Privacy Policy
This policy explains how Premsan Inc (“Premsan”, “we”, “us”) handles personal data in Paperingo — this website, the web app, the API, and the Paperingo apps for iPhone, iPad and Android. Premsan is the controller of that data.
1. What we collect
- Your account. Your name, your email address, and either a password — stored only as a hash — or, when you sign in with Apple or Google, your identifier there and the sign-in tokens the provider gives us. Each session records the IP address and the browser or device it was opened from, and when it expires. We also record the date on which you accepted the Terms, and which version, and the day you last used the account.
- What you bring. The sources you add and the records fetched for them, the text of a source you attach, the messages you exchange with the assistant, the papers it writes and every version of them, the files, figures and bibliographies you import, the pictures and PDFs you attach, and the PDFs it produces. What goes in is your choice; Paperingo holds it exactly as you gave it, for the paper you want, and you can edit or delete any source, file or paper at any time.
- Sources you look up. When you add a source by its DOI, ISBN, arXiv ID or PubMed ID, our server asks that registry for the record; when a publisher offers an open-access copy of a work you add by DOI, our server fetches that PDF and keeps it with your paper as the source’s text. When you search the literature, our server sends your search words to the open index and brings the results back. When you paste a link, our server fetches that page. In each case the other service sees a request from our server, not from you, and nothing about your account goes with it.
- What the assistant remembers. The facts you tell the assistant about yourself, your work and how you want it to work, kept as memories so every later conversation starts with their titles and descriptions: each one’s kind, title, description and details, whether you or the assistant wrote it last, and when. You see and delete them in Settings, and correct one by telling the assistant; their titles and descriptions go to the model with every message you send it, and a memory’s details when the assistant opens it.
- Your voice. When you turn on voice mode, what you say is recorded and sent to be written down as text; the text goes to the assistant as your message, and the recording is deleted once it is written down. The assistant’s replies are read aloud by your own device’s voice.
- The plan. When your free use began, how many messages you have sent since, and the state of your subscription. On the web, payment is taken by Stripe: it receives your email address and your account id, and your card details go to Stripe and never reach us. We keep the subscription’s id, its customer id at Stripe, when its current period ends and whether it renews. In the app, payment is taken by the App Store or Google Play; we receive the transaction’s id, confirm it with Apple or Google, and record it against your account.
- Help. When you write to us from Help, we keep your messages, the pictures you attach, our replies, and details that help us answer: whether you wrote from the web or the app, your browser or the app’s version and operating system, your language, the screen you came from, the size of your window or screen, your time zone and your most recent failed requests to our servers. They are kept with your account until you delete it. Our team reads them in our own support tool, where, if you have allowed the assistant, Paperingo’s model may draft a reply that a team member reviews before sending.
- Usage. How many times the assistant ran, how many PDFs were made and how many model tokens were used each month, kept inside your own account’s storage for our accounting. Server logs hold request metadata, including your IP address, and error reports for a short time, for security and debugging.
- The bot check. Cloudflare Turnstile runs on our sign-in and sign-up pages, and in the app’s sign-in screen, to tell a person from a script.
- Nothing else. There is no advertising, no analytics service, no tracking across sites or apps, no advertising identifier, and no data broker.
How far you get is recorded as you go: the day you sign up and each day you come back, whether on the web or the phone app and in which language; when you allow the assistant; when each request to it ends, which of its agents answered and whether it worked; when you reach what is free; when you pay, and through which store; when you attach a file, and whether it is a PDF, an image or a table; when you import a project; and when you download a paper, and whether as its PDF or its files. Each record carries a random number kept in your account’s storage, never your name, your address or anything you wrote or made, and we read the records only as counts, to see where people stop. Deleting your account deletes the number; the records stay, with nothing in them that leads back to you.
