Privacy Policy

ResearcherFlow is run by Viking Labs, LLC. For anything about your data, including having it removed, write to us from the Help and feedback page.

When you create an account we store your username, your email address if you give one, the display name and role you set, your plan, and where you came from when you signed up (the campaign tags in the link you followed, if any). We also store what you add to your workspaces, such as papers, notes, questions and uploaded files.

If you write to us from the Help and feedback page, we store your message, your email address and the page you wrote from.

If you tick “Email me this summary” on the free paper summarizer, we store the email address you enter with the paper’s DOI and the time, and use it to send that one summary once. Leave it unticked and we store no email. To have an address removed, write to us from the Help and feedback page.

To find a paper for the free summarizer, we look up its DOI or paper id at public scholarly services: Crossref, DataCite, Semantic Scholar, OpenAlex, Europe PMC, Unpaywall, arXiv, bioRxiv/medRxiv and OSF. They receive only that DOI or id, never your email address or account.

If you subscribe to the newsletter, we store the email address, when it was entered and when it was confirmed. We send an email asking you to confirm, and nothing else until you do. Every newsletter email has a link to unsubscribe, which stops it at once.

When you use AI features, relevant parts of your workspace are sent to our language-model provider, the Anthropic Claude API, to generate responses. If Claude is unavailable or not set up, or a spending limit is reached, the request goes to OpenRouter instead. OpenRouter is told to use only model providers that keep no copy and collect nothing, and email addresses, labelled names and other identifiers are replaced with placeholders before the request leaves our servers.

Separately, when an embeddings key is configured on our servers, we send text to our embeddings provider, the OpenAI embeddings API by default, so AI features can find it. That covers content you save: papers, paper cards, notes, questions, manuscripts, artifacts, linked resources and Second Brain entries (Lab Wiki entries). It also covers the questions you ask AI features and the searches they run for you; what you type in a workspace’s search box is not sent. Saved content is sent when it is saved, not only when you use an AI feature.

When you ask for a literature scan of a research question, its text is sent as a search to arXiv and Crossref.

We do not use your data to train foundation models without your explicit consent.

All traffic to ResearcherFlow passes through Cloudflare, which sees your IP address and the addresses of the pages you request.

Payments are processed by Stripe. Checkout and the billing portal are hosted by Stripe, so your card details go to Stripe and not to our servers. Stripe also receives your username and account id with each checkout.

We send email through SendGrid, which receives the recipient address and the message: account emails, invitations and notifications, summaries you ask for, messages you send us from Help and feedback, and the newsletter. A message you send us from Help and feedback reaches our support inbox through SendGrid with your message and email address, your username and account id if you are signed in, and the page you wrote from. For the newsletter, SendGrid may record when an email is opened or a link in it is followed. SendGrid does not record opens or link clicks for account emails, notifications (such as an invitation or a password reset) or messages you send us.

If you link a GitHub repository, file or notebook, our servers fetch it from GitHub. If you connect Zotero, Mendeley, OSF, Slack or Microsoft Teams, or add a webhook, we send that service what the connection is for, such as the papers you sync or the updates you asked to post. The access tokens for these connections are stored encrypted.

We use PostHog to understand how the product is used. It receives the addresses of the pages you visit, without their query strings, and named steps such as signing up. It records no clicks, typing or screen recordings. Like any web service, it receives your IP address with each request.

We use Sentry on our servers to diagnose errors. By default it does not receive personal information such as IP addresses or what you submit.

We set three cookies, all to keep you signed in. rf_access (30 minutes) and rf_refresh (30 days) hold your session and cannot be read by scripts on the page; rf_signed_in (30 minutes) only tells the site that you are signed in. We set no advertising or cross-site tracking cookies.

Your browser’s local storage keeps your theme and text size, the last five papers you summarized, and a random identifier that PostHog uses to recognise a returning visitor. Session storage, which your browser clears when you close the tab, keeps short-lived steps such as a paper you are taking into sign-up.

Our servers keep standard access logs for each request: your IP address, the page address you requested, the time, and your browser’s user agent. We use these logs only to keep the service secure and working, and we delete them after 30 days. We also keep short-lived counters by IP address to prevent abuse, which expire within 24 hours. Separately, we keep a record of which papers have been summarized; that record does not include your IP address.

You can delete your account from Account settings. That deletes your account, the workspaces you own with everything in them, including uploaded files, the comments you wrote and your lab, and cancels your subscription at once. The rest of a paid period is not refunded.

Work you added to other people’s workspaces stays there, as part of their workspace, and so does a lab file you linked into one. Before you delete your account, you can download each workspace you own from its Export page.

Your newsletter subscription, summary emails and messages to us are kept apart from your account. Unsubscribe from the newsletter’s link, or write to us from the Help and feedback page to have them removed. Stripe keeps its own record of your payments, with your email address, username and account id.