Paper Place

Privacy Policy

The short version: your sheet is yours. An account is optional and your notes never need one. There are no ads, no sale of data, and nothing that follows you across other companies’ apps or websites. Your work lives on your device (and in your own iCloud, if you use it). Content leaves your device when you ask for an AI feature, and then we send only what's needed to fulfill that request. Two things travel without you asking each time. One is Ambient mode's optional weather matching, which sends an approximate area (rounded to about 11 km, never a precise location) to a weather service so the scenery matches your sky. You can turn that off, and then the App never asks where you are. The other is a count of which features you use, described in Section 9: numbers only, never your notes or anything you have written, sent in the background unless you switch it off. In the European Economic Area and the United Kingdom it is off until you switch it on.

Effective date: August 5, 2026. This Privacy Policy describes how Society Rebel LLC ("Society Rebel," "we," "us," or "our") handles information in connection with the Paper Place application, formerly named One Sheet of Paper (the "App") and this website (the "Site"). By using the App or Site, you agree to the practices described here. If you do not agree, please do not use the App.

1. Who we are

Paper Place is made by Society Rebel LLC, a United States limited liability company. We are the "data controller" (where that concept applies) for the limited processing described in this policy. Contact: support@onesheetofpaper.com.

2. What we do not do

3. What stays on your device

The following is created and stored locally on your device (and in your personal iCloud, per Section 7). Everything in this list stays on your device except where a bullet says otherwise, and only one of them does:

4. AI features (when content leaves your device)

Some features use cloud-based AI models. These run only when you initiate them: for example, when you ask Shxdoh (the in-app assistant) a question, ask it to write or proofread, show it your canvas with the look (eye) button, generate an image, request a summary or takeaways, or record a meeting with automatic notes. Nothing is sent in the background or without an action you take.

When you use one of these features, the App sends the content needed for that request (which may include your typed prompt, relevant note text, an image of the relevant portion of your canvas, or, for meeting notes, the audio recording or its transcript) over an encrypted connection (HTTPS/TLS) to our infrastructure and on to an AI model provider, which generates the response and returns it to your device.

Showing the assistant your canvas (the "look" button). When you tap the look (eye) button in a conversation with Shxdoh, the App attaches a picture of the currently visible part of your canvas to that message so the assistant can "see" what you're working on. To keep the exchange coherent, a few of the most recent messages in that same conversation are sent along with it. As with every AI feature, this happens only when you tap to send.

Where the work happens (cloud vs. on your device). Most AI features prefer a cloud model for quality. Some features can fall back to an on-device Apple model when the cloud is unavailable; when a request is handled on-device, that content is processed locally and is not transmitted off your device. Whether a given request is handled in the cloud or on-device, no account or identity is attached to it (see "What is NOT sent" below).

Who processes it. Requests are handled by AI model providers and our infrastructure partners, acting as service providers/processors on our behalf. As of the effective date, these are:

We may add, remove, or substitute providers in these same categories; we will update this list when it changes materially.

What is and is not sent. We do not attach your name, email address, Apple Account, advertising identifier, or Apple device identifier to AI requests, and we do not attach your account to them either, if you have one. (If you join our email list during setup we hold your address for that, and only that; see Section 10.) We do attach one identifier, so that we can meter usage fairly and prevent abuse: a random identifier the App generates and stores on your device, or, if you have an active subscription, the identifier Apple issues for that subscription. Where it comes from a subscription it is the same across your devices. Our relay removes this identifier before your request reaches OpenRouter or any AI model provider, so no third party receives it alongside your content. Like all internet traffic, requests necessarily expose your IP address and routine connection metadata to the servers that handle them.

Retention. Our relay is configured to forward request content for processing, not to retain it; we do not maintain a server-side store of your content. AI model providers process content transiently to generate your response and handle it under their own service terms, which may include short-term operational retention (for example, for abuse prevention). We do not authorize any provider to use your content for advertising.

