Privacy Policy

Last updated: June 11, 2026

Overview

PaperPilot is a browser extension and web app for tracking conference deadlines, managing research projects, and citing papers inside Overleaf. This policy explains what we collect, how it's stored, who we share it with, and your rights. It covers the extension, the web app & marketing website at getpaperpilot.com, and our optional account & sync. PaperPilot is operated under the name PaperPilot; for any privacy question or request, contact hello@getpaperpilot.com.

Two ways to use PaperPilot

• Without an account (default): everything stays on your device. We don't collect personal data — see "Local-only data" below.
• With an account (optional): if you sign in to sync across devices, we store your account email and the data you choose to sync on our servers. You can export or delete it any time.

Information we collect when you sign in

Signing in is optional and only needed for cross-device sync. If you sign in, we collect:

• Email address — to send your one-time sign-in code and identify your account.
• Profile details you choose to provide — display name, institution, and research field(s). All optional; you can skip or edit them any time.
• Synced app data — your tracked-conference watchlist, custom conferences, projects/tasks, and settings, so they appear on all your signed-in devices.
• Documents you upload — files you add to the Document Board (for example résumé, CV, cover letter, or transcripts; PDF/DOC/image). These are stored in a private, per-user cloud folder (a Supabase Storage bucket) that is access-controlled to your account, so you can reuse them across devices and attach them to applications. We don't read the contents.
• Application autofill profile (optional) — if you use the form-autofill helper, the details you enter to fill job/fellowship applications (such as name, email, phone, location, education, and work experience). These are stored with your synced data and used only to fill forms you choose to.
• Email-updates preference — whether you opted in to occasional product-update emails (unchecked by default; opt-in only).

We do not collect passwords (sign-in is a one-time email code), payment information (PaperPilot is free), or your browsing history.

Marketing website & waitlist

This is separate from the extension's no-account mode below. If you join the early-access waitlist on getpaperpilot.com, we collect the name and email you submit so we can send you PaperPilot product updates and let you know when access opens. We store it with our infrastructure providers (Cloudflare and the email provider, Resend), use it only for PaperPilot updates (never sold or shared for advertising), and every email includes an unsubscribe link. You can opt out any time, or email hello@getpaperpilot.com to be removed.

Local-only data (no account)

When you're not signed in, PaperPilot stores everything locally in your browser (Chrome storage / localStorage) and it never leaves your device — your tracked conferences, custom conferences, projects & tasks, activity log, archive/trash, settings, and a cached copy of the public conference database for offline use.

Optional AI Connector

PaperPilot offers an optional Connector that lets your own AI assistant (for example, Claude) manage your PaperPilot data — deadlines, projects, tasks, and notes — on your behalf. The Connector only ever accesses your own account data, the same deadlines, projects, tasks, and notes already covered by this policy; it never exposes your data to other users, and every action is scoped to your account.

You connect in one of two ways: with a personal access token you generate in the extension (shown once, so save it somewhere safe), or by signing in with your email via a one-time code (an OAuth flow). When you connect through the email/OAuth flow, your email address is stored in the connection grant for that session — it lives in temporary key-value storage and the access token expires after about an hour.

Nothing about your research content is sent anywhere new through the Connector — it drives your workflow data (deadlines, projects, tasks, notes) only.

How we use your information

• To provide the service — sync your data across devices and personalize your deadline feed to your field(s).
• To sign you in (one-time email codes).
• To send product-update emails only if you opted in (unsubscribe any time).
• To keep the service reliable and secure (see Telemetry).

We do not sell your personal data and do not use it for third-party advertising. Profile information you provide may be used to improve and personalize PaperPilot and our related research tools.

Telemetry

The extension sends a small amount of content-free diagnostic telemetry (e.g. "sign-in succeeded", "sync error") to our Cloudflare Worker to keep the product working. These events are a fixed whitelist of event names with no personal content, are not tied to your identity for advertising, and expire automatically.

