Clear boundaries before you stash a paper.

Early-access signup

If you join the list, we store your normalized email address, the consent wording version, consent and record timestamps, and the source “marketing site.” We also keep a one-way hourly abuse-limiting hash for up to 48 hours; we do not store the raw network address in the waitlist database.

We use the email only for MyPaperStash private-beta access and related launch messages. We do not use it for advertising profiles. You may unsubscribe or ask us to delete your waitlist record at privacy@mypaperstash.com.

What the private beta is designed to store

When the vault opens, account and session identifiers, encrypted original documents, titles and categories, OCR text, extracted facts with source locations, corrections, reminders, storage usage, device sessions, audit records and export/deletion state may be processed to provide the service. Important papers can contain financial, identity, health, property and family information, so document content is treated as highly sensitive.

Encryption and service access

Transport and stored data are designed to be encrypted. The beta uses service-managed envelope encryption so narrowly authorized MyPaperStash processing can decrypt a document for retrieval, malware scanning, preview generation, OCR and requested export. This is not end-to-end encryption, and we do not claim the service is technically unable to access papers. Decrypt permissions, processing workers and operational access are intended to be isolated, least-privilege and audited.

Document intelligence and AI

The current implementation performs OCR and deterministic extraction in controlled workers. Extracted details keep confidence and page-level provenance, can be corrected, and never overwrite the original. Document content is not authorized for advertising, general product analytics or training general-purpose AI models. Any external OCR or AI processor would require privacy and security approval and must be named here before production papers are sent to it.

Retention, export and deletion

• Documents moved to Trash are designed for a visible recovery period before approved permanent deletion.
• Complete exports include retained originals plus portable metadata; generated export archives expire after seven days.
• An account-deletion request has a 30-day cancellable grace period.
• Irreversible account erasure is not active yet. It will remain disabled until original, preview, OCR, search, reminder, export, session, identity and backup deletion is approved and restore/purge drills pass.
• The final Trash period and encrypted-backup ciphertext expiry are not yet approved. They must be stated here before the vault accepts beta documents.

Service providers and locations

The production identity, database, private object storage, key-management and hosting providers and processing regions are still being selected. A named subprocessor list—including purpose, data categories, region and change process—will be published before the document beta opens. Until that list and the corresponding contracts are approved, production document processing is a launch blocker.

Your controls

The implemented clients provide document download, complete account export, signed-in device removal, Trash and restore, and account-deletion request/cancellation. Access to each paper and operation is owner-scoped. Some sensitive actions require a recent sign-in. Final rights, appeal and complaint language depends on the launch operator and markets and will be added to the formal privacy policy before beta acceptance.