Privacy notice
We ask for one small thing at a time, at the moment it becomes useful to you, and never as a wall in front of the work. This page says what each of those moments collects, why we are allowed to, and how long it lasts.
What is collected, and when
Read this as a sequence. Most people never pass the second row, and everything in the second row works without an account.
| The moment | What is collected | Why we may |
|---|---|---|
| You arrive and read | Nothing you typed. A first-party session cookie so the site can tell one visitor from another, and a note that a page was opened. | Legitimate interest in running the site and knowing which parts of it are used. No advertising, no profiling, no third-party analytics. |
| You check a paper, as a guest | The file you upload, the audit result, and a note that an audit finished. | Legitimate interest, and your own request. The upload is the thing you came for; we cannot do it without the file. |
| You try an audit without a licence | A one-way salted hash of your network address, and the fact that a trial audit ran. Never the address itself. | Legitimate interest in a licensed product not being used without a licence. It is the only thing on this page that is not something you typed or asked for, so it has a section of its own below. |
| You want to keep the work, or come back to it | Your email address, and the exact wording of what you were shown when you gave it. | Consent, recorded with the wording and the time. The record of what you agreed to is kept as a legal obligation. |
| You export a record | Your name and your role: student, researcher or reviewer. | Consent. It is asked here because a record that goes to somebody else should say who wrote it. |
| You invite a reviewer or a supervisor | Their email address, and your institution if you choose to give it. | Consent for yours. The invitation to them is a single transactional message, and their address is used for nothing else. |
| You sign in | A single-use sign-in token that expires in 30 minutes, and the fact that the message was delivered or was not. | Contract: we cannot give you an account without it. |
Declining costs you nothing that is already on screen. If you say no at any of these moments, the audit you are reading stays where it is and the work you have done stays done. A refusal is never used to take something back.
The trial, and the one thing it stores about your connection
PaperAlly is licensed software with a small trial in front of it: the audit is free to try, and the working product needs a licence. Counting a trial means recognising somebody who has already had one, and that is the only reason anything about your connection is stored at all.
| The question | The answer |
|---|---|
| What is stored | A one-way salted hash of your network address, and nothing else about it. The address itself is never written down: not in the database, not in a log, not anywhere. |
| What it is for | Counting the two trial audits, so that a licensed product is not used without a licence. It is used for that and for nothing else. It is never used to work out who you are, where you are, or what you looked at. |
| The lawful basis | Legitimate interest, and here is the balancing in one sentence: a trial cannot exist at all without recognising a repeat visitor somehow, and a salted hash is the least we can hold in order to do it, since it names nobody and reveals nothing about you. |
| How long it is kept | 30 days, then it is deleted. The count runs over the same 30 days, so a spent trial comes back rather than standing against you for good. |
| Can it be turned back into an address | No. It is a SHA-256 hash taken with this application's own secret, so it is useless to anyone who takes a copy of the table, and it matches nothing in any other system, ours included. There is no lookup that turns it back. |
| If you would rather we did not | You are entitled to object to anything that rests on legitimate interest, and this does. Ask us and we will delete the row. That is the whole procedure. There is no form and no reason to give. |
Worth saying alongside it: the trial limits how many audits you get and never what an audit tells you. A trial audit returns the whole, correct result, because a product whose point is a record you can trust cannot hold part of one back to make a sale.
What is never done with it
Not sold
Your data is not sold, rented or shared with an advertising network. There is no advertising network involved in this site at all.
Not trained on
Your manuscript is not used to train a model. The passage you choose to send to an assistant goes under paid terms that forbid training on it and forbid human review of it.
Not reported on you
No institution is given a window into your work. A record goes to somebody when you send it to them, and not before.
Where it is, and who else touches it
The application, the database and your uploaded files are hosted in the United Kingdom. When you ask an assistant for something, that one passage is sent to a model provider whose inference happens outside the UK, on paid terms under which your content is not used to train or improve its products, and the run record shows what was sent and when. The full list, with what limits each of them, is on the trust page.
How long it is kept
| What | Kept for |
|---|---|
| Work done without an account, with its uploads and run records | 30 days from the last time you touch it, then deleted automatically |
| Work inside an account | Until you delete it, with a 30-day undo window |
| Consent records | Six years after the relationship ends, as proof of what you were shown |
| The trial count: a salted hash of a network address, never the address | 30 days, then deleted |
| The mail log | 90 days |
| Funnel events | 12 months, then reduced to counts and deleted |
Funnel events are small and typed: which kind of moment it was and when. They never carry text you typed.
Cookies and what is stored in your browser
One session cookie, which is what lets the site keep your work together across pages. It is first-party, it rolls for 30 days, and it is essential rather than optional. Your light or dark preference is stored in your own browser and never sent to us. There is no third-party cookie, no tracking pixel and no analytics script on this site.
Your rights
See it
Ask for a copy of everything held about you. There is a button for it in settings and it needs no support request.
Correct it
Anything wrong in your profile or your records can be put right in the product.
Delete it
Erasure is requested in settings, confirmed by a fresh link, held for seven days in case you change your mind, and ends in a certificate that says what was deleted.
Take it elsewhere
Your delegation record is the portability surface. It is a structured, machine-readable file and it is designed to be handed to somebody else.
Restrict or object
You can ask us to stop a particular use while a question is open, or object to a use that rests on legitimate interest.
Withdraw consent
At any moment, for any purpose you consented to, without losing the work already on your screen. That is a design rule here, not a courtesy.
We aim to answer in minutes where the product can do it itself, and the legal backstop is one calendar month. If you are not satisfied with how a request was handled you can complain to the Information Commissioner's Office, the UK supervisory authority.
Who is responsible
This section names the registered controller and the address for data protection enquiries, and it is written here rather than omitted. PaperAlly is operated from the United Kingdom. The controller's registered details go here before the site accepts real work, because a notice with no controller in it is not a notice.
Last reviewed alongside the trust page. Material changes will be shown on the page and not made quietly.