Privacy Policy

Pilebert

This privacy policy applies to Pilebert, including the web app and the macOS client.

End-to-end encryption

Every Pilebert workspace is end-to-end encrypted. Your documents, their previews, titles, summaries and other details, and your tag and folder names are encrypted on your device before they are uploaded, with keys that only you and the members you invite hold. Pilebert stores the encrypted data but cannot read it, and cannot recover it if you lose both your encryption passphrase and your recovery code: neither ever leaves your device.

What the server can see

To run the service, Pilebert can see: your email address; the names of your workspaces; who belongs to which workspace; how many documents, tags and folders a workspace has; the approximate size of each encrypted file (sizes are rounded up to hide exact lengths); when files were uploaded or changed; and when you use the service. To stop you from uploading the same file twice, Pilebert can also tell when two uploads to the same workspace are identical, without learning what they contain.

Local document processing

Text recognition, classification, tagging suggestions and the extraction of titles, dates and amounts run entirely on your Mac, with AI models that ship inside the app. Neither your documents nor the extracted text are sent to any AI provider for this.

So that you can search inside your documents, the words recognised in a document are stored with it, encrypted on your device in the same way as the document itself. We cannot read them. Searching happens in your browser or on your Mac: your search terms are never sent to us.

Web app and macOS app

The web app decrypts your documents in your browser using code that Pilebert serves each time you open it, so using it means trusting that this code is genuine. The macOS app is installed once and signed, which makes it the higher-assurance way to use Pilebert.

Cloud storage and infrastructure

Encrypted files and the data listed above are stored with infrastructure providers: Supabase (database and sign-in), Cloudflare R2 (encrypted files) and Vercel (web app hosting). Data is transmitted over encrypted connections.

Billing

Subscriptions and in-app purchases may be handled through Apple and RevenueCat. We do not receive your full payment card details.

Deleting documents

A document you move to the trash stays there for 30 days, so it can be restored, and is then deleted for good, with its stored file. An owner of the space can empty the trash or delete a document from it at any time.

Account deletion

You can request deletion of your Pilebert account from inside the application. Deleting an account removes associated app data and access, subject to any technical, contractual, or legal retention requirements.

Server logs

When you use the web app, technical server logs may be processed automatically, for example request time, route, response status, and related operational metadata. These logs are used for reliability, abuse prevention, and security.

Gmail import

If you connect Gmail in the macOS app, the app reads your mail directly from Google with read-only access and keeps the access token in your Mac's keychain. Messages and tokens are never sent to Pilebert; Pilebert only stores when the app last checked and which messages you chose to skip. Attachments you import are encrypted like any other document.

Your rights

If you are located in a jurisdiction that grants privacy rights, including under the GDPR, you may have the right to request access, correction, deletion, restriction, or portability of your personal data, subject to applicable law.

Because we cannot read your documents, we cannot hand you a copy of them either: you take them with you yourself. “Export space” (in the account menu on the web, and under File in the Mac app) decrypts every document of a space on your device and saves the original files, in their folders, together with a table of their details.

Contact

For privacy-related questions, please use the contact details listed in the imprint.