Privacy policy
Last updated 17 September 2026.
PaperTok is an application for discovering and reading scientific research. This page describes what data is collected, why, where it is kept and who it is shared with. It is written from what the code actually does, not from a template.
In short
- You can use PaperTok without an account. The feed, search and the public pages work signed out, and nothing about you is stored.
- Analytics uses no cookies and never records which paper you read or what you searched for. You can turn it off in Settings.
- Nothing is sold and nothing is shared for advertising. Only the providers that make the app work handle your data.
- You can delete your account, and everything in it, from Settings → Privacy → Delete account.
- For anything else, write to nicomg60@gmail.com.
Who is responsible
PaperTok is a personal project, not a company. The data controller is its author, and the contact for anything to do with this data is nicomg60@gmail.com.
You can use PaperTok without an account
The paper feed, search and the public pages work without signing in. Without an account no profile is created and no activity is stored about you.
What is collected if you create an account
Sign-in is with Google or GitHub. PaperTok never sees or stores your password: Firebase Authentication handles the sign-in and only the result arrives here.
| Data | Where it comes from | What it is for |
|---|---|---|
| User identifier, email, name and profile picture | Google or GitHub, when you sign in | Recognising you between sessions and showing your profile |
| Public name, handle and bio | You write them | Your public profile, if you choose to have one |
| Lists, saved papers and highlights | Your use of the app | So your library is still there next time |
| Authors, institutions and topics you follow | Your use of the app | Building your feed and, if you turn them on, your email updates |
| Comments and content reports | You write them | Publishing the comment and moderating the conversation |
| Interactions with papers (likes, skips, reads) | Your use of the app | Not showing you the same paper twice, and ordering the feed |
| Language, theme and notification preferences | You choose them | So the app behaves the same on every device |
This data is stored in Google Firestore. The legal basis is performing the service you ask for when you create the account: without it there is no library, no personalised feed and no profile.
What is public and what is not
By default your activity is private. It becomes public only when you decide: when you publish a list, write a comment or turn on your public profile. What you publish can be reached by anyone with the link, search engines included. You can reverse it at any time from Settings; from then on it is no longer served, although a search engine may take a while to update its copy.
Email updates
If you turn them on, PaperTok emails you what is new from what you follow. For that it stores your email address, your sending preferences and an unsubscribe identifier, in Cloudflare Workers KV. Brevo sends the emails.
The legal basis is your consent, and you can withdraw it whenever you like: every email carries a one-click unsubscribe link, and you can also turn updates off in Settings. Unsubscribing deletes the subscription.
Analytics
PaperTok uses Vercel Web Analytics. It uses no cookies: to tell visits apart, Vercel derives an identifier from the browser itself that expires every day and cannot follow you from one day to the next or across sites. That is why you are not asked for permission before measuring. You can turn it off whenever you like from your account settings; if you do, the library is not even loaded.
The only thing sent is page views, with the path stripped of identifiers: reading a
specific paper is recorded as /public/paper/:id, and visiting an
author's profile as /explorer/author/:id. Which one never travels.
Neither do your searches or anything from your account.
Scientific sources and AI features
Searches and papers come from public repositories: OpenAlex, arXiv, PubMed, Europe PMC, bioRxiv, Semantic Scholar, CORE, OSTI, NASA ADS, INSPIRE, OpenReview, Hugging Face, Unpaywall and OpenCitations, among others.
Those queries do not leave from your browser: they go through an intermediate server on Cloudflare, so those repositories never receive your IP address. That server logs the volume of requests, to respect each source's limits, not who makes them.
Paper explanations and rewrites are generated by a language model (Google Gemini, with DeepSeek and Kimi as fallbacks). Those models receive the paper's text and the language and level you choose, never your identity or your email.
Who it is shared with
Nothing is sold and nothing is shared for advertising. Only the providers needed for the application to work are involved:
- Google (Firebase Authentication, Firestore) — accounts and app data.
- Vercel — hosting and page-view analytics.
- Cloudflare (Workers, KV) — the intermediate server and email-update storage.
- Brevo — sending the emails.
How long it is kept
Your account data is kept for as long as the account exists. You can delete it from Settings → Privacy → Delete account. That deletes your profile, your lists, your highlights, what you follow, your preferences, the email subscription and the sign-in account. Comments you have published remain, detached from your profile, so as not to break other people's threads; write to nicomg60@gmail.com if you want them deleted too.
Your rights
You can access, correct and delete your data, object to its processing, ask for it to be restricted and request a copy in a portable format. Much of this you can do from within the app, in the profile and account settings. For everything else, write to nicomg60@gmail.com.
If you believe the processing is not correct, you can lodge a complaint with the Agencia Española de Protección de Datos, Spain's data protection authority.
Storage in your browser
PaperTok keeps a few things in your own browser that are never sent to any server: the light or dark theme, the language, your choice about analytics and a session cache so the application does not reload from scratch when you come back. They are cleared when you clear the site's data.
Changes
If this policy changes in a meaningful way, the date at the top will be updated and the change will be announced in the application itself.