Operator and contact
Penori is operated by Oleh Blokitin. For privacy questions, support or help with your data, email oleh.blokitin@gmail.com. You can also open Settings → Help & feedback in the app. This support address is separate from the recipient address you choose for a learner's PDF emails.
On-device practice
Penori prepares printable handwriting practice. Profile names or nicknames, writing preferences, pasted text, saved worksheet records and book positions are stored on your device. Device backups may include them. You may use a nickname. Practice stays on your device unless you choose to share a PDF, use the work photo account archive, enable optional email delivery or request optional AI writing. There is no automatic photo grading, third-party advertising, tracking or third-party product analytics in the current interface. Printed pages include Penori branding.
Apple Pencil writing on a shared iPad
Editable Apple Pencil strokes and their page settings are saved locally on the shared iPad. They do not automatically sync to another device and are not sent to the work photo archive as editable strokes. Finishing practice creates page images attached to the lesson. If the lesson is connected to a work photo account, those images and optional manual reviews use the storage described below. Parent marks can be saved as a separate image while keeping the original submitted image. Returning a page for rewriting changes the local editable copy on that same iPad; it does not email or transfer editable strokes to another device.
Books and PDFs
Books and font resources are included with the app. Generating a PDF does not send your writing text to an AI service. The included editions have source and rights information. The Bible collection uses the American Standard Version of 1901. Parents and adult learners select suitable material.
Optional manual feedback
Parents and adult learners can record grades, practice dates, observed effort, handwriting checklist ratings and notes for a saved work. These are your own assessments, stored locally with the profile and included in device backups where enabled. For profiles connected to a work photo account, lesson records and manual reviews are also saved on Penori's server for restoration. Penori does not assign grades, convert grade systems or automatically assess handwriting. Reviews are not included in emailed PDFs or sent to AI services. Remove a review from its practice details, or delete the profile to remove its work and server archive. Saving photos or grades does not advance a book or mark a lesson complete.
Optional saved work photos
Work photos are stored in a confirmed email account. Penori can reuse the confirmed PDF delivery account for a profile, or use a separately signed-in work photo account. The photo account can differ from the recipient of lesson PDFs. You can take a photo with the camera or select images using the system Photos picker and save them with a particular lesson. Camera access is requested only when you choose Take photo. The Photos picker shares only the images you select. Penori creates JPEG viewing copies up to 3200 pixels on their longest side and small previews; originals in Photos are not changed. Photos, previews, learner details, lesson text and manual feedback are sent over HTTPS to Penori's server and stored in its database with authenticated encryption at rest, scoped to your signed-in account. Local protected viewing copies may be included in device backups. These photos are not analysed, attached to email PDFs, sent through Resend or sent to AI services.
Photos and grades waiting to upload are not backed up on the server yet. The app retries pending app uploads and checks for new submissions when the profile or its work photos are opened with an active account connection. Pull down to refresh. It does not promise background completion after the app is closed. Server-accepted photos stay until you delete them, their profile archive or the account. Storage limits can prevent new uploads. You can keep photos without a grade and review the lesson later. Restore saved work downloads the archive after signing in on another device; it is an explicit restoration action rather than continuous cross-device live sync. Saving a photo does not confirm completion.
Deleting a photo in its viewer removes the server copy and this device's copy while keeping the PDF, grade and original in Photos. Other devices' cached copies update when the archive is restored. Deleting a connected profile requires access to its account and removes its server archive before local removal. Deleting the account removes both its photo archive and any PDF email data associated with the same account, while keeping local work and delivered inbox copies. Minimal deletion identifiers are retained to prevent stale uploads from restoring deleted photos or profiles. Separate account-deletion restore journals and backups may have separate retention. Signing out keeps server records and local copies. A lesson email can include a private Send work photos link. Anyone with that link can see the lesson title and add photos to that lesson without signing in; they cannot read the archive or its photos. Keep the link private. Forwarding the email shares that upload ability. Links expire after 180 days; deleting the lesson archive, profile archive or account disables its links. The server may renew a link for scheduled mail while that routine remains authorised.
Apple purchases
Apple processes subscriptions and payments. Penori uses StoreKit to verify current Apple purchase entitlements on your device. A Penori account or email address is not required. We do not receive your payment-card number, Apple Account password or practice text through the purchase flow. Apple handles purchase information under its own privacy terms. Restore purchases explicitly requests synchronisation with Apple.
Optional PDF email delivery
Each profile can have a recipient email address you choose. You can open an email draft or share the current PDF using another app without creating a Penori email account. Those apps and their providers handle the message under their own terms.
When the direct email service is configured, confirm your address using a one-time code before sending. This creates an optional email delivery account; it is not required for generating PDFs or Apple purchases. Penori sends the confirmed address, current PDF and its title to its mail server and uses Resend to send the email. PDF contents may include names or text you included. Do not include sensitive information. The app stores its email session token in the device Keychain.
