What we do with your mail,
in plain language.

Unpaper is operated by Aerolune LLC, a limited liability company registered in Georgia, United States. This policy covers unpaper.io, the Unpaper web app and the Unpaper mobile apps.

What we collect

Three kinds of information, treated very differently.

We never ask for your postal address, your date of birth, your government identification numbers or your bank details. If a letter you scan contains any of those, it is inside the locked copy and we cannot see it.

How a letter is read

This is where most apps go vague, so here is the actual sequence.

• The photograph is sent once, to be read. It travels over an encrypted connection and is held in memory for the seconds it takes. It is never written to a disk, a log or a queue.
• A language model reads it. Gemini 2.5 Flash, reached through OpenRouter, works out the sender, the amount, the due date, the category and whether the letter looks fraudulent. It runs under a zero retention agreement and your letters are never used to train anything.
• The details come back to your device. Nothing readable has been stored anywhere at this point.
• Your device locks it and only then uploads it. The photograph and the details are encrypted with your key before they are saved. What we hold is a locked copy.

Keys, and what happens if you lose yours

Your key is created on your device from your passkey or passcode. It is never sent to us. We hold a copy of your key that has itself been locked by that key, which is useless without you.

This has a consequence worth taking seriously. If you lose your passcode and your recovery phrase, your mail cannot be recovered. Not by you and not by us. We are not being unhelpful. We genuinely cannot. That is the same property that stops anyone else from reading your mail.

This is why we ask you to save a recovery phrase before your first scan, and why we will not let you skip it.

Reminders and notifications

We know when something of yours is due, because the date is the one thing our scheduler has to hold in the clear in order to fire on time. We do not know what it is.

Reminder emails and push notifications never contain an amount, a sender name, or anything read out of a letter. They say something needs you. You open the app to find out what. This matters most on a lock screen, which other people can see.

Sharing with your household

When you link accounts with a six letter invite code, shared mail is locked so that both of you can open it, and every item records who added it.

An item marked private is locked with your key alone. The other member of your household cannot open it. That is not a setting we enforce in the interface, it is a fact about the encryption, which means it holds against us too.

Medical and financial letters

People scan medical bills, insurance statements, tax notices and benefit letters. We assumed from the start that they would.

Aerolune LLC is not a healthcare provider, a health plan or a healthcare clearinghouse, so we are not a covered entity under HIPAA and Unpaper is not a HIPAA compliant service. What we do instead is hold this material in a form we cannot read, keep medical sender names out of every notification and email, and never use any of it for advertising or profiling.

Companies we rely on

Each receives only what it needs.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.

How long we keep things

Account deletion is in the app. It is not an email request, and we will not try to talk you out of it on the way through. Deleting your account destroys the locked copy of your key, which makes everything we hold permanently unreadable.

What you can ask us for

Wherever you live, you can do all of this yourself in the app, which is faster than writing to us.

• See it. Everything we hold about you is visible in your account.
• Take it. Export your whole inbox to CSV at any time.
• Fix it. Edit any detail read from a letter, or your account information.
• Delete it. Remove a single item or the whole account.
• Object. Turn off optional processing such as crash reporting.

If you are in the United Kingdom or the European Economic Area you may also complain to your local data protection authority. If you are in California you have the right to know, delete, correct and opt out, and we will not treat you differently for using any of them.

Our legal basis for handling your mail is the contract between us, because the service cannot work without it. For crash reporting it is our legitimate interest in the software working, and you can switch it off.

Children, changes and contact

Children. Unpaper is not intended for anyone under 16 and we do not knowingly collect information from them. If you believe a child has created an account, write to us and we will remove it.

Where your data lives. Our servers are in the United States. Using Unpaper from outside the United States means your information is handled there.

Changes. If we change this policy in a way that matters, we will email you before it takes effect rather than quietly updating the date at the top.

Contact. Write to privacy@unpaper.io. A person reads it, and we aim to answer within five working days.