5. Microphone, meeting recordings & speech recognition

The App requests microphone access only for meeting recording and voice features, and records only after you explicitly start a session. The system recording indicator is visible while recording. Recordings are saved inside the relevant document on your device; audio cleanup to improve clarity (such as level normalization and equalization) happens entirely on-device, before any of the optional AI steps below.

Your responsibility when recording others. Laws on recording conversations vary by jurisdiction; many require the consent of all participants. You are solely responsible for complying with applicable recording, wiretap, eavesdropping, and privacy laws (including obtaining any required consent from other participants) before recording any conversation or meeting. Society Rebel LLC does not monitor your recordings and disclaims responsibility for any use of the recording features in violation of applicable law.

6. Ambience, weather & location

Ambient mode matches the scenery behind your documents, and the weather that drifts across them, to your real time of day and season. Time and season come from your device's own clock and need no location at all.

One optional setting, "Match real weather," uses your approximate location so the weather on your page mirrors the weather outside. Exactly what that does:

7. iCloud

If iCloud is enabled on your device, your documents sync through iCloud Drive, and small key-value data (usage metrics, coins, trophies) syncs through iCloud's key-value store, in each case within your own Apple account. This storage is operated by Apple, protected by your Apple credentials, and is not accessible to us. Apple's handling of iCloud data is governed by Apple's privacy policy. You can control iCloud for the App in iOS Settings.

8. Notifications

The App can send you notifications. There are two kinds, and they work differently.

Reminders about your own progress (for example, a tool upgrade in Shxdoh Grounds finishing, or daily coins you have not claimed) are scheduled on your device, by the App. Nothing about them leaves your device and no server is involved. You can turn them off in the App under Settings → Notifications.

News and offers from us are sent from our server and are off unless you turn them on, under Settings → Notifications → “News and offers”. Turning that switch off stops them, and the change is sent to our server, not just stored on your device.

To deliver either kind, Apple gives the App a device token: an opaque identifier for one installation of the App on one device, issued and rotated by Apple. If notifications are enabled we store that token on our own server (a Cloudflare Worker), together with the same usage identifier described in Section 4, your language (not your region), which Apple notification environment the token belongs to, whether you opted in to news and offers, and the App’s build number. We do not store your name, email address, account, IP-derived location, advertising identifier, or time zone alongside it, and we never share it with advertisers or data brokers. If you have made an account, the account records that same per-installation identifier for each device you sign in on (Section 12), so it can be linked to you. If you have joined our email list, that address is held separately and is not linked to this token. For completeness, the other places this same identifier appears are the usage meter described in Section 4 and, unless you have switched them off, the feature counts described in Section 9. Our analytics server does not store that identifier at all: it keeps only a one-way handle computed from it with a key held on that server, so its records cannot be reversed back into an identifier. It is not used to track you across other companies’ apps or websites.

Turning notifications off in iOS Settings stops delivery immediately. Deleting the App invalidates the token; Apple tells our server on the next send and we delete our copy. Tokens we have not heard from in six months are deleted automatically. You can also email us to have yours removed.

9. Feature-use counts & issue reports

We want to know which parts of the App people actually enjoy, so we can spend our time on those. To do that the App sends us counts of how often features are used. It is a list of numbers, nothing more: how many sheets have been created, how many times the mine was opened, how many days the App has been launched, how far you got through the introduction, which places in the App you visited and for how long, and how often a membership screen was shown.

What it never includes. Not your notes. Not your writing, drawings, photographs or recordings. Not the names of your documents, not where files live on your device, not your location, not your name or email address, and not the contents of anything you have made. There is no way for what you write to reach us through this.

