Privacy
- Who runs this app
- Duke University, in Azure, East US 2.
- Who reads your text
- Duke's AI Gateway, which runs AI models for Duke (OpenAI directly when the gateway is unavailable). It receives the text of your messages and drafts, never your name, email address or account. Each call requests response storage off (storage flag: off). Your messages go to Duke's AI Gateway (OpenAI when it is unavailable) with your question, the current study plan, recent conversation turns, and bounded excerpts from earlier turns. Relevant saved waypoints and whether earlier proposals were accepted or declined can also accompany the conversation so the guide can respond to your study. We request response storage off on every call. The provider's abuse-monitoring retention is described below. When you have checked a draft and revealed a group of its findings, Paige also receives that group's findings and the lines of your draft they quote, so it can talk them through with you. The draft itself is not sent again or kept. If you set up the sample size planner from your conversation, your messages go to Duke's AI Gateway once, so it can suggest which kind of study and model fit. Nothing new is kept.
- Where a search string goes
- In a study plan, the literature search you run goes to Europe PMC (EMBL-EBI, United Kingdom) as a query, and nothing else of yours goes with it. This app keeps each search's query, date and counts in your study; the titles it shows are fetched each time and not kept.
- How long the provider may hold a copy
- Duke's AI Gateway keeps a record of each request, including the text sent, in a restricted Duke security audit log for 180 days. Replies are not kept there. Only authorized Duke platform, security and privacy staff can open it, for support, security reviews or investigations. When OpenAI is used as the fallback, it may keep request and response content for abuse monitoring for up to 30 days, unless the law requires longer. Your text is not used to train AI models.
- What this app keeps
- The report for each paste: item statuses, the lines from your draft that each finding quotes, and the arithmetic checks. Also a hash of the text, its word count, the time, your design choices, your question, and earlier versions of it when you change it, and the taps you make. Nothing else from a draft you check. If you attach a draft in a conversation, we keep its text in that study, encrypted, so Paige can refer back to it. You can delete it at any time, and it is deleted with the study or your account. In Designer, we keep the messages you send and the guide's replies in a conversation record, separate from your study plan. When you add a sample size planner run to the conversation, its inputs, results and assumptions are kept there, with what moves the answer. The plan keeps the words you submit and the choices you accept, including earlier decisions replaced by later ones. We also keep search queries, dates, and counts. We keep the conversation and plan until you delete them or the inactive-account deletion described below.
- How your text is protected
Your studies, your conversation with Paige, your attached drafts, your peer reviews, your study record, your searches, your readings and any feedback you send are encrypted with a key that belongs to your account. People with access to the database or its backups cannot read them without the app's own key.
PaperPrep can read them while it runs, so it can show you your work, send your messages to the AI service, show account names and email addresses to Eric on the admin page and, for course accounts, show conversations to the teaching team. This is not end-to-end encryption: we hold the keys, which is what lets you sign in on a new device with an email link.
- Downloading your work
- You can download a study, its conversation, or everything at once as a ZIP of text files. The app builds each file from what it already keeps, sends it to your browser and keeps no copy. It records only that a download happened and when. Once a file is on your device it is yours: deleting here does not delete it.
- AI use disclosures
- If you publish an AI use disclosure for a study, we keep each version you publish: its statement, the parts of the record you chose to show and any excerpts of your conversation you chose, encrypted with your account's key. We also keep your choices and the record's link. Nothing is public until you publish and turn sharing on. While sharing is on, anyone with the link can open the published record, and we ask search engines not to list it. Turning sharing off makes the link unavailable straight away, but copies anyone has already saved, printed or shared cannot be recalled. Deleting the study or your account deletes the disclosure and every version of it. Deleting the conversation deletes any version that shows excerpts from it.
- Peer reviews
- If you start a peer review, we keep the draft you give it, what you predicted the reviewers would ask, the place you plan to send it if you say, the reviewers' comments with the passages of your draft they quote, your answers, Paige's feedback and your checklist, encrypted with your account's key. We keep the draft so Paige can read the passage around a comment when you answer it. Your draft and your answers go to the AI service that runs the reviewers and Paige, as your messages do; your name, email address and account are not sent. The PaperPrep team sees only counts, such as how many reviews were run. Deleting the peer review, the study or your account deletes all of it.
