Privacy Policy

1. Who we are

ScholarXIV ("we", "us") provides an AI-assisted research platform, including paper search, research chat, and health features. This policy explains what we collect, why, and what control you have. It applies to scholarxiv.com, our desktop and mobile apps, Papers API, Agent API and other APIs, Model Context Protocol (MCP) server, Router, official bots (including our Telegram bot), command-line tools (CLI), developer dashboard, and related features and integrations that link to this policy. Third-party apps, AI clients and messaging platforms also have their own privacy policies for the data they handle.

2. Information we collect

Information you give us

• Account details — name and email address, provided directly or through a sign-in provider such as Google.
• Content you create — chat messages, prompts, saved papers, bookmarks, collections, and notes.
• Files you upload — documents and images you attach to a conversation or store in your library, including any PDFs you choose to upload.
• Health information — only what you voluntarily enter. See section 5.
• Developer and integration data — API key records, connected credentials, routing profiles, model preferences, prompts, message history, tool inputs and results, and feedback you submit through APIs, MCP, the Router, bots or developer tools. If you configure your own AI Gateway key, we store it encrypted so we can make authorised requests.
• Bot interactions — messages, commands and attachments sent to the bot, platform user and chat identifiers and profile details supplied by the messaging platform, and the credentials you provide to connect your ScholarXIV account.
• Billing details — handled by our payment processor. We never see or store your full card number.

Information collected automatically

• Usage data — pages visited, features used, and approximate request volume.
• Device and connection data — IP address, browser type, and approximate country derived from your IP.
• Session data — cookies required to keep you signed in.
• API, MCP and Router records — account and key identifiers, endpoints or tool names, timestamps, status and error details, request durations, and usage counts. Papers API logs include search queries and filters. Router records include task classification, selected and fallback models, token and cost estimates, outcomes and feedback. The public Router demo also records up to the first 500 characters of your prompt for evaluation and benchmarking; do not put confidential or sensitive information in that demo.
• App data — app and operating-system information, session and preference data, and cached or downloaded content on your device. Where push notifications are enabled, the mobile app obtains a push token and sends it with your operating system to register for delivery.

3. How we use your information

• To provide the service — running searches, generating answers, and storing your work.
• To personalize results, including using your health profile to tailor health answers.
• To operate accounts, subscriptions and billing.
• To maintain security, prevent abuse, and enforce our Terms.
• To diagnose problems and improve the product.
• To authenticate connected tools, execute requested actions, synchronise account activity across products, deliver notifications, and measure usage against your plan.
• To classify and route requests, measure model reliability and performance, and improve routing using decision records, outcomes, feedback and public-demo prompt samples.

We do not sell your personal information, and we do not use the contents of your conversations to advertise to you.

4. AI providers and how your content is processed

This is the most important thing to understand about an AI product. When you send a message, the contents of that conversation — including any text extracted from files you attached and, on the health assistant, your health profile — are transmitted to third-party AI model providers so that a response can be generated. Those providers process the content on our behalf and return a result.

Which provider receives your content depends on the model you select or the Router selects, including any fallback used. Each provider has its own retention and processing terms. If you would prefer that particular content never leaves our systems, do not enter it into a conversation.

Router and developer APIs

The Router processes submitted prompts and message context to choose a model. Even a recommendation-only request may send a portion of your prompt through our AI gateway to a classification model; it is not necessarily processed only on our servers. A route-and-run request also sends the supplied messages and supported attachments to the selected model provider. Requests made with your own gateway key are processed through that account and are also subject to your agreement with the provider. Routing uses temporary in-memory caches and the usage and decision records described above; it is not a promise of zero retention.

MCP, bots and connected clients

An MCP client or other integration sends us tool inputs and receives results. Depending on the tools invoked and access available to your key, results can include saved research, conversations, collections, account information or health data. Tools can also change, share or delete that content. Connecting a client can therefore expose account data to that client and any AI providers it uses. Review its permissions and privacy policy before connecting.

When you use an official bot, the messaging platform (such as Telegram) handles your messages, commands, any credentials sent in the connection flow, and returned answers. We process those interactions to link your account and perform the requested searches or actions. Messages and results sent to a group or shared through inline features can be visible to other participants. The platform and connected clients may retain their own copies under their own policies.

