Privacy

The short version

Papertrek holds your manuscripts, the account details needed to log you in and write to you, and a small amount of technical data that keeps the service working. It runs on a server in Germany. Nobody sees your work unless you share it. If you join a manuscript someone else shares with you, its author sees your name and email address. You can export everything or delete your account at any time, and deletion is immediate.

What’s stored

• Your name and email address, so you can log in and we can write to you, and, if you join a manuscript someone shares with you, so its author can see who joined.
• Your ORCID iD, if you sign in with ORCID or import from it.
• If you turn on notifications on a device: that device’s push address (issued by the maker of your browser), two encryption keys for it, the browser’s name, and when it was added and last seen — one row per device, nothing about any notification’s content.
• The date the beta founder note was sent to you — stored so it can only ever be sent once. It is in your export and it goes when your account goes.
• Which entries of your ORCID record we have already offered you, kept as ORCID’s own reference numbers for them — no titles, no DOIs. That is what lets the nightly sync leave a work you deleted deleted, instead of adding it back the next night. It goes when your account goes.
• Everything you enter about your work: titles, abstracts, notes, co-authors, journals, submissions, reviewer notes, deadlines and links — and each work’s stage history, which the app records as you move it and you can edit or clear.
• If you share a manuscript: its invite link, stored only as a one-way fingerprint so the link itself cannot be read back from our database, with its expiry date; the people who joined, each with their current name and email address, the date they joined, and whether and since when they asked for update emails; and, for anyone you removed, a note that they may not rejoin through that link.
• If you signed up through a co-author’s invite link, a fingerprint of that link is kept on your account until you join or dismiss the invitation, at most 30 days, so the Join button can wait for you after you confirm your email address.
• A session cookie, so you stay logged in — plus, stored with the session, the IP address and browser you signed in from. That is how a session can be told apart from an intruder and how abuse is rate-limited; it is kept while the session lives (up to 30 days) and is never used to profile you. No tracking cookies, no third-party analytics, no ad-tech.
• Bug reports you send from inside the app: your message, the page you were on, your browser, the app version, and — if you reported a crash — its error reference. The operator reads these next to your name and email in order to answer them.
• How you found us, if you register: when the link that brought you to the signup page carried a campaign tag (say, “reddit”) or came from another website, that tag and that site’s address, or, if you came through a co-author’s invite link, just the word “invite” (never whose), are written once to your account at registration — alongside your answer, if you give one, to the one-question “How did you hear about Papertrek?” in the app. This is a single note made at signup, not tracking: nothing is stored on your device for it, nothing records your browsing, and it is never updated afterwards. Visitors who never register leave nothing.
• Anonymous usage counters: how often a feature is used per day — one number per feature per day, nothing else. No user id, no account id, no IP address is stored with these counts, so they cannot be traced back to you. They exist to learn which features matter during the beta.
• Anonymous visit statistics on the public pages (this site and the login screens — never the app you log into): a self-hosted, cookie-free analytics tool (Umami) on our own server records page views with referrer, browser, operating system, device type, screen size, language and approximate location (country and city, derived from the IP address — the IP itself is not stored). It stores nothing on your device, visitors are distinguished by a hash that changes daily, and the data never leaves our server.
• Error logs. When something fails — a mail that will not send, an ORCID lookup that times out — the server writes a line about it, which can contain an email address or an ORCID iD. These are operational logs on our own machine, kept no longer than needed to fix the problem. There is no web access log: nothing records which IP address requested which page.

Why, and on what legal basis

• Running the service— your account, your manuscripts (for the co-authors named in them, see “Co-authors and other people you record” below), the calendar feed, sharing links, and the emails that make an account work (confirmation, password reset, deletion receipt): performance of our contract with you, Art. 6(1)(b) GDPR. Without this data there is no service; providing it is required to have an account.
• Deadline reminders— also contract performance: they are a feature you switched on by creating a deadline, and you can delete the deadline or mark it done to stop them. The same reminder as a notification on a device is the same feature on a second channel, switched on by you on that device and switched off there too; the subscription your browser keeps for it is strictly necessary for a service you explicitly requested (§ 25(2)(2) TDDDG).
• Sharing a manuscript with co-authors— showing a manuscript you share to the people who join it, the email you get when someone joins, and the update emails a member switches on for themselves: performance of our contract with you and with them, Art. 6(1)(b) GDPR. You ask for it by creating the link, they ask for it by pressing Join, and either side can end it at any time. Two parts rest on legitimate interest, Art. 6(1)(f), instead. Showing you each member’s name and email address: an invite link can be forwarded, and you need to know who can read an unpublished manuscript. Showing members the names and roles of the other authors recorded on the manuscript, with its submissions, decisions and stage history: those authors have no contract with us, and the interest, theirs, yours and ours, is in keeping the authors of one paper informed about it. Anyone affected can object under Art. 21 GDPR at any time: a member by pressing Leave, which ends it at once, and a co-author named on the manuscript by writing to the address below.
• The beta founder note— the single message the operator sends during the open beta, in your first week, asking what to fix: our legitimate interest in learning what is wrong with the software while it is still being built, Art. 6(1)(f) GDPR. It is sent once per person and never again. You can object at any time under Art. 21 GDPR — the message says so and tells you how, and one reply is enough. Objecting costs nothing but the reply.
• Session IP and browser, rate limiting, error logs, backups— our legitimate interest in keeping the service secure, available and recoverable, Art. 6(1)(f).
• Anonymous counters and visit statistics— legitimate interest, Art. 6(1)(f), in knowing which features are used and whether anyone reads these pages. Neither can be traced to a person.
• The signup-source note— legitimate interest, Art. 6(1)(f), in learning which of the handful of places we talk about Papertrek, including an invitation from a co-author, actually brings researchers here during the beta, and whether people who came from each place keep using it. For an invitation, the note records only that you came by one, never who invited you or to which manuscript. It is ordinary account data: included in your export, deleted with your account.
• Aggregate figures— totals the operator computes from account and manuscript data, such as how many accounts are active or came back after their first day, how many manuscripts are shared and how many people joined them: legitimate interest, Art. 6(1)(f), in learning whether the beta works. Only totals are looked at, nothing is stored about you for them, and nothing is linked between accounts.
• Payments — none. Papertrek is free and processes no payment data. Tips happen at Ko-fi or PayPal and never reach us (see “Tips” below).
• No processing here relies on consent, so there is no consent to withdraw. No automated decision-making or profiling takes place.