2. What we do with it
We use personal data to run Paperingo: to write, typeset and check your papers, to fetch the sources you ask for, to sign you in, to send you the emails the account needs — a verification link and a password reset — to take payment and keep your subscription’s state, to keep the service running and prevent abuse, to answer you when you write to us, and to meet legal obligations. We do not use your sources, conversations or papers to train models, we do not sell personal data, and we do not share it for advertising.
3. Why we are allowed to
Where the GDPR or a similar law applies, we rely on these bases:
- Performing our contract with you — your account, your sources, your conversations and papers, and the subscription. Without them there is no service to give you.
- Our legitimate interests — keeping Paperingo running, finding failures, and stopping abuse and automated sign-ups. We limit this to what running the product needs: the usage counts, the logs and the bot check, not profiling and not advertising. Seeing where people stop, from the record of how far you get, rests on it too.
- A legal obligation — payment records and anything else the law requires us to keep.
- Your consent — for anything the law treats as special that you choose to put in a paper or a conversation. You give it by putting it in, and you withdraw it by deleting the paper or the account.
4. Who else processes it
Paperingo runs on Cloudflare: the servers, the storage that holds your account, the container that typesets the PDF, the email we send, and the bot check are all Cloudflare services on our own account. The model that writes for you runs at Anthropic, reached through Cloudflare, and the assistant sends it nothing until you allow that, on the web or in the app, when it asks before your first message; you can turn it off in Settings (under Account in the phone app), and the assistant then asks again before your next message. Anthropic does not train a model on what it is sent and deletes it under its own retention policy; when Anthropic cannot answer, the same request goes to OpenRouter, which does not train a model on it and passes it only to a model host that keeps nothing once it has answered, or else to Cloudflare Workers AI, and no prompt of yours goes to any other AI provider. Some email may be sent through Resend instead. Stripe takes payment on the web and stores your card details; Apple and Google take payment in the app, and each tells us when a subscription you bought there renews, is cancelled or is refunded. A source added by DOI is looked up at DOI.org, which returns the publisher’s own record; a book by ISBN at Open Library; a preprint by its identifier at arXiv; a biomedical paper by its PubMed ID at PubMed. A search of the literature, and the check for an open-access copy of a paper, go to OpenAlex; the copy itself is fetched from wherever the publisher hosts it, and only where it states a licence or is on arXiv. None of them receives anything about you except the identifier or the words you searched, sent from our server, which identifies itself to them as Paperingo with our support address and stays within each service’s request limits. The citation styles and the typefaces the papers are set in are copied from their public repositories into our own storage when we deploy, with no personal data. When the app opens it asks Expo’s update service whether a newer version of our code is available; that request carries the operating system, our project id and a random identifier the app generated for itself — no account and no device identifier — and Expo sees the IP address it came from. These providers process data only on our instruction and are each bound to protect it at least as well as this policy does; we give notice here before a new one starts.
In voice mode, each recording of what you say goes to Cloudflare Workers AI to be written down as text, and to no other provider; we do not keep the recording.
Signing in with Apple or Google sends us your identifier and email from that provider. Each acts on its own behalf there, not as our processor, and its handling of your account with it is governed by its own privacy policy; if you hide your email from us with Apple, mail reaches you through Apple’s relay. The App Store and Google Play are the sellers of what you buy inside the app, and their handling of your payment is governed by theirs.
When the assistant searches the web, the words it searches for, which it writes from your conversation, go through Cloudflare to Linkup, or to Ceramic.ai when Linkup cannot answer; neither keeps them once it has answered. When the assistant reads a web page, our servers fetch it from its site in a request that names Paperingo, and the site sees nothing else of yours.
5. Where it is
Your data is processed on Cloudflare’s network, which spans the world, and stored on it under Cloudflare’s own commitments for international transfers. A request that goes to Anthropic leaves that network for Anthropic’s servers, and one that goes to OpenRouter for OpenRouter’s servers and its model host’s, each under that company’s own commitments for international transfers. Premsan is in Japan, a country the European Commission recognises as protecting personal data adequately.
