ScholarLM

Privacy Policy

Last Updated: June 11, 2026

Data We Collect

Account Data: Email address, display name, auth provider — retained until account deletion.

Usage Data: Search queries (30 days, local only), saved papers (until you delete), session data (24 hours).

Technical Data: Browser type (session only), error logs (7 days), performance metrics (aggregated, 30 days).

AI Processing of Your Inputs

Your search queries and any text you submit are processed by large language models and embedding models (Google Vertex AI / Gemini) to generate results.

Please do not enter confidential, personal-health, financial-account, or proprietary information that you are not authorized to share with third-party AI processors.

Data We Do NOT Collect

  • Payment card information (handled by Stripe)
  • Personal research content beyond what you submit to run a search
  • PDF file contents (processed in-browser where possible)
  • Location data
  • Device identifiers
  • Third-party advertising / tracking cookies

Third-Party Processors

We rely on trusted sub-processors, each governed by its own terms:

  • Google Firebase — authentication and identity.
  • Google Cloud / Vertex AI — LLM generation and embeddings.
  • Stripe — payment processing (if/when paid plans launch).
  • Academic data providers — OpenAlex, arXiv, PubMed, Semantic Scholar, Crossref and others are queried to fulfil your searches.

Cookies & Local Storage

We use only essential cookies and browser local storage for authentication, session continuity, and saving your preferences. We do not use third-party advertising trackers.

Data Security

Traffic is encrypted in transit (TLS) and routed through a trusted ingress gateway with scoped internal access. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Your Rights

All Users: Access your data, delete your account, export in standard formats (BibTeX, JSON), update profile.

GDPR (EU/EEA): Right to access, rectification, erasure, restrict processing, data portability, object, and withdraw consent.

CCPA (California): Right to know, delete, opt-out (we don't sell data), non-discrimination.

International Data Transfers

Data may be processed on Google Cloud infrastructure located outside your country of residence. Where required, appropriate safeguards (such as Standard Contractual Clauses) apply.

Children's Privacy

ScholarLM is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

Changes to This Policy

We may update this policy as the product evolves. Material changes will be reflected in the "Last Updated" date above and, where appropriate, communicated in-app.

Data Deletion

Go to Account Settings → Click "Delete Account" → Confirm deletion. All user data is permanently deleted within 30 days.

Contact

For privacy inquiries: bharath@scholarlm.dev