What travels with it. The same opaque per-installation identifier described in Section 8, and a second random identifier shared between your own devices so that one person with an iPad and an iPhone is counted once rather than twice. Neither is stored as sent: the server keeps only a one-way handle of each, as described in Section 8. Also your device model and iOS version, the App's version and build number and whether it was installed from the App Store, TestFlight or Xcode, your language (not your region), and which settings you have switched away from their defaults. It also carries your Pass (Explorer, Gold or Diamond; whether that comes from a subscription or a support code; whether a subscription is in a free trial, whether it is set to renew and the day it ends), never any payment details; the day you first opened the App; the clothes and hair you chose for your character in the closet (never its skin tone, face or body); and the names of the features that led you to a Pass screen. We call these identifiers opaque because that is what they are: random values that mean nothing outside our own systems. They are still identifiers, so we treat this information as personal data rather than calling it anonymous.

Your choice. In the European Economic Area and the United Kingdom this is off unless you turn it on. Everywhere else it is on, and you can turn it off at any time under Settings → Cloud and Data → “Help improve One Sheet”. Switching it off does two things: the App stops sending, and it asks our server to delete what it already holds for your installation. Totals we have already combined across everyone cannot be unpicked afterwards, because nothing in them points back to you. What it deletes includes the days you used the App and the history of your membership status. Records of which features were used on which day are deleted after 120 days in any case.

Reporting a problem. If you use Help → Report an issue, we receive what you type, the same device and build details above, which settings you have changed, a few size figures (such as how much memory the App was using), the feature counts described above, and a list of recent events inside the App recorded as numeric codes, for example “document opened” or “save failed”. Those codes cannot contain your content: there is no text field in them to put it in. You may optionally give us an email address so we can reply; leave it blank and we simply cannot. The App shows you the complete report before you send it. Reports are deleted after 180 days, or sooner if you ask.

10. The email list

When you first set up the App, the last step of the introduction offers to add you to our email list, so we can tell you when something new lands. It is optional and it is opt-in. Nothing is sent unless you type an address and tap “Join the list”; tapping “No thanks” sends nothing, stores nothing, and the introduction carries on exactly the same way. There is no pre-ticked box and no default.

What we receive, and nothing else: the email address you type, the first name you entered a few steps earlier, and, if you answered it, the path you chose when the introduction asked “What is your path?”: the one word you finally tapped, such as College, Entrepreneur, Writer, Explorer or Polymath (earlier versions of the App sent Student, Business, Writer, or “I will not be defined”). That is the whole of it: no device identifier, no usage identifier, no notification token, no location, and nothing about what you have written in the App. The address is held on our own list at onesheetofpaper.com and is used only to send you news about Paper Place. We do not sell it, share it, or pass it to advertisers or data brokers, and it is not joined to any of the identifiers described elsewhere in this policy.

Leaving. You can ask us to remove you at any time by writing to support@onesheetofpaper.com, and any email we send you will carry an unsubscribe link. Removal deletes the address and the name stored with it.

11. Purchases

The App offers optional auto-renewing subscriptions, sold and processed entirely by Apple through the App Store. We never see or receive your payment details. If you are signed in to an account when you buy, the purchase carries your account’s identifier (Apple calls it an app account token), and Apple’s server tells ours which Pass it is, whether it is active, and when it renews or ends, so your Pass follows you to your other devices. We still never see your payment details, your Apple Account or your card. To know which features to unlock, the App asks Apple on your device which subscription is currently active; that check does not send us your name, email address, or Apple Account. One identifier derived from an active subscription is used for usage metering, and is described in section 4.

12. Your account

Making an account is optional. You can make one at the end of the introduction or later in Settings, Account, or tap “Maybe later” and never make one. Your notes never need it.

What an account holds. Your first and last name; a username you choose (it must be unique); the email address you signed in with, or the private relay address Apple gives us if you chose Hide My Email; how you sign in (Sign in with Apple, email, or both); for each device you signed in on, the per-installation identifier described in Section 4, the kind of device and the App version; your Pass, whether it comes from an App Store purchase (the product, its status and its renewal or end date) or is a gift from us; gifts and messages we have sent you and whether you have opened or claimed them; and, if we ever had to, a note that the account was muted or suspended and why.

