions under Indian law carry a statutory obligation of confidentiality. Where such a prohibition later lifts, we notify you as soon as we are lawfully able.
11. Cookies and similar technologies
The PinPapers mobile app does not use cookies. Our admin surfaces may use a small number of strictly-necessary session cookies for authentication; these are internal-operations only and are not used for advertising or cross-site tracking.
12. Children
PinPapers is not directed at anyone under 18 years of age. You must be 18 or older to create an account, and you affirm your age at sign-up. If we learn that a user is under 18, we suspend the account and securely delete the data within 30 days. We do not knowingly process children’s data and we do not run behavioural advertising to minors.
13. Breach notification
Personal-data breach notification is governed by DPDP §8(6) — the data fiduciary’s statutory duty to give the Data Protection Board of India and each affected data principal intimation of a breach, in the form and manner prescribed by the DPDP Rules. This is the correct Indian statutory hook (§27 concerns the Board’s powers and functions, not the breach-intimation duty). For EU/EEA residents, GDPR Art. 33 (notify the lead supervisory authority within 72 hours of becoming aware) and Art. 34 (notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms) also apply.
14. Complaints
If you are unhappy with how we have handled your data, please contact our Grievance Officer first at info@mindslake.com (acknowledged within 7 days; resolved within 30 days). You also have the right to complain to a regulator:
- India — the Data Protection Board of India, once its complaint portal is operational.
- EU/EEA — your local supervisory authority in your country of habitual residence.
15. Changes to this policy
We may update this policy from time to time. Material changes (a new processor, a new purpose, a change in retention or cross-border destination, or a change in lawful basis) are announced in-app and you will be asked to acknowledge the new version. Editorial changes (clarifications, contact updates) are published with a new effective date. This is version 1.5, effective 27 August 2026 (editorial correction: the account-deletion paragraph no longer says your documents become “permanently unrecoverable” within 30 days — the keys are destroyed when the 30-day window closes, and recovery becomes impossible once our encrypted database backups have also aged out. This narrows a claim; no processing change).
16. Contact
Related pages: Account & Data Deletion · Support · Terms of Service · Closed Beta Privacy Notice.