How to choose a private on-device paperwork app

Trace the document from capture to deletion

Privacy claims are clearest when they describe the whole path. Ask where the image is staged, where text recognition and language processing happen, what extracted fields remain after the scan, and whether the image is uploaded, synced, or retained. “Private” is too broad if the product does not explain those boundaries.

Handled stages the scanned page locally for Apple’s on-device document and language-model processing. The extracted fields and scheduling identifiers remain in Handled’s local SwiftData store. Doxa Creative does not collect the scanned paperwork through the mobile app.

Separate product permissions from document processing

A paperwork app may need the camera to capture a page. It may also request Calendar, Reminders, or alarm access when you choose those destinations. Those permissions should have a visible purpose and should not all be required before the workflow needs them.

Handled requests permission only for a destination you select. It prepares the title, date, destination, and alert times first, then waits for you to confirm. The document-reading step does not grant the app permission to create a commitment automatically.

• Camera: needed when you capture a page.
• Reminders: needed only to create a confirmed Reminder.
• Calendar: needed only to create a confirmed event.
• Alarms: needed only for a confirmed commitment alarm.

Look for accounts, tracking, and third-party SDKs

An account can support sync, but it also changes the data path. Advertising and analytics SDKs can introduce additional collection even when document processing itself is local. Read the app’s privacy policy and App Store privacy information, then compare the language with the permissions and features you actually see.

Handled has no Doxa account, third-party advertising, or third-party analytics in the mobile app. StoreKit handles purchases through Apple. The Handled privacy policy distinguishes the iPhone app’s document workflow from the separate doxacreative.io marketing website.

Private processing still requires careful review

On-device processing changes where data travels; it does not make recognition infallible. Small type, folds, low contrast, unusual layouts, and relative dates can still produce uncertainty. A privacy-respecting tool should let you inspect and correct the result rather than presenting every field as certain.

Handled flags unclear details and keeps the person in the confirmation loop. If a date or amount cannot be established from the source page, do not schedule it. Rescan or verify it with the sender first.