6. On the phone
The app keeps on your device a sign-in token, the language and appearance you chose, the random identifier it uses for update checks, and, when you share a PDF or the paper’s files, a copy of that file in the app’s own cache for the share sheet. It uses the camera, your photos or your files only when you tap the paperclip or import a file and pick something, and the operating system asks your permission the first time you use the camera; nothing is read in the background. It uses the microphone only while voice mode is on, and the operating system asks your permission the first time you turn it on. Purchases go through the store’s own sheet. The app contains no advertising or analytics library. The only review prompt it shows is the operating system’s own, requested once after you share your first PDF.
7. Cookies
On the web we set the cookies the product cannot work without: the one that keeps you signed in, and the ones Cloudflare Turnstile sets to tell a person from a bot on the sign-in and sign-up pages. This website and the web app keep your theme and language in your browser’s own storage. There are no other cookies: no advertising cookies, no cross-site trackers, and no analytics that follows you between sites, so the site does not ask you to accept cookies. Clearing them signs you out.
8. How long we keep it, and deleting it
We keep your account and everything in it for as long as the account exists. Deleting a source removes it. Deleting a paper removes it, its conversation, its versions, its sources, its files, its attachments and its PDFs. Verification and reset links expire on their own.
If your account goes unused for a month and has never had a subscription, we delete it and everything in it, as if you had deleted it yourself. One that has had a subscription becomes dormant instead: nothing it does on a schedule runs, and using it again restores it as it was; if it is still unused twelve months after it was last used, we delete it the same way. An account with an active subscription is never made dormant or deleted for going unused.
You can delete your account at any time: on the web under Account in Settings, or in the app under Account. Deleting it erases everything we hold for you — papers, sources, conversations, versions, files, attachments, PDFs, Help messages, usage and the subscription’s state — and then the account itself, except for the records listed below. You cannot undo it.
These records remain after the account is deleted:
- Purchases in the app. A subscription bought in the app leaves a record of the store’s transaction id, the date and the id of the account it was bought for, so that the same receipt cannot be applied to another account, and because the law requires payment records to be kept. The account it names no longer exists.
- Payment records. Stripe, Apple and Google keep their own records of a payment under their own legal obligations.
- Backups. Cloudflare keeps restorable copies of our databases for up to 30 days, so that they can be restored after a failure; they then expire.
- Server logs. These are deleted automatically after a short time.
9. Your rights
You can read, correct and delete every source, file and paper yourself, download any paper as a PDF or as a zip of its files, and delete your account, without asking us. Depending on where you live, you may also have the right to a copy of the rest of what we hold about you, to restrict how we process it, to object to processing we base on legitimate interests, to withdraw consent where we relied on it, and to move your data elsewhere. Write to support@paperingo.com and we will answer within one month.
If you live in California or another U.S. state with a similar law, you have the right to know what personal data we hold about you, to delete it, and to correct it; the controls above do that. We do not sell or share personal data as those laws define the words, so there is no opt-out to offer, and exercising a right gets you the same service on the same terms.
If you think we have handled your personal data wrongly, you can complain to a data protection authority — in the EEA or the United Kingdom, the one where you live or work or where the problem happened; in Japan, the Personal Information Protection Commission. You are welcome to contact us first, but you do not need to.
10. Security
Every connection is encrypted in transit. Passwords are stored as hashes. Each user’s data is kept in its own isolated storage and is deleted with the account, apart from the records listed in section 8. The app keeps its sign-in token in the operating system’s secure store, never in a cookie. Credentials never enter our logs. If you find a security weakness, write to security@paperingo.com and allow us time to fix it before you disclose it to anyone else.
11. Children
Paperingo is not for anyone under 16, and we do not knowingly hold a child’s data. If you think a child has an account, tell us and we will delete it.
12. Changes
We may update this policy. When a change matters we will say so in the web app or the phone app, or by email. The date at the top is the version that stands.
13. Contact
Premsan Inc — 530-0001, 12-12, Osaka Ekimae Dai-2 Bldg., 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka, Japan. support@paperingo.com.