Privacy policy

Paperfoot is run by Paperfoot AI Pte. Ltd., a company incorporated in Singapore (“we”, “us”). We are responsible for the personal data described here.

• When you join, we store your name, your email address and your password, which is kept only as a one-way hash. If you sign in with your phone number, we store the number.
• If you sign in with Apple, Apple gives us the name you choose to share and either your email address or, if you choose to hide it, a private relay address that Apple forwards to yours.
• We also keep with your account how you found us: the first page you opened on the visit you joined in, the site that sent you and the campaign tags in the link you followed, and, if you followed one of our campaign or referral links in the 30 days before, which ones (the first and the latest). With Global Privacy Control or Do Not Track turned on, we keep none of these.
• If you joined through another reader’s referral link, we keep whose link it was, so that they can be given Plus when you first pay.
• When you share a page while signed in, the link carries your referral code, and whoever opens it is shown your first name and your picture beside “shared this with you”, and nothing else about you. If they join, it counts as your referral. Turn this off in Settings, Privacy, under Show my name on links I share: your links are then plain, and a link you shared before shows no name within a minute.
• We store the papers you save and like.
• We store the subjects and authors you follow, in the words you typed, the drugs, genes and other entities you follow, what you mute, and what you ask your feed for more or less of.
• For each entity and search you follow, we record the new papers that match it, when you saw them and whether an email told you of them, for 90 days. Unfollowing deletes them.
• Each sign-in session records the IP address and browser it began on, to keep the account secure. A session stops working after 60 days without a visit.
• When the sign-in screen opens we record the steps taken in it: that it opened and what you were doing when it did, the way of signing in you chose, each step it moved on to, whether a code was sent and whether the one entered was right, a return from Google, Apple or X, an error it showed (that there was one, not its words), and the step it was on if you left before finishing. Each carries the daily visitor code described under Page views and, once you are signed in, your account. We never record the address, the number, the code or the password you type. We use these to find where signing in fails.
• We also record, with your account, when you claim a link that gives Plus, a trial or a seat (which kind of link and its number, never its code), when another reader's referral link is credited with your joining, and the first time you ask a question in Ask and the first time you follow something. We use these to see which links bring readers who stay.
• When one of our editors opens your account’s record on our private desk, or changes your account’s plan or access, the desk logs which editor did it and when, so access to your data is accounted for.

We use no advertising or third-party cookies.

• __Secure-better-auth.session_token keeps you signed in. It is set when you sign in and lasts up to 60 days.
• __Secure-better-auth.session_data holds a signed copy of your session for 5 minutes, so pages know you are signed in without looking you up each time.
• arn_checkout is set when you start a checkout. It holds the plan you chose and the page you were on, so the site can take you back there once you have paid, and can tell when you come back without paying. It lasts an hour and is deleted when you come back.
• arn_x is set while we are testing two versions of a part of the site, such as how many lines a post’s summary runs to. It holds which version this browser sees of each test, and nothing that identifies you, so the site shows you the same one every time. If you are signed in, it follows the version your account first saw. It lasts 180 days. It is not set with Global Privacy Control or Do Not Track turned on, and you then see the site as it was before the test.
• In session storage, a random id groups one tab’s page views and reading records into a visit, with the time of the tab’s last page view or of the page’s last report of time spent on it, so a visit ends after 30 minutes without either. Both are deleted when the tab closes.
• In session storage, when you are signed out, the papers you hid in this tab, so they stay hidden until it closes.
• In session storage, when you are signed out, the pages this tab’s visit arrived on, whether one of our own emails sent it, and, if it came through a reader’s shared link, that reader’s referral code, so the page you were sent to opens whole and the reader who shared it is named. They are deleted when the tab closes.
• In local storage, when you are signed out, the stories you have opened in the last 30 days (their ids and when), so that the site can count them, and when you last dismissed its invitation to join. They never leave your browser.
• In session storage, when you press Ask while signed out, your question, so that it is asked once you sign in or join. It is deleted when it is asked, after 30 minutes or when the tab closes.
• In local storage, to count how many readers come back: the day this browser first opened the site, the last day it did and the gap before that day, and the day it first came back. Until it opens the site on a day after the day it first came back, it also keeps the site that first sent it, the utm_source and utm_medium tags of that first link, and whether that first page was one of our own gift, trial or referral links. It holds no id. Pages send only the return mark described under Page views, never the days themselves.
• In local storage, whether this browser was last signed in, so the top bar keeps its shape while the page loads.
• In local storage, whether you paused your history, so the first record a page sends already leaves your account out.
• In local storage, the time of the newest entry you have seen on Updates, so the unread dot can show. It never leaves your browser.
• In local storage, your recent searches, so the search box can offer them again. They never leave your browser.
• On our editors’ own browsers only, a flag in local storage that keeps their visits out of the counts.

