Privacy Policy

Last updated: July 17, 2026

This policy explains what information CiteDash (“CiteDash”, “we”, “us”) collects, why we collect it, who processes it, and the choices you have. The short version: your research is yours. We process it only to provide the service you ask for, we do not sell personal information, we do not use your content to train AI models, and you can export or permanently delete everything from your Settings page at any time.

Contents

• 1. Who we are and what this covers
• 2. Information we collect
• 3. How we use information
• 4. AI processing
• 5. Service providers (sub-processors)
• 6. Research-participant (form respondent) data
• 7. When we share information
• 8. Data retention and deletion
• 9. Security
• 10. Your rights and controls
• 11. International data transfers
• 12. Cookies and local storage
• 13. Children
• 14. Changes to this policy
• 15. Contact

1. Who we are and what this covers

CiteDash is an AI research platform for graduate students and academics, operated from the United States and serving researchers worldwide, including in the United States, the United Kingdom, Canada, and Australia. This policy covers the CiteDash websites and applications, signed-in workspaces, anonymous demo workspaces, and the public research forms our users publish. It does not cover third-party sites we link to, or the practices of your institution.

2. Information we collect

• Account information. The email address you sign up with, your chosen plan, and locale/preferences. If you sign in with Google, we receive your email from Google; we never see or store your password (authentication is handled by our identity provider).
• Your content. The documents and PDFs you upload, reference files you import, and the projects, libraries, notes, extractions, analyses, datasets, drafts, and manuscripts you create. Uploaded documents are parsed (including OCR where needed) so the platform can search, quote, and verify against them.
• Billing information. Handled by our PCI-compliant payment processor (named at checkout). We store your subscription status and a ledger of credit grants and usage; we never store card numbers.
• Usage and log information. Basic technical logs (timestamps, request metadata, approximate usage of features) needed to operate, secure, and meter the service, plus an audit trail of significant actions in your workspace, which exists primarily for you, as provenance for your research.
• Demo workspaces.The Explore demo uses an anonymous account. No email is collected unless you choose “Keep my work”, at which point the anonymous account becomes your account.
• Support communications. Messages you send us, so we can help you.

3. How we use information

• to provide the service: authenticate you, store your work, and run the features you invoke;
• to meter usage against your plan’s credit allowance and process payments;
• to secure the platform: prevent abuse, enforce rate limits, and investigate incidents;
• to support you and respond to your requests;
• to improve reliability: we review aggregate usage and traces of failed operations to fix bugs and improve quality;
• to comply with law.

We do not sell personal information, use your content for advertising, or use your content to train AI models, and we do not permit our AI providers to use it to train theirs.

4. AI processing

CiteDash’s features work by sending the relevant parts of your content (for example, passages of papers in your library, your notes, or a draft section) to third-party AI model providers to perform the task you requested (drafting, synthesis, screening, verification, OCR, embeddings). Three commitments apply to all of it:

• Task-scoped. Content is sent only as needed for the operation you invoke, not wholesale.
• No training. We use API tiers under terms that do not permit providers to train models on your content.
• Traceable. Model calls are logged in our observability tooling so we can audit quality, cost, and failures.

5. Service providers (sub-processors)

We rely on a small set of vetted infrastructure and AI providers to run CiteDash. Each is bound by agreements that limit it to processing data only to provide its service to us, and each falls into one of these categories:

We do not publish the named vendor list, but we make it available on request for legitimate review: for example, an institutional data-protection or procurement assessment. Email [email protected]. We may add or replace providers as the platform evolves; this section is kept current with material changes.

6. Research-participant (form respondent) data

CiteDash users can publish consented research forms and collect responses from participants. If you respond to such a form:

• The researcher is responsible for the study.The form describes the research and presents a consent statement before you answer; your responses go to that researcher’s project.
• Responses are structurally anonymous. You do not create an account, and we do not store your IP address or other network identifiers with your responses. Whether a form asks for identifying information is up to the researcher. Read the questions and consent statement before answering.
• To ask about or withdraw a response, contact the researcher who shared the form; if you cannot, email us at [email protected] and we will help route your request.

7. When we share information

We share personal information only:

• with the service providers listed above, to run the platform;
• when required by law, subpoena, or to protect the rights, safety, or security of CiteDash, our users, or the public, and where lawful we will notify you of such requests;
• as part of a merger, acquisition, or asset sale, in which case this policy continues to apply to your data and we will notify you of any change in ownership;
• with your direction or consent (for example, when you export or share your own work).

