Penombre privacy.

What this covers

Penombre is free, self-hosted software: the server and web app, the Android and iOS apps, the desktop sync app, and the MCP server built into every instance (what Claude and other AI clients connect to). There is no hosted version, no account with me, no ads and no analytics.

Who is responsible

Whoever runs a Penombre instance decides what it stores and who can reach it, so under the GDPR they are the data controller for it. If that’s your own server, that’s you. If someone else gave you an account, ask them about your data: I have no access to their server.

I write the software. For questions about what it does with data, email orochibraru@gmail.com.

What stays on your server

• your files, their versions (10 per file by default) and the trash, until you empty it
• your account: name, email, profile picture, password hash, passkeys, two-factor secrets and API keys
• sessions, with the IP address and browser they were opened from
• share links, with their optional password hash, expiry and download count; signature requests record each signer’s IP address in the signed document
• an activity log, notifications and background jobs

The activity log, notifications and finished jobs are kept until the admin sets a retention period, after which older rows are deleted every night. Deleting your account deletes what is tied to it. File contents can be encrypted at rest if the admin turns it on.

What leaves your server

• Update check: the server asks GitHub for the latest Penombre release, at most once an hour. GitHub sees the server’s IP address, nothing else. Admins can turn it off.
• Desktop app updates: released builds check GitHub for a new version every six hours. GitHub sees your IP address.
• Android scanning: QR codes and document scans use Google Play services, which Google covers in its own privacy policy.
• What the admin connects: single sign-on providers and the mail server for emails, if configured.

No telemetry, no crash reporting to anyone, no fonts or scripts from a CDN, no push service in the middle: the apps ask your server for notifications directly. Errors in the web app are sent to your own server’s log, nowhere else.

Claude and other AI clients

Connecting an AI client signs it in to your instance with OAuth: you approve it on a consent page of your own server, which then gives it an API key named after the client. That key acts as you, sees what you see, and lasts until you revoke it under Settings → API keys.

Through it, the client can list, search, read, write, move and trash your files, and get download and upload links that work for 15 minutes. Whatever it reads goes to the AI provider and is then covered by their privacy policy (for Claude, Anthropic’s). Nothing goes through me.

Your device

The web app sets a session cookie to keep you signed in, a language cookie, and a 12-hour cookie when you unlock a password-protected share. It keeps your sort order, editor mode, language, last sign-in email and pending uploads in your browser’s storage.

The iOS app asks for the camera to scan documents and codes; the Android app hands that to the system camera and asks only to show notifications. Neither tracks you or reads your location or contacts. The desktop app keeps its key in your system keychain.

Your rights

Under the GDPR you can ask to access, correct, delete or restrict your data, or object to how it is used. Ask the person who runs your instance: they hold the data. You can delete your own account from its settings. You can also complain to your data protection authority (in France, the CNIL).

Changes

If what Penombre collects or sends changes, this page changes with it, and the date at the top gets updated.