We no longer set the arn_anon cookie, which held a random id for counting story reads. If your browser still has one, the site deletes it on your next visit.

To stop abuse and to tell crawlers from people, we keep a security log: the IP address of each browser that sends a page view and of each crawler that asks for a page, once a day for each address, with the times of its first and latest request that day, the crawler its browser named if any, and the network the address belongs to (the network’s number, name and country, and whether it is a hosting company, a university or a home or mobile provider), which we look up in a public table we keep ourselves, sending your address to no one. Each page view names its day’s row in the log. We use the log only to find and limit automated traffic, never to rank, personalize or market, and we delete each row 30 days after its day.

When you search, we record the words and filters you used, how many results came back, and which result you opened and where it sat, with the daily visitor code and, if you are signed in, your account. Your search words go to Google (Gemini), which turns them into the form we use to find papers by meaning. A search you follow is kept with your account until you unfollow it.

When you are signed in, the subjects your searches name and the results you open also rank For you. While your history is paused, your searches carry no account, and clearing your history removes your account from the searches you ran.

We send email through Amazon SES:

• a welcome email when you join;
• a link to reset your password when you ask for one, which expires after an hour;
• the digests you make yourself, each at the time you choose, and only when it has new papers. We keep a record of each one sent, with the papers it carried, for 120 days, so the next carries only new ones. Each has its own unsubscribe link, which stops that digest and nothing else;
• at most one email a day with the new papers on the entities and searches you follow that you have not seen on the site. It goes only while you follow something. We keep a record of each one, with its day and whether it was sent, for 90 days. Each has its own unsubscribe link, which stops it and nothing else, and you can turn it off in Settings, under Email;
• an email when a paper you saved is retracted, withdrawn or put under an expression of concern, once for each, with the notice. It is on unless you turn it off in Settings, under Email. We keep a record of each one, with the paper, the notice and whether it was sent, for 90 days;
• if you turn it on in Settings, under Email, a short email of what is new on the site, at most once a week. We keep a record of each one, with its day, how many updates it carried and whether it was sent, for 90 days. Each of these two has its own unsubscribe link, which stops it and nothing else.

To make these emails better, we record for each one, with your account, whether it was delivered, opened and unsubscribed from and which of its links were clicked, for 13 months; turn off Count opens and clicks in Settings, under Email, and they go with no open pixel and plain links.

These companies process personal data for us, only to provide their service:

• Amazon Web Services hosts the site and runs its code and our database. It handles every request, including your IP address. It also sends our email (Amazon SES) and stores pictures and the research archive (Amazon S3).
• Vercel keeps a standby copy of the site and measures page speed (Speed Insights).
• Neon ran our database until October 2026 and keeps a copy of it until we close the account.
• Stripe takes payments and runs the billing portal.
• Apple takes payments in our iPhone and iPad app (In-App Purchase) and delivers the app’s notifications (Apple Push Notification service).
• Twilio texts you a code when you sign in with your phone number (Twilio Verify).
• Cloudflare checks that a person, not a bot, is asking for a sign-in code or sending a message from the contact page (Turnstile).
• The AI model providers we contract with judge papers and write and check stories, news briefs and email text. For those steps they receive the papers and our own text, and, for a digest you make, its name: nothing else about you.
• To find and rank papers and write answers, Google (Gemini), TypeSafe (Jev) and OpenAI receive the text that step needs: your search words, Ask questions with the last few turns of the conversation, the subjects you follow and your Plus research interests. Their terms with us bar them from training their models on it. They may keep it for as long as they need to provide their service and to detect abuse, and then delete it.

We don’t sell personal data or share it with advertisers. We disclose it to anyone else only when the law requires it, or to a buyer of the business, and we would tell you before a sale.

Where UK or EU data protection law applies, we rely on:

• contract, to run your account, followed searches, Plus, Ask, API keys, the AI assistants you connect and the app’s notifications, and to send the welcome and password emails;
• legitimate interests, to keep the service secure, count visits, measure how quickly pages load, rank papers from what readers do, improve search and Ask, build the research archive and train our models, and send account holders the weekly email and the emails about papers they saved, and write once to a paper’s corresponding author about our story on it (under Outreach to authors). You can object to any of these;
• consent, to send the product updates email, which you can withdraw in Settings or with its unsubscribe link;
• legal obligation, to keep billing records.

We also handle personal data in line with Singapore’s Personal Data Protection Act 2012.

