Your data stays on your device

The short version

PaperPunch stores everything locally on your device using your browser's storage. No personal data is collected, no accounts are required, and nothing is sent to a server unless you explicitly enable cross-device sync.

When sync is enabled, your arrival time, breaks, and settings travel only between your own paired devices. No one else — including us — can access this data.

What's stored on your device

PaperPunch uses your browser's localStorage and, for the Chrome extension, chrome.storage.local. No cookies. The following data is stored locally:

• Your arrival time for the current day
• Breaks you've added (name and duration)
• Activity timers (task names and recorded seconds)
• Work history — a rolling archive of past days
• Settings: working days, daily hours, reduced-hours schedules, break presets, notification preferences
• A random device identifier (used only for sync pairing — never linked to your identity)

All of this data lives on your device. Closing the app, clearing browser data, or uninstalling the extension removes it permanently.

Optional sync between your own devices

Cross-device sync is entirely opt-in. If you choose to pair two devices (e.g. your phone and your desktop browser), the following data is sent to our sync server:

• Arrival time for the current day
• Breaks added or deleted
• Settings changes
• Activity snapshots (task names and durations)

This data is stored in a self-hosted Directus database and is readable only by devices you've explicitly paired. It is not shared with any third party, not used for analytics, and not retained beyond 14 days after it was created.

Unpairing your devices immediately removes the link. You can unpair at any time from Settings.

Anonymous usage analytics

PaperPunch uses PostHog to collect anonymous, aggregate usage events — things like "user added a break" or "user opened settings". These events help us understand which features are used and improve the product.

These events contain no personal information. They are not linked to any identity, email address, or device fingerprint. No session recordings or heatmaps are collected.

PostHog is configured with IP anonymisation enabled. Data is stored on PostHog's EU cloud infrastructure.

No third-party data sharing

PaperPunch does not sell, share, or transfer your data to any third party. The services involved are:

• Vercel — hosts the web app (paperpunch.app). No user data is retained by Vercel beyond standard server logs (IP address, request path, response time). Logs are purged automatically.
• PostHog — anonymous usage analytics only (see above).
• Directus (self-hosted) — sync data, only when you enable pairing.

No advertising networks, tracking pixels, or social media SDKs are included.

Deleting your data

Because PaperPunch stores data locally on your device, you can delete it at any time by:

• Clearing your browser's site data for paperpunch.app
• Uninstalling the Chrome extension
• Unpairing your devices from Settings (removes sync data from the server)

For any questions about your data or to request deletion of sync data from our server, contact hey@bilal.one.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date below and note the change. Since PaperPunch doesn't collect email addresses, we can't notify you directly — check this page if you're curious.