Privacy Policy

Last updated: April 28, 2026

1. Introduction

PaperPilot ("we", "our", "us") provides AI-assisted academic writing tools that help students and researchers produce outlines, drafts, and citation-verified manuscripts. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our website, our web application, and any related services we operate.

We designed PaperPilot with privacy as a baseline. Your manuscripts are your work — we do not sell them, and we do not share them with third parties for marketing or advertising.

2. Information we collect

2.1 Account information

When you create an account, we collect your email address, display name, and password (stored as a salted hash). If you sign in with a third-party identity provider (Google, GitHub, ORCID), we receive the basic profile information that provider returns.

2.2 Content you submit

When you use PaperPilot to draft a paper, we receive the topic, prompts, outline edits, and uploaded reference files you supply. This content is processed to generate the output you request and is stored in your workspace so you can return to it later.

2.3 Usage and device data

We collect technical logs that include IP address, browser type, device type, pages viewed, and time stamps. This data helps us diagnose errors, prevent abuse, and improve performance.

2.4 Payment information

If you purchase a paid plan, payment is processed by our payment partner (Stripe). We receive a transaction reference and the last four digits of your card; we do not store full card numbers.

3. How we use information

• Provide, maintain, and improve the PaperPilot service.
• Generate the outputs (outlines, drafts, citation suggestions) you request.
• Authenticate your account and prevent fraud or abuse.
• Send service announcements, billing notices, and security alerts.
• Respond to support requests and feedback.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your manuscripts or uploaded reference files to train the foundation models that power our service.

4. Sharing and disclosure

We share information only in these limited cases:

• Service providers who host our infrastructure, send transactional email, or process payments. These vendors operate under contract and only process the data needed to perform their service.
• Model providers we use to generate outputs (e.g., large-language-model APIs). Prompts and the minimum context required for generation are sent over encrypted channels and are not retained by these providers for training, per their enterprise terms.
• Legal compliance — when required by law, valid legal process, or to protect rights, property, or safety.
• Business transfers — if PaperPilot is involved in a merger, acquisition, or asset sale, your information may transfer as part of that transaction. You will be notified before any change in ownership of personal data.

5. Data security

We use industry-standard safeguards including TLS 1.3 in transit, AES-256 at rest, regular vulnerability scanning, and role-based access control for engineers. No system is perfectly secure; if we detect unauthorized access to your account, we will notify you and take prompt remedial action.

6. Data retention

Account data is retained for the life of the account. Manuscript drafts are retained until you delete them or close your account. Server logs are retained for up to 90 days. After deletion, residual copies may persist in encrypted backups for up to 30 days before being purged.

7. Your rights and choices

Depending on your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data. To exercise any of these rights, email [email protected]. We respond to verified requests within 30 days.

You can also delete projects directly from your workspace, or close your account from Settings → Account → Delete account.

8. Cookies and tracking

We use first-party cookies to keep you signed in and to remember your interface preferences. We use a minimal analytics cookie to count page views in aggregate. We do not use third-party advertising or cross-site tracking cookies.

9. Children's privacy

PaperPilot is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, contact us and we will delete it.

10. International data transfers

Our infrastructure is hosted in multiple regions. By using PaperPilot, you consent to your information being transferred to and processed in these regions, where data-protection laws may differ from those in your home country. We rely on Standard Contractual Clauses or equivalent safeguards where required.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or via an in-app notice at least 14 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.

12. Contact us

Questions, requests, or complaints? Email us at [email protected]. We aim to respond within one business day.