Effective 1 September 2026. penombra is a notebook you write in by hand, with a tutor in the margins. It runs on an iPad or an Android tablet. This page says what the app keeps, what leaves your device, and when.
What stays on your device
Your pages, the ink, the text, anything you bring in, are plain files in a folder on your device. On an iPad it is the app's own folder, which the Files app shows under On My iPad › penombra. On Android it is the folder you chose when the app first opened, and other apps can open it too. The app's own housekeeping lives in a hidden folder inside it, including a local record of each tutor turn: timing, counts, errors, and at times what the tutor said. That record never leaves the device.
If you enter an access code or an API key, it is stored in the app's own private storage, not in the notebook folder, so copying or sharing your notebook never carries it. Delete a page and it is gone. Delete the app and its private storage goes with it. On Android the notebook folder you chose stays, because it is yours.
What leaves your device, and when
Your pages never leave your device until you ask the tutor. One thing leaves earlier: when you enter a code on the first page, the app checks it with a one-word test message, the code and the word “hi”, never a page.
When you ask the tutor, the app sends the page you are on, an image of your ink with any file you brought onto it, together with the tutor's instructions, to the model provider.
- With a penombra access code, given to testers
- The request goes to penombra's relay, which forwards it to Anthropic under penombra's own account and returns the answer. The relay keeps a usage ledger: date and time, the code's name, the model, token counts, status and duration. It never keeps the content of pages or answers. Anthropic is the only party the relay passes anything to, and it handles what the relay forwards under its commercial terms, linked below, which give your pages the same or greater protection than this page promises.
- With your own API key and endpoint, set in the app's settings
- The request goes directly to that provider, under your own account and its terms. penombra has no server in that path and never sees your key, your pages, or the answers.
What penombra does not do
No accounts. No analytics, advertising or tracking, in the app or on this site. No third-party code that reports home. This site is a static page with no cookies and no scripts, hosted by Vercel, whose servers see page requests as any web host does.
Keeping and deleting
Everything in the app is on your device and yours to delete. Relay ledger rows exist to cap and account for tester usage; write to santiago@penombra.ai to have your code's rows deleted. What a model provider keeps of the requests you send is governed by that provider's terms. Anthropic's are at anthropic.com/legal/commercial-terms.
Withdrawing
Delete the app: its private storage and your code or key go with it, and on an iPad your pages too. The app asks nothing of you it does not need to draw your page and answer in its margin.
Contact
santiago@penombra.ai. Changes to this page are dated here.
1 September 2026, first version.