Network requests

• Conference data: the extension fetches a public JSON file from getpaperpilot.com/data/deadlines.json (plus a tiny version manifest) to keep the deadline database fresh — public GET requests containing no user data.
• Account & sync (signed in): requests to Supabase to sign in and sync your data.
• Citation search: see Semantic Scholar below.

Extension permissions

• storage — save your data locally.
• alarms — refresh the badge countdown and check reminders.
• sidePanel — open the kanban side panel beside Overleaf.
• notifications — optional deadline notifications (off by default; opt-in).
• host_permissions — overleaf.com (citation helper / nudge bar), our Supabase project (sign-in & sync), and api.crossref.org (used only for the optional abstract preview on Google Scholar, below). The editor features only activate on overleaf.com/project/* pages.

The extension can also detect two things on your device, using text already loaded in your browser: (a) conference submission deadlines on web pages you visit (for example, a Call for Papers page), and (b) job/fellowship application forms, so it can offer to attach a résumé you've saved. Both run entirely on your device — no page content is ever sent to any server, and we don't collect your browsing history. You can turn each off in Settings ("Detect deadlines on web pages" and "Resume helper on application pages").

On Google Scholar, the extension can badge search results with journal/conference quality signals (SCImago SJR quartile, ABDC rating, CORE conference rank, and predatory-journal warnings). This matching runs entirely on your device against a bundled public dataset — no data leaves your browser. The one exception is the optional abstract preview: if you click "abstract" on a result, that paper's title is sent to the public Crossref API to fetch its abstract (no cookies or account data are sent). Turn the whole feature off in Settings ("Journal ranks on Google Scholar"). PaperPilot is an independent tool and is not affiliated with or endorsed by SCImago, ABDC, or Google Scholar.

Service providers we share data with

We use a small set of trusted providers to run PaperPilot, sharing only what each needs to do its job:

• Supabase — authentication, database, and private file storage for accounts and synced data (email, profile, watchlist, projects, settings, your application autofill profile, and the documents you upload — held in a per-user, access-controlled Storage bucket). Supabase privacy.
• Resend — sends your one-time sign-in codes, waitlist confirmations, and (if you opted in) product-update emails. Resend privacy.
• Cloudflare — our API Workers: the citation proxy, diagnostic telemetry, the waitlist/newsletter sync, the optional AI Connector (above), and — when you share a project or use Circles — the collaboration service that delivers your invites and shared-project data to the people you invite. Cloudflare privacy.
• Vercel — hosts the site + web app and provides anonymized, cookieless analytics/performance metrics. Vercel privacy.
• Microsoft Clarity — aggregate heatmaps / anonymous session recordings on the marketing site only, and only after you accept the cookie banner; sensitive inputs (incl. email/name fields) are masked. Clarity terms.
• Semantic Scholar & Crossref — when you use citation search or verification, your query is forwarded via our Cloudflare Worker to the Semantic Scholar API and Crossref. The Worker doesn't log queries beyond transient request logs or tie them to your identity.
• Google Fonts — dashboard typography.

We do not use Google Analytics, ad-network tracking, or Facebook Pixel.

Your rights

Whether or not local law requires it, signed-in users can:

• Access & export your data — "Export" in the signed-in menu downloads a JSON copy.
• Delete your account and all synced data — "Delete" in the signed-in menu permanently removes it from our servers.
• Correct your profile any time, and withdraw consent for product emails (unsubscribe link in every email).
• Nominate another person to exercise your rights if you die or become incapacitated, and complain to us or to a data-protection authority.

Depending on where you live you may have additional statutory rights — for example under the EU/UK GDPR, California's CCPA/CPRA, or India's Digital Personal Data Protection Act, 2023 (under which we act as the "Data Fiduciary" for your personal data). These include rights to access, correct, delete, or restrict processing, withdraw consent, nominate, and complain to the relevant authority (in India, the Data Protection Board). Email hello@getpaperpilot.com to exercise any of these — see "Grievance redressal" below.