Sign in with Apple. Apple gives us an identifier that stays the same for you in this App, your name the first time only, and an email address, which may be Apple’s private relay. We also keep a token from Apple, encrypted, for one purpose: so that deleting your account can tell Apple to end the link.

Email sign-in. We email you a 6-digit code that works once, for ten minutes. We store only a keyed scramble of the code, never the code itself. To stop abuse we count attempts per address and per network, again stored only as keyed scrambles, never the address or IP address itself. The emails are sent for us by Resend, Inc.

Staying signed in. Your device keeps a random sign-in key in its Keychain; we store only a one-way scramble of it. It ends when you sign out, or after a year of not being used.

Where it lives. On our own server at Cloudflare (Cloudflare Workers and its D1 database), in North America. It is never sold, never used for advertising, never shared with data brokers, and never attached to AI requests.

Deleting your account. Settings, Account, Delete account. It deletes your account and every record that names it at once, and tells Apple to end the Sign in with Apple link. We keep only a count that a deletion happened and whether Apple’s link was ended, with nothing that says who. Your notes are not part of your account and stay on your devices. A Pass bought through the App Store keeps renewing until you cancel it in your Apple subscriptions.

Chat. Chat is for accounts only, and only for people 13 and older. If you use it, we handle: the lines you send (your words, or the number of a quick phrase), which chat they were in and when; your account identifier, your username and whether you have a Pass, so other people see your name next to your lines; the birth year you give once, before chat opens (the chat server is told only whether you are 13 or older); the people you block; and reports. A report holds your account, the line you reported, who wrote it and the reason you picked. People you mute are kept on your device only.

How chat is checked. Before a typed line is posted, it is checked against a word list and by an automated safety model that runs in our own Cloudflare account (Workers AI); the line is not sent to any other company for this, and we do not use chat lines to train any model. We read a line ourselves only when someone reports it. Everyone in a chat sees what you send there, with your username, so please keep anything private out of it.

Your chat profile. Tapping a name in chat shows that person’s profile: their username, whether they have a Pass, whether they hold the Founding Member award, four numbers from their scoreboard (strokes drawn, sheets made, days they opened the App, and their best streak) and the trophies they hold. While you use chat, the App sends those numbers, the names of your trophies and the Founding Member award to our server, at most once an hour, so your profile can show them to anyone signed in to chat. They are counts and award names only, never your notes.

Moderators. People we choose, and automated moderators we run on rules we set, help keep chat safe. They can hide a line, warn someone, mute an account in every chat, or hide an account from everyone else (nobody else sees that person or what they say, in chat or in the places people share, and they are not told), for a set time or until it is lifted. Every one of these actions is logged: who acted, to whom, where, when, for how long, the rule an automated moderator followed, and the line it was about. We review the log and can undo any action. A moderator’s view of a profile also shows whether that account is muted or hidden.

How long chat keeps things. Each chat keeps only its last 100 lines, and deletes any line older than 7 days (it checks every few hours); a line hidden after reports is kept for those same 7 days, for review. A report is kept until we have dealt with it, then 90 days more. The moderation log is kept 180 days. Lines sent while an account is hidden are never shown to anyone else, even after the hiding ends. Your birth year, your chat profile and the people you block stay with your account. Deleting your account removes every line you sent, every report you made or that names you, every block, your chat profile and every log entry about you, from every chat at once; an action you took as a moderator stays in the log under “a deleted account”.

Where it lives. Chat runs on our own server at Cloudflare (Cloudflare Workers and Durable Objects); blocks, reports, the birth year, your chat profile and the moderation log are kept with your account, as above. Like the rest of your account, none of it is sold, used for advertising, or attached to AI requests.

13. The website

The Site is a static informational site. It sets no cookies and runs no analytics or tracking. Our hosting provider may keep standard, short-lived server logs (IP address, request time, user agent) for security and operations, as is routine for any website.