Automatic delivery is off by default. If enabled for a profile, creating and saving a new PDF queues that PDF for the confirmed address. Reopening an existing PDF does not send it again. Turning automatic delivery off does not recall a message already queued. Unsent PDFs are held in an encrypted server queue for up to 23 hours and their queue payload is cleared after sending or expiry. Delivery metadata is retained for up to 30 days; the email account remains until deleted. Provider processing, sent emails and backups may have separate retention. A provider-accepted or delivered status does not establish that a person read the message.
Practice routines are optional and off by default. Local reminders require notification permission on your device. If you enable scheduled PDF email, Penori stores your chosen weekdays, local time, time zone and one current PDF in encrypted server storage until you turn scheduled email off or delete the email account. The server sends that same current task on the selected days even while the app is closed. Preparing a new PDF replaces the scheduled task; the server does not automatically advance the book. Save the routine after changing or disabling it. If an update cannot reach the server, the app reports that the previous schedule may still be active. An email already being sent cannot be recalled. Deleting a local profile first stops its email routine but keeps the separate email account.
Optional AI writing
When connected, Premium and Family can generate original practice texts. Before each generation session, the app asks you to allow sending the chosen mood, theme, format, reader group, vocabulary level, length and any optional instructions to OpenAI through Penori's server. Names, exact ages, previous writing and book positions are not automatically included. Avoid personal or sensitive information in instructions. The model is GPT-6 Sol. Generating a PDF from an existing text is a local operation and does not call OpenAI.
Penori sends a signed Apple subscription transaction to its own server to verify paid access with Apple. The server derives a pseudonymous subscription identifier for the shared monthly allowance. This identifier and the Apple proof are not sent to OpenAI. The original Apple proof is not retained in the AI request table. Usage records contain request identifiers, hashes, timestamps and status, and are retained for up to 40 days. An encrypted recovery copy of a successful text is available for 24 hours to prevent duplicate charges after interrupted connections; the running retention worker clears it after expiry. Provider records and backups may have separate retention. Saved texts and edits remain on your device until you delete them or their profile.
OpenAI requests use store=false. This does not mean zero provider retention: OpenAI may retain abuse-monitoring logs for up to 30 days, subject to its published data controls and applicable exceptions. See https://developers.openai.com/api/docs/guides/your-data. The app does not claim that generated material is always accurate, unique or appropriate; parents and adult learners review it before printing. Deleting a local text does not restore a used generation or immediately remove its temporary server recovery copy.
Sharing and support
PDFs can be shared to destinations you choose using the system share sheet. Recipients and storage services you choose may retain copies. The in-app Report a problem form sends the message you type, an optional reply email, and app/device software versions to Penori's support service. Your children's names, writing and photos are not attached automatically. If offline, a protected local outbox retries while Penori is open. A received confirmation means the server has accepted the message. An operator notification is delivered through Resend and includes the support message you choose to send. The message and technical stack are also kept in encrypted server storage. Technical stack frames are not copied into the notification. If you provide a reply email, it is included as the notification's Reply-To address.
Technical error reports
Penori sends technical error and crash reports to help repair the app: error type and code, affected operation, app build and OS version, device platform (iPhone or iPad), and a technical call stack. Automatic reports do not include account IDs, profile names, worksheet contents, photographs, credentials or advertising identifiers. They are not used for advertising or tracking and are not linked to your Penori account. iOS controls when crash diagnostics become available; immediate reporting of every crash is not guaranteed. You can turn off automatic reports in Report a problem. Repeated incidents are grouped to avoid repeated notification emails. Reports and support messages are retained for up to 90 days; opaque incident fingerprints and aggregate counts can remain to prevent duplicate alerts. The service uses temporary one-way network-address keys for abuse prevention. No raw network address is stored in the diagnostics database; hosting providers may process connection metadata in operating their services. Sent notification emails can remain in the operator's mailbox. Contact support to request deletion of an identifiable support request.
Your control
Open a profile, then its menu, to delete that profile and its saved local work after confirmation. Exported PDFs and copies in device backups or other apps are not recalled by this action. Email delivery settings include a separate, confirmed action to delete the server email account and its server data. This affects other profiles connected to that same email account. Delivered inbox copies are not recalled. Deleting only a local profile does not delete the server email account or recall queued messages. Deleting profiles or uninstalling Penori does not cancel an Apple subscription. Manage subscriptions through Apple's subscription settings. Book positions and profile data are not automatically synchronised between devices.
Earlier experimental versions
Previously stored local course records or photos may remain on an upgraded device. This version does not submit them for grading or upload them. Deleting the associated local profile removes its local saved work. If you previously created an experimental server email account, its server data and delivered emails are separate from local data; contact support about those records. This version does not claim to have deleted existing server data.
Children
This is a parent-operated tool and also supports adult learners. It does not offer child-operated public accounts, public uploads, messaging or social profiles. A child can use a private lesson upload page with parental permission. The page requests camera access only when the child chooses to take a photo, or accepts selected image files. Images are converted to JPEG viewing copies in the browser before being sent over HTTPS to the associated account. The upload page does not provide public browsing, messaging, automatic grading or completion checks. Parents should choose appropriate excerpts and avoid pasting sensitive personal information. The included source editions were selected for United States rights scope; rights may differ in other countries. Contact Oleh Blokitin at oleh.blokitin@gmail.com with a question about a child's data or to request help deleting it.