Legal

Privacy Policy

Colophon processes your documents on your device. Opening, editing, redacting, signing, scanning, searching, and asking questions of your library all run locally on your iPhone, iPad, or Mac. None of it is uploaded to a Colophon server, because Colophon doesn't have one. Two narrow, optional paths can touch the network — iCloud sharing, and a trusted-timestamp request when you digitally sign — and both are described below; neither sends the document's contents.

What we collect

Nothing. Colophon ships a Privacy Manifest (PrivacyInfo.xcprivacy) declaring no developer data collection, no tracking, and no linkage to a tracking domain. There are no accounts, no analytics SDKs, and no crash-reporting service that phones home with your data.

iCloud sharing, and only if you ask

A document stays local unless you explicitly choose Share… and invite a collaborator over iCloud. Only that single file, never your whole library, moves into your own iCloud Drive, under your own Apple Account. It is not a Colophon server; Apple hosts it the same way it hosts any file you put in iCloud Drive. You can stop sharing at any time, which returns the file to local-only storage on your device.

Trusted timestamps when you sign

When you add a digital signature, Colophon can bind a trusted time to it by requesting a timestamp from a timestamping authority — a standard internet service (freeTSA.org by default) contacted over HTTPS. Only a cryptographic hash of the signature is sent, never the document or its contents, and the request is best-effort: offline, the signature still applies, just without a trusted time. Nothing is sent unless you sign.

Apple Intelligence stays on-device

Search, retrieval, and chat answers are generated by Apple's on-device Foundation Models framework. Your questions, your document text, and the generated answers never leave the device, because there is no server-side model call to send any of it to.

No third-party services

Colophon has no analytics vendor, no advertising network, and no third-party crash reporter. The website you're reading this on follows the same rule, making no requests to any third-party domain: no font CDN, no analytics script, no embedded tracker.

Note

Colophon is pre-release. This policy describes the app's behavior today and will be finalized to reflect the shipping App Store version at launch.

Questions

Reach us at pdf-colophon+support@erichchampion.com.