Skip to main content
Security & Governance

Privacy & Security Posture

Papia Studio is built on a local-first foundation. Your documents, custom dictionaries, and translation memories remain stored strictly inside your browser. We do not track your activity, sell your data, or store your text on central application servers.

Local-First Storage

All document drafts, bundles, and user collections are persisted in your browser's IndexedDB or local filesystem directory handle. No content is synced to remote databases without your action.

BYOK (Bring Your Own Key)

AI requests for translation and proofreading are relayed by a Papia Studio API route to the provider you chose (Gemini, Anthropic, OpenAI). Your key is stored in your browser's local storage, forwarded in-request, and never persisted on our servers.

No Content Analytics

We do not track document content, keystrokes, or user behavior analytics. Optional sign-in uses Clerk, with its client-side telemetry disabled.

1. Local Storage Architecture

When you edit documents in Skrebe, manage vocabulary in the Workbench, or import glossary presets, all storage operations write to standard Web APIs (IndexedDB via Dexie.js or File System Access API handles). Your work remains strictly under your control on your machine.

2. AI Model Provider Connections

When you invoke AI translation or proofreading, the text you selected is sent to a Papia Studio API route, which forwards it to your chosen provider's official endpoint and returns the result. Your API key rides along on that same request so the server can authenticate as you. Neither your document text nor your key is persisted on our servers — they exist only for the duration of the request. Please refer to your respective provider's privacy policy (e.g., Google Cloud Vertex/Gemini Privacy, Anthropic Commercial Privacy) for details on their data processing standards.

3. API Key Storage

Your API key is saved in your browser's local storage on the device where you entered it. It is not encrypted at rest, so anyone with access to your browser profile can read it — prefer a scoped, revocable key, and remove it from Settings when working on a shared machine. Clearing your browser data deletes it.

4. Account & Authentication

Optional sign-in features use Clerk for session management. Clerk processes authentication tokens required for identity verification. We disable Clerk's client-side telemetry; Clerk's own server-side SDK may still report anonymous usage metrics to Clerk, governed by their privacy policy.

5. Data Control & Right to Erasure

Because your data is stored locally, you maintain complete ownership. You can export your dictionaries, download document bundles as standard Markdown/JSON, or clear your browser data at any time to instantly erase all local state.

6. Open Source Transparency

Papia Studio is open source software. You can inspect our security model, dependency chain, and codebase on GitHub.

← Back to Papia Studio