Privacy Policy

Account data

When you register, we process your name, email address, and password (stored in hashed form), as well as your plan and account settings. You can also add optional information such as a profile picture. We use this data to provide your account and the service (Art. 6 (1) (b) GDPR).

Documents and project data

The documents, files, and projects you create or upload are stored so we can provide the editing and collaboration features you use. If you collaborate with others, the project members you share with can see your name and the content you contribute (Art. 6 (1) (b) GDPR). If you create a share link, anyone who has the link can open the project with the access the link grants, in some cases without an account.

Service emails and invitations

We send you the emails needed to provide the service, such as verification codes, password resets, and notifications about your account and projects (Art. 6 (1) (b) GDPR). When you invite someone to a project, we send an invitation to the email address you enter, including your name and the name of the project. We process the invited person’s email address to deliver the invitation and let them join (Art. 6 (1) (f) GDPR; our and your legitimate interest in working together on projects).

Payment data

Paid subscriptions are processed by our payment providers Stripe and PayPal. Your payment details (such as card numbers) are collected and processed by the provider, not stored by us; we receive confirmation of payment and the data needed for invoicing (Art. 6 (1) (b) GDPR and our statutory retention obligations under Art. 6 (1) (c) GDPR). Please see the privacy policies of Stripe and PayPal for details on their processing.

Sign-in providers

If you sign up or log in with Google or LinkedIn, the provider shares your name and email address with us once you authorise it, and we use them to create and identify your account (Art. 6 (1) (b) GDPR). The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; they process your sign-in under their own privacy policies. If your university or organisation offers single sign-on, we receive your username, name, and email address from its login service for the same purpose.

GitHub and Mendeley

If you connect your GitHub account, we store an access token and your GitHub username, name, email address, and profile picture URL, and we read from and write to the repositories you link to your projects to synchronise their files (Art. 6 (1) (b) GDPR). GitHub is provided by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you disconnect GitHub, we delete the stored token; to also revoke our access on GitHub’s side, remove our app under Settings → Applications on GitHub.

If you connect Mendeley, we store access tokens and your Mendeley name and email address, and read your Mendeley profile and library to import references into your projects as BibTeX (Art. 6 (1) (b) GDPR). Mendeley is a service of Elsevier.

Server logs

When you access the service, our servers temporarily record technical data such as your IP address, date and time of the request, the requested resource, and browser information. We use this data to operate the service securely and to diagnose faults (Art. 6 (1) (f) GDPR). Log data is deleted after 30 days.

Contact requests

If you contact us via a contact form or email, we process the data you provide to handle your request (Art. 6 (1) (b) or (f) GDPR).