14. Data retention & deletion

Because your content lives on your device and in your own iCloud, you are in control of it. Deleting a document, a recording, or the App itself removes the associated data from your device; iCloud copies are managed through your Apple account (Settings → iCloud → Manage Storage). Server-side we hold only: the notification device token described in Section 8, if you have notifications enabled; the feature counts and any issue report described in Section 9, unless you have switched those off; the transient processing described in Section 4; your first name and email address if you joined our list (Section 10); your account, if you made one, until you delete it (Section 12); if you use chat, your chat lines, reports, blocks, chat profile and the moderation log, for the times set out in Section 12; and any email you choose to send us (which we keep only as long as needed to help you). You can have the Section 9 data deleted at any time by switching that setting off, or by emailing us.

15. Your rights

Depending on where you live (for example, the EU/EEA, UK, or California), you may have rights to access, correct, delete, or port personal information, to object to or restrict processing, and to not be discriminated against for exercising those rights. Most of these rights are satisfied directly by you, through the App and your device. If you have an account, Settings, Account shows what it holds and deletes it; email us for a copy. For the rest, your data is already in your hands, and deleting it (Section 14) is deletion. For anything else, email support@onesheetofpaper.com and we will respond as required by applicable law. You may also lodge a complaint with your local data-protection authority.

California (CCPA/CPRA). We do not sell personal information or share it for cross-context behavioral advertising. The categories we collect are: user-provided content and audio transmitted at your direction for AI processing; identifiers (the opaque per-installation identifier described in Section 4, and the notification token in Section 8); account details if you made an account (name, username, account identifier and the email address you signed in with); if you use chat, the lines you post there, reports you make, people you block, your birth year, and what your chat profile shows (four scoreboard numbers and your trophies); commercial information (App Store purchases linked to an account); internet activity inherent in making network requests; usage data (the feature counts in Section 9); and contact information (your first name and email address) if you chose to join our email list, or an email address if you typed one into an issue report. We use them solely to provide and improve App functionality, and we do not sell or share any of them.

EU/EEA & UK (GDPR). Where the GDPR applies, our legal bases are performance of a contract (providing the App features you invoke, including AI processing of content you submit), legitimate interests (securing and operating our relay infrastructure), and consent for the feature counts in Section 9, which are off in the European Economic Area and the United Kingdom until you switch them on. You can withdraw that consent at any time by switching them off, which also asks our server to delete what it holds for your installation. We do not use your content for profiling or automated decisions with legal effect.

16. Security

All network communication uses encrypted transport (HTTPS/TLS), and AI requests are authenticated so that only the App can use our relay. No security measure is perfect, but we keep the risk small the simplest way we can: by holding as little as possible. Your notes never reach our servers, and an account keeps sign-in keys and codes only as one-way scrambles and Apple’s token only encrypted.

17. Children

The App is not directed at children under 13 (or the higher age of digital consent in your jurisdiction, such as 16 in parts of the EU), and we do not knowingly collect personal information from children. Chat, the one place in the App where people talk to each other, is closed to anyone under 13: the App asks for a birth year before chat opens and does not open it for a younger person. If you believe a child has provided personal information to us, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time. The current version always lives at this page, with the effective date below. Material changes will be highlighted in the App's release notes. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

19. No warranties; limitation

This policy describes our privacy practices; it does not create warranties, representations, or guarantees beyond those required by applicable law. To the maximum extent permitted by law, Society Rebel LLC's aggregate liability arising out of or relating to this policy is limited to the amount you paid for the App in the twelve months preceding the claim.

20. Governing law

This policy and any dispute relating to it are governed by the laws of the Commonwealth of Virginia, United States, without regard to conflict-of-laws principles, except where the law of your place of residence mandatorily applies.

21. Contact

Society Rebel LLC
237 Hanbury Road East, Suite 17 #267
Chesapeake, Virginia 23322
Email: support@onesheetofpaper.com
Web: societyrebel.com

Effective date: August 5, 2026 · Last updated: November 13, 2026