Data retention

Synced account data — including the documents you upload and your autofill profile — is kept until you delete it (or delete your account), at which point it is removed from our database and file storage. Diagnostic telemetry expires automatically (within about two weeks). Waitlist name/email is kept until you unsubscribe or ask us to remove it. Local-only data lives on your device until you clear it.

International data transfers

Our providers (Supabase, Resend, Cloudflare, Vercel) may process data on servers outside your country. By using PaperPilot's account features you understand your data may be transferred to and processed in those locations under each provider's safeguards.

Cookies and Tracking Technologies

PaperPilot uses a small number of cookies and similar technologies. The extension and web app do not use advertising or tracking cookies; the marketing site (getpaperpilot.com) uses limited analytics technologies described below.

Types of cookies

Cookies are small text files placed on your device by a website. They fall into the following categories, all of which may be present on getpaperpilot.com:

• Strictly necessary cookies — essential for the site to function. They do not require consent and cannot be switched off. They are typically set in response to actions you take such as navigating between pages or loading site assets.
• Functional cookies — remember your preferences and choices (such as cookie consent status) to improve your experience. Disabling them may affect how the site behaves but will not prevent access.
• Analytics cookies — collect anonymised or aggregated information about how visitors use the site (pages visited, time spent, navigation paths). No personally identifiable information is stored. These are non-essential and require your consent before being set.
• Third-party cookies — set by external services we use (Microsoft Clarity, Google Fonts) rather than by PaperPilot directly. These are governed by the respective provider's privacy policy and are outside PaperPilot's direct control once set.

We do not use advertising cookies, profiling cookies, or any cookie that tracks you across unrelated third-party websites.

What we use and why

How cookies are processed

When you visit getpaperpilot.com, your browser sends a request to our servers hosted on Vercel. At this point, only strictly necessary and functional cookies are active. If you accept analytics cookies via the consent banner, Microsoft Clarity is initialised and may set its own cookies on your device. These cookies are read on each subsequent page load to maintain session continuity and record interaction data (mouse movements, clicks, scroll depth) in aggregated, anonymised form. No cookie data is combined with your PaperPilot account information or used to identify you personally. Cookie data is processed on Microsoft's infrastructure under their data processing terms and is subject to their retention and deletion policies.

Google Fonts are loaded via a standard HTTPS request to fonts.googleapis.com. Google may process your IP address and User-Agent string as part of this request; no persistent cookie is set by PaperPilot for this purpose, though Google may log the request per their own policies.

Vercel Analytics operates without cookies entirely, using server-side aggregation of anonymised request data. No individual user is tracked or identifiable from this data.

Your choices

Non-essential cookies (Clarity) are only placed after you accept via the cookie banner on the marketing site. You may withdraw consent at any time by clicking "Cookie Preferences" in the site footer, or by configuring your browser to block or delete cookies. Blocking functional cookies will not affect your use of the extension or web app. You can also opt out of Microsoft Clarity directly at https://privacy.microsoft.com.

Cookie retention

Security

Account data is protected by row-level security so you can only access your own records, and is transmitted over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your information. In the event of a personal-data breach that affects you, we will notify you and the relevant authority where required by law.

Children's privacy

PaperPilot is intended for researchers and is not directed to children. We do not knowingly collect personal data from children — under 13 (or 16) in jurisdictions that use those thresholds, and under 18 in India under the DPDP Act, where processing a child's data requires verifiable consent from a parent or guardian. We do not knowingly profile children or serve them targeted advertising. If you believe a child has provided us data, contact us and we will delete it.

Changes

If this policy changes materially, we'll update the "Last updated" date above and, for significant changes affecting signed-in users, may notify you by email.

Grievance redressal

If you have a complaint about how we handle your personal data, contact our Grievance Officer at hello@getpaperpilot.com (postal address available on request). We will acknowledge and address grievances within the timelines required by applicable law. If you are in India and remain unsatisfied, you may escalate to the Data Protection Board of India.

Contact

Questions or requests about this policy or your data: hello@getpaperpilot.com. See also our Terms of Service.