8. Data retention and deletion

• Active accounts. We keep your content for as long as your account exists, so your research is there when you return.
• Account deletion. Deleting your account from the Settings page permanently removes your projects, documents, libraries, drafts, ledgers, and other personal data from our production systems. Copies in encrypted backups are purged on the normal backup rotation cycle.
• Demo workspaces. Anonymous demo accounts and all their contents are automatically deleted approximately 7 days after creation unless converted to a real account.
• Billing records. We retain transaction records as required by tax and accounting law, even after account deletion.
• Shared scholarly index. The public-paper index (metadata and abstracts of published research) is not personal data and is not affected by account deletion.

9. Security

We protect data with encryption in transit and at rest, workspace-level tenant isolation enforced on every query, token-based authentication, least-privilege access to production systems, and audit logging. No system is perfectly secure, but security is a design constraint of the platform. See our Security page for the fuller picture. If we learn of a breach affecting your personal data, we will notify you without undue delay, consistent with applicable law.

10. Your rights and controls

Built into the product, no email required:

• Export: download all of your data as a file from the Settings page at any time.
• Delete: permanently delete your account and all associated data from the Settings page.

Beyond those controls, you have rights under the privacy laws of where you live. In every case, to exercise a right, use the built-in controls or email [email protected]. We respond to verified requests within the timelines the applicable law requires, we do not charge for reasonable requests, and we will never discriminate against you for exercising your rights.

• United States.If you live in California, the CCPA/CPRA gives you rights to know, access, correct, and delete personal information, and to opt out of “sale” or “sharing”. We do not sell or share personal information as those terms are defined by the CCPA, and we do not use sensitive personal information beyond what the service requires. Residents of other US states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, and Texas) have similar access, correction, deletion, and portability rights, which we honor through the same channels.
• United Kingdom and EU/EEA.Under the UK GDPR and the EU GDPR you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent where processing is based on consent. Our lawful bases are performance of our contract with you (providing the service), our legitimate interests (securing and improving it), and consent where required. You may complain to your supervisory authority; in the UK that is the Information Commissioner’s Office (ICO).
• Canada. Under PIPEDA (and substantially similar provincial laws) you may access and correct your personal information and withdraw consent, subject to legal or contractual restrictions. We are accountable for personal information in our control and answer access requests through the contact below. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
• Australia. We handle personal information consistently with the Australian Privacy Principles in the Privacy Act 1988 (Cth), including rights to access and correct your information. Complaints go first to us via the contact below; if you are unsatisfied with our handling, you may complain to the Office of the Australian Information Commissioner (OAIC).

11. International data transfers

CiteDash is operated from the United States, and the providers listed above process data primarily in the US. If you use the service from the United Kingdom, the EU/EEA, Canada, Australia, or elsewhere, your information will be transferred to and processed in the US. Where a transfer mechanism is required, we rely on appropriate safeguards: for UK and EU/EEA data, standard contractual clauses (with the UK Addendum or International Data Transfer Agreement as applicable) in our provider agreements; for Canadian and Australian users, contractual protections that hold our providers to obligations comparable to those in this policy. Your data receives the protections described here wherever it is processed.

12. Cookies and local storage

The product itself uses authentication tokens to keep you signed in and local storage to cache your workspace so pages load fast. We also use product analytics and, where enabled, Google Analytics and Google Ads measurement cookies to understand how CiteDash is used and whether our advertising works. Three limits apply to all measurement: your research content never rides along (page addresses are stripped of search and quote text before anything is recorded), research-participant form pages and shared-snapshot pages are never tracked at all, and blocking these cookies with your browser or an ad blocker does not affect the product. Clearing your browser storage signs you out and clears cached views; your work stays safely on the server.

13. Children

CiteDash is intended for graduate students, academics, and adult researchers, and is not directed at children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We will update this policy as the product and the law evolve. If a change is material, we will notify you (by email or an in-product notice) before it takes effect. The “Last updated” date above reflects the current version.

15. Contact

Questions or requests about privacy? Email [email protected] or write to CiteDash, 1111B S Governors Ave, STE 54769, Dover, DE 19904, United States.