Sharing and other service providers

Search and research features send queries or relevant content to external search, paper and tool providers as needed to fulfil your request. Hosting, storage, authentication, analytics, payment and notification providers process the information needed to operate their services. Content you publish, share by link or add to a shared collection is available to its intended audience according to that feature's visibility settings. Recipients may copy or redistribute it.

5. Health information

The health assistant is optional. If you use it, we process the health information you choose to provide — for example symptoms you describe, medications and conditions in your health profile, and any lab reports or medical documents you upload. This also applies when you use health features through apps, MCP, APIs or bots. If a connected client requests health information or you send it through a messaging platform, that service also receives it as described in section 4.

• Health profile data is used to personalize the answers you receive, and is included in the prompt sent to the AI provider handling your request (see section 4).
• Health conversations are stored separately from your research chats.
• Uploaded medical documents are stored in a private bucket and are only retrievable through an authenticated request tied to your account.
• You can edit or clear your health profile at any time in Settings, delete individual conversations and files, or delete your account entirely.

We are not a healthcare provider, and ScholarXIV is not a covered entity under HIPAA. Information you enter here is not protected health information held by a clinician, and the service does not provide medical care. It is a research tool that offers information — not diagnosis or treatment.

6. Where your data is stored

Purpose	Processor
Application database (account, chats, profile)	MongoDB Atlas
Uploaded files and documents	Cloudflare R2 (EU region)
Hosting and delivery	Vercel
AI model inference	Model providers reached through our AI gateway
Payments and subscriptions	Our payment processor
Mobile push delivery, where enabled	Expo and Apple or Google push services
Bot messages and connected tool results	The messaging platform or client you use

Data is encrypted in transit, and our database and file storage encrypt data at rest. Uploaded files are stored in a private bucket and served only through short-lived, access-checked links.

Apps and CLI tools also keep session information, settings and, where relevant, credentials or downloaded files on your device. Content you export or share to another app is handled by that app. Our providers and the external services you connect may process information in countries other than where you live; the file-storage region above does not describe every processing location.

7. Retention

We keep your content for as long as your account is active. When you request deletion, your account is deactivated immediately and your data is queued for permanent removal following a short review period, after which chats, files, health information and profile data are permanently deleted. We may retain limited records where we are legally required to, such as billing history.

Operational records, including API and MCP logs, routing decisions, feedback and demo samples, are retained according to their purpose: operating and improving routing, investigating errors or abuse, resolving billing disputes, and meeting legal obligations. Their retention may differ from saved chats. Contact us about deletion of these records. Disconnecting an integration or revoking a key stops future authorised access with that key; it does not erase prior records. Uninstalling an app or deleting a bot conversation does not delete your ScholarXIV account. Account deletion does not remove copies already held by messaging platforms, connected clients, other recipients or your own device; use their deletion controls as well.

8. Your rights

• Access — see the data associated with your account.
• Correction — edit your profile and health information at any time.
• Deletion — delete individual chats and files, or your entire account from Settings → Account.
• Objection and restriction — stop using a feature, or contact us to limit specific processing.

You can revoke API keys in the developer dashboard, remove connected clients, and change your Router configuration in the Router dashboard. Control notifications and supported device permissions in your operating-system settings. Use app sharing and file controls to choose what to export or upload. If you use ScholarXIV through someone else's application, contact that application's operator about data it holds; you can also contact us about data we hold.

Depending on where you live, you may have additional rights under laws such as the GDPR, the UK GDPR, the CCPA/CPRA, or state health-privacy laws. Contact us to exercise them.

9. Cookies

We use cookies that are necessary to keep you signed in and to maintain your session, and limited analytics to understand aggregate usage. We do not use advertising cookies.

10. Children

ScholarXIV is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will remove it.

11. Security incidents

If a breach affects your personal information, we will notify you and any relevant regulator as required by applicable law.

12. Changes

We may update this policy as the product evolves. Material changes will be signalled by updating the date at the top of this page, and where appropriate we will notify you in the app.

13. Contact

Questions, requests, or complaints: hello@scholarxiv.com.