Paper Cup connects one child's device to one parent's iPhone. It's an independent project run from the UK, currently being tested with a few families. This page explains what it stores, what it can't see, and how to remove your data.
Messages are end-to-end encrypted
Messages are encrypted on the device that sends them and can only be decrypted by the paired device that receives them. Our relay passes them along without being able to read them. We never have the keys.
What the relay stores
- The child's device: its public keys, generated on the device itself, and when it was last online.
- The pairing: the parent phone's public key and a hashed copy of its sign-in token.
- Messages: encrypted, with the times they were sent, delivered and read. They're deleted after 30 days.
- Control messages, such as reactions, quick replies, quiet hours, device status and ringing the device, are encrypted too, and deleted once delivered or after 30 days.
- Notifications: the parent phone's Apple push token, so we can tell it a message has arrived.
- Settings: if you turn on the offline alert, how long the device must be offline before we notify you, and when we last did.
We don't collect names, email addresses, phone numbers or contacts. The child's name you type into the app stays on your phone.
Location
If the child's device can find its location, it can attach it to a message. The location is encrypted with the message, so only the paired phone can see it. To show a street name, the app asks Apple's map service on your phone. You can turn that off in the app's settings.
Notifications
Apple delivers notifications to the parent's phone. A notification contains no readable message text: the phone fetches the encrypted message and decrypts it itself. With the app's Face ID lock on, notifications just say "New message".
Network data
The relay runs on Cloudflare. Like any website, it sees your IP address when you connect. We use it briefly to limit repeated or abusive requests and don't keep it. It can also see when messages are sent and when a device is online, and roughly how large messages are, but never what they say. Our logs record only technical details such as message sizes and error codes, never message content. Checks for device software updates don't identify the device.
Who else is involved
- Cloudflare hosts the relay and this website.
- Apple delivers notifications, provides street names, and runs TestFlight, which testers use to install the app. Apple's own privacy policy covers those services.
There are no adverts, no analytics and no tracking, in the app or on this website. This site sets no cookies and loads nothing from other websites. Cloudflare keeps aggregate traffic statistics for this website, such as request counts and countries, as part of serving it.
Children
Paper Cup is made for children to use with a parent. The device can only talk to the one phone it's paired with, and it has no browser, apps or way to add contacts.
Removing your data
Unpairing in the app deletes the pairing, its messages and the push token from the relay straight away. A device that stays unpaired and unused is erased after 7 days.
Under UK data protection law you have rights over your data, including access and deletion. Because we hold no names or contact details, we usually can't tell whose data is whose, so unpairing is the quickest route. For anything else, email hello@papercup.app. You can also complain to the Information Commissioner's Office.
Changes
If this policy changes, we'll update this page and the date at the top. Testers will be told about any significant change.