• Your account, its settings and how you found us: until you close the account.
• Saves, likes, followed searches and Ask conversations: until you remove them or close the account.
• The subjects and authors you follow, and what you mute or ask for more or less of: until you remove them, a mute or a request runs out, or you close the account.
• API keys, including revoked ones, and their daily usage: until you close the account.
• AI assistants you connected: your consent and the app’s tokens until you disconnect it or close the account; refresh tokens past their 60 days are deleted daily. The counts of lookups through assistants: a week. The counts of their tool calls: 400 days, and the hashed callers of each day: 90 days. A request to be sent new papers: until it ends, after 30 days at most.
• The scores and scoring records made from your Plus research interests: until you close the account.
• Sign-in sessions, with their IP address and browser: until you sign out or close the account. A session stops working after 60 days without a visit.
• The devices the app registered for notifications, with their push token, app version, language and region, and time zone: until you sign out of the app on that device or close the account. The record of each notification sent: 30 days.
• Password reset links: they stop working after an hour.
• The security log of IP addresses and their networks: 30 days.
• Page views, the steps that lead to a plan, the steps of the sign-in screen, the parts of a page that came into view, how your checkouts ended and searches: indefinitely, to measure the site and improve rankings and search over time. Those linked to your account are deleted with it.
• Our copies of page-speed timings, and reports of errors: 90 days. They are linked to no one.
• Reading records: in our database for 35 days (which cards were on your screen, and the lists we showed) or 400 days (everything else), then only in the research archive. The earlier log of saves and likes, and reading records from before 3 October 2026, are kept indefinitely. Those linked to your account are deleted with it.
• The network code on the actions you take: three days at most.
• The record of each email we sent you (delivered, opened, which links you clicked, unsubscribed): 13 months, and deleted with your account.
• The desk’s log of editors opening your account’s record or changing its plan or access: indefinitely, with your account’s id, the plan and its dates, and nothing else about you.
• The summary of what you read and your ranked list of papers: until you close the account. The copies of For you pages we showed you are kept with the reading records.
• The research archive: indefinitely, under the pseudonymous code.
• Messages sent from the contact page: as our correspondence, until you ask us to delete them. Those linked to your account are deleted with it.
• Authors’ addresses found for outreach: a year after we found them; the hash of an address we wrote to or that opted out, indefinitely.
• Billing records: as long as tax law requires. Stripe and Apple keep their own.
• A subscription bought in the app, as Apple last reported it: until you close the account. Apple’s notices of its renewals, refunds and lapses, which name no account: indefinitely, as billing records.
• The subscriptions that took a founding place: indefinitely, as each subscription’s Stripe id and its date, and nothing else about you.
• The Plus trial an account started: indefinitely, as a one-way hash of the address it was made with and the date, so each address gets one trial; the hash cannot be turned back into the address.
• The reminders sent before a renewal or a trial’s first charge, and the email sent when a payment fails: as each subscription’s Stripe id, the charge’s date, which email it was and whether it went, so that none is sent twice.

Depending on where you live, you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, or take it elsewhere. In Settings, change your name under Account, your topics, interests and what you follow, mute and keep as history under Feed, and your emails under Email. Under Privacy, pause or clear your reading history, download a copy of everything we hold about your account, export your saved papers, and delete your Ask conversations.

Deleting your account, in Settings on the website or in the app, removes your profile, how you found us, sessions, saves, likes, followed searches, Ask conversations, API keys, the AI assistants you connected and the devices the app registered for notifications, the summary of what you read and your ranked list, and the page views, reading records, searches and Plus scoring records linked to it. If you pay for Plus or Pro on the website, we cancel the subscription. If you pay through Apple in the app, deleting your account doesn’t cancel the subscription, and Apple keeps billing you until you cancel it in your Apple Account’s subscriptions (on your iPhone or iPad, open Settings, tap your name, then Subscriptions). Records already in the research archive stay under their pseudonymous code, with no link to your name or email address.

If you think we have mishandled your data, tell us first. You can also complain to the data protection authority where you live, such as the PDPC in Singapore or the ICO in the UK.

We are based in Singapore. The site, its database and the research archive run in the United States, as do our AI model providers, Stripe and Twilio, and email is sent from the United Kingdom, so your data is handled outside your own country. Where the law requires it, these transfers rely on our providers’ data processing terms, including standard contractual clauses.

Connections to the site are encrypted. Passwords are stored only as one-way hashes, API keys are encrypted, and card details stay with Stripe or Apple. Access to our data is limited to the people who run the service.

Accounts are for people aged 16 and over. If you think a child has given us personal data, write to us and we will delete it.

When this policy changes, so does the date at the top. We email account holders before a significant change takes effect.

Paperfoot AI Pte. Ltd., Singapore