Privacy Policy

Analytics (optional)

If you accept cookies, we use Google Analytics (GA4) to understand how visitors use this site. This includes pages visited, time on site, device type, and approximate location (country/region level). Your IP address is anonymized. This data is processed by Google LLC and subject to Google's Privacy Policy. You can decline analytics cookies at any time using the banner or by clearing your browser's local storage.

Newsletter (if you subscribe)

If you submit your email address, it goes to Kit, the service that sends our newsletter (see below), and is used only to send you updates about Papyrium — new versions, announcements, and founding discount information. Kit first sends one email asking you to confirm; you are subscribed only after you confirm. Your email is never sold or shared with third parties for their own marketing. Kit records which page you subscribed from, whether our emails are opened, and which links are clicked. This tells us what subscribers find useful. You can unsubscribe at any time via the link in any email we send.

Feedback and support emails

If you email us feedback or a support request, we process your email address and the contents of your message so we can respond, troubleshoot issues, and improve Papyrium. If you write from the app (Help → Report a Bug…), the email is pre-filled with your Papyrium and macOS versions. Logs saved with Help → Export Logs… hide your macOS user name but keep library folder paths and file names, because they are needed for diagnostics; attach them only if you are comfortable sharing them.

How the app processes your books

To show covers, display metadata, and power search (and, in future, optional AI features), Papyrium processes the books you add directly on your device. Derived data — extracted text, cover images, metadata, and search indexes — is stored locally alongside your library and is not sent anywhere unless you enable an optional feature that sends data.

Usage analytics (optional, off by default)

The app includes optional usage analytics that are turned off by default. You are asked during first-run setup, and you can turn analytics on or off at any time in Settings → General. When enabled, the app uses PostHog (EU region) to record how features are used:

• app launches and how long the app stays open, the approximate size of your library, and whether you use grid or table view;
• reading sessions (book format and approximate duration) and when you add a highlight, note, or bookmark;
• searches — the kind of search and an approximate number of results, not what you searched for;
• library actions such as connecting folders, importing books (file counts and formats), creating collections, applying tags or categories, linking editions, and reviewing duplicates, with the number of books involved;
• first-run setup steps and which settings sections you save;
• the local MCP server: when it starts or its settings change, when a client connects, and which tools a client calls (tool name, whether it succeeded, how long it took, and the name the client reports);
• error codes when something fails, without error messages.

Each event comes with basic device information: operating system and version, device type, time zone, and the country from your system's region setting. PostHog receives your IP address with each request, as any server does, but is set to discard it rather than store it. The event sent when the app opens your library also includes your system language, and the setup events include the language you pick during setup. Each event also carries two random identifiers: one for your installation of Papyrium, so events can be counted per installation and we can see how usage changes over time, and one for the current launch, which is new every time the app starts and is never saved. The installation identifier is created on your device when you turn analytics on and stays the same across launches. It is not linked to your name, email address, or any account, but because it persists, it counts as personal data under the GDPR. When you turn analytics off, it is deleted from your device; if you turn analytics on again later, a new one is created.

What analytics never include

Analytics never include your book files, book content, titles, notes, highlights, tag or collection names, file names, file paths, what you search for, error messages, or any other library contents. No account is required, and the data is not linked to your identity or your library content.

Connected AI clients — MCP (optional, off by default)

Papyrium can run a local MCP (Model Context Protocol) server so that AI applications you choose to connect — for example, Claude or other MCP-compatible clients — can work with your library. The server runs on your device and is off by default. Connected clients can read library metadata, file paths, annotations, highlights, notes, and bookmarks — not the full text of your books — and write access is a separate opt-in. Papyrium itself does not send this data anywhere: a connected client decides what it reads and may send it to its own AI provider under that provider's terms, so review the privacy terms of any client you connect.

Update checks

The app checks for new releases at update.papyriumlib.com, which is hosted by Netlify and forwards the request to GitHub, where the update files are stored. When an update is available, the app downloads it the same way and installs it when you restart or quit the app. Like any network request, these include your IP address and standard technical information (app version, platform) — never any library content. You can turn off automatic checks and installs with Automatic updates in Settings → General.

Optional features that send data

Some optional integrations are off until you enable them and may send data outside your device. For example, a connected MCP client controls what it sends to its model and AI provider. Any feature that sends your data to us or to a third party is opt-in, indicated in the app, and documented in this policy before it processes your data.