- Sign-in records
- Each time you sign in, we keep a coded record of that sign-in: when it started and when it ends, not the sign-in link itself. It ends after 12 hours, when you sign out, or when you sign out on every device. Deleting your account deletes these records.
- Account and email
- We keep your verified email address in a protected account record, separate from your conversation and study plan. We use Resend to send sign-in links, a welcome email when you create an account, and reminders before an inactive account is deleted. Resend receives your email address and the email content. Your conversation and study plan are not included. Sign-in links expire after 15 minutes and work once. The app stores a hash of each link, not the link itself. If you choose to keep a course account, we also keep the dates of your choice and email verification. Your existing coded account identifier continues to connect your study records.
When you create a public account, we also ask for your first name, last name and country or region. We keep these details in an encrypted account record, separate from your conversations and study plans. They are not included in messages to the AI model or in sign-in and reminder emails. The welcome email greets you by your first name. We record when you accept the Terms of Use and acknowledge the Privacy notice, together with the versions shown. These account details and agreement records are deleted with your account under the same deletion and backup limits described here.
Eric, who runs PaperPrep, can see a list of accounts on an admin page. It shows each account's name, email address, country, the dates it was created and last used, counts of its studies, messages and drafts, and its AI cost. He uses it to see who uses PaperPrep and how. It does not show your conversations, studies or drafts.
- Service records
- We keep coded request counters briefly to limit repeated sign-in attempts. We remove expired links and counters during the hourly public-service check. We keep protected email payloads and delivery status so a retry can use the same message. Accepted delivery records are removed after 14 days. Uncertain deliveries can remain for review; account-linked email records are removed with the account. Aggregate usage emails contain counts and cost estimates, with counts from one to four suppressed. They contain no conversation, plan, draft, feedback or account identifiers.
- Usage limits and cost records
- During this pilot, you can make up to 10 requests that use the AI model each day. Up to three of them can be draft readings. We keep account-linked request dates, model names, price estimates and reservation status to limit usage and estimate model costs. We remove request details during the hourly public-service check once they are more than 30 days old, or when you delete your account. Aggregate daily and total cost estimates can remain without account identifiers or study content.
- Inactive accounts
- After 12 months without activity in your account, we schedule its deletion. We send reminders 30 days and 7 days beforehand. Returning to the app to read or work renews the activity period. Requesting or opening an email does not. You can delete your account sooner. If reminders cannot be confirmed, deletion is deferred rather than performed without notice. Database backups can retain a deleted copy for up to 7 days.
- Product feedback
- If you choose to send feedback, we keep your message, its topic, the app version and time, and a link to your PaperPrep account. Eric can read submitted feedback and record its review status. Your conversation and study plan are not attached. This is not anonymous. Feedback is separate from studies: deleting a study does not delete it. You can delete feedback on its own or by deleting your account. The same active-database deletion, term deletion and backup limits described on this page apply. Feedback is not sent to the model provider.
- Letting the PaperPrep team read your conversations
- You can choose to let the PaperPrep team read your conversations with Paige so we can improve it. It is off unless you turn it on. When it is on, the team can read what you and Paige write from that moment, on a review page that shows no name or email address and records each time a conversation is opened. Drafts you attach in the conversation are shown with it. Your study plan, and drafts you only check, are not shown. Turning it off hides all of it again.
- Logs
- Request paths, timings and the connecting IP address. No draft text appears in any log.
- Deleting
- You can delete a study, one reading, or a study's conversation while keeping its record, or delete everything this app holds about you. The app removes those records from the active database immediately. Database backups can retain a deleted copy for up to 7 days. Deleting your account also destroys its key, so any copy of your text left in the database can no longer be read. Backup copies, which hold the key for up to 7 days, are gone after that.
- Writing to us
- If you write to support@paperprep.org, your message is kept in our support mailbox, outside the app. Deleting your account does not delete it; ask us and we will.
Questions about your data: support@paperprep.org.
Short answers to common questions: Your research and PaperPrep.