Privacy Policy

Last updated: July 11, 2026

Paper Atlas (the “Service”) respects users’ privacy and complies with applicable laws — including Japan’s Act on the Protection of Personal Information — as well as the Google API Services User Data Policy. This policy describes the information the Service collects and how it is handled.

1. Information we collect

• Email address: collected for account registration, login and identity verification.
• Display name / attributes (optional): collected only if you choose to provide them.
• Google account information: when you sign in with Google, we obtain basic profile information such as your email address (including the OpenID sub identifier).
• Files on Google Drive: limited to the https://www.googleapis.com/auth/drive.file scope; the Service accesses only files it created, or files you have explicitly opened through the Service. It never browses or searches your entire Drive.
• Google Docs document content (when using the add-on): under the https://www.googleapis.com/auth/documents.currentonly scope, the Google Docs add-on accesses only the document you currently have open, solely to insert and update citations and the bibliography. Document content is never sent to or stored on our servers; only your own library identifiers, the citation style, and locale are transmitted for formatting.
• Imported literature data: the PDFs and metadata you upload or register, and the tags and annotations you add.
• Usage records: to provide the service and prevent abuse, we may retain minimal records such as processing history and usage counts.

2. Purpose of use

We use the collected information solely to provide, maintain and improve the literature-management service, to authenticate users, to prevent abuse, and to respond to your inquiries. We do not use or sell the information for advertising purposes.

3. Limited Use of Google user data

The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we comply with the following:

• Google Drive data is used only to provide and improve the literature-management features we offer to you (storing and retrieving your literature PDFs).
• Google Docs data (the open document) is used solely to provide the citation and bibliography feature to you, and document content is neither transmitted externally nor stored.
• We do not use or transfer Google user data for advertising purposes.
• We do not allow humans to read Google user data, except with your explicit consent, for security purposes (e.g. investigating abuse or fraud), where required to comply with applicable law, or where the data is aggregated and anonymized for internal operations.
• We do not sell Google user data to third parties.

4. Handling of LLM (AI) API keys

Any LLM (AI) API key you configure is never stored on the Service’s servers. The key is kept only in your browser (IndexedDB) and is supplied per request via a request header when AI features run. On the server it is used only transiently during request processing and is never written to the database or logs.

5. Protection of Google Drive integration tokens

The refresh token used for Google Drive integration is stored encrypted (Fernet) on the server. You can disconnect the integration at any time from the settings screen, and the token is deleted when you do.

6. Provision to third parties

Except as required by law, we do not provide personal information to third parties without your consent. In providing the Service, we use the following external services:

• AI (LLM) providers: when AI features are used, the text to be processed is sent to the provider you select.
• Google: used for login authentication and Drive integration.
• Infrastructure and monitoring providers: we may use subcontractors for hosting, databases and error monitoring, subject to appropriate oversight.

7. Retention and deletion

You can close your account at any time via “Delete account” on the settings screen; upon closure, all data linked to that account (literature, tags, annotations, integration tokens, etc.) is deleted immediately. You can also delete individual data on the Service at any time.

8. Contact

For inquiries about this policy, or to request disclosure, correction or deletion of collected information, please contact us:

• Service name: Paper Atlas
• Operator: Paper Atlas operator (individual)
• Contact: [email protected]

Related: Terms of Service