Who else sees it

Nobody sees your work unless you share it: your data is private to your account and isolated at the database level, and whatever you share is read through a narrow, read-only view of only what you chose to share. These are the routes by which anything leaves your account or the server.

• Hosting.The application, its database and its backups run on servers operated by netcup GmbH (Germany) under an Art. 28 data processing agreement. Your data is stored in the EU.
• Email. Papertrek sends you a confirmation link, password resets, a deletion receipt, a short notice if someone tries to sign up with your address, and — if you have deadlines — a reminder digest. Those digests contain the titles of your deadlines and the manuscripts they belong to, so those titles travel through the mail servers of netcup GmbH (Germany, same agreement) to your mailbox. If you share a manuscript, you also get an email naming each person who joins it. If you have joined someone else’s manuscript and switched on its updates, you get at most one email a day when its author logs a decision or a stage change: the manuscript’s title, what changed and when, nothing from its notes and never any advertising; the link in every such email switches them off. These emails travel through netcup’s mail servers like every other Papertrek email, and then to whichever mail provider the recipient uses. Papertrek never sends invitations: an invite link reaches other people only if you send it yourself. We never write to anyone about an invitation; someone without an account gets email from us only if an account is created with their address (the confirmation link) or if they write to us first. During the open beta you also get one personal note from the operator, about a day after you sign up, unless you signed up through a co-author’s invitation, asking what he should fix; it contains nothing but your first name, it is sent once and never again, and replying to it writes to him directly. If you would rather not have it, one reply saying so is enough — the note itself says that too.
• Push notifications. If you turn them on for a device, a reminder is also handed to the push service of that browser’s maker — Apple, Google or Mozilla, in the United States — as an encrypted message they cannot read (the keys live in your browser). What they see is that one was sent to your device, and when. It contains the deadline lines the mail carries, never a manuscript title, and only reaches a device where you switched notifications on; turning them off there, or Remove in Settings, ends it.
• The contact form. What you write on /contact — your message and the address you give for a reply — is emailed to the operator and not stored anywhere else. Nothing about you is kept if you never write.
• Crossref. When you fetch or import metadata we ask Crossref about a DOI. That request tells Crossref that a DOI was looked up, not who looked it up.
• ORCID. When you import, we ask ORCID for the public works on your record. If you have connected your ORCID iD, we also do this automatically once a day so new publications appear on their own — without you present. That request contains your ORCID iD, so ORCID can see which researcher was looked up and when.
• Payments. Nothing is sold, so no payment data is shared with anyone. Should that ever change, the processor would be named here first, and we would still never see or store card details.
• Tips. The support page links to Ko-fi and PayPal. Whatever happens there is between you and that provider under its own terms; Papertrek receives nothing about it and never connects a tip to an account. Every few months your board shows a line that asks; your browser keeps the days you opened the board, when the line was shown, closed or followed on your device only, so it stays quiet afterwards. The server sees just an anonymous daily count of lines shown and followed.
• Anyone you give a link to, and co-authors you invite. See the next section. Those are your decisions, and you can end each of them at any time: ending one stops all further access at once, but it cannot take back what someone has already read, copied or received by email.

Crossref and ORCID are based in the United States, as are the push services of Apple, Google and Mozilla. What reaches them is narrow, a DOI, an ORCID iD or an encrypted notification, and each is contacted because you asked for a feature that needs them. People you invite to a shared manuscript can be anywhere, including outside the EU, in countries for which there is no EU adequacy decision. What they see is shown to them because you invited them, and it is limited to what is listed under “What you can share”. If they switch on update emails, those emails reach whichever mail provider they use.

What you can share, and how far it reaches

• Co-authors you invite to a manuscript see that one manuscript, read-only, on their own Papertrek board: its title, type, stage and abstract, the names and roles of the authors recorded on it, its submissions (journal, dates, status), its review rounds (decision, date, due date), the revision deadlines Papertrek created from them, and its stage history. They never see your notes, reviewer or journal notes, manuscript numbers, files or links, target journals, deadlines you created yourself, or any other manuscript of yours, and they do not see each other. Each manuscript has one invite link, and Papertrek never sends it; you do. Anyone who opens it sees your name, not the manuscript. For 30 days, up to 10 members at a time, each with their own account, can join through it without asking you first. You get an email when someone joins, you see each member’s name and email address, and you can remove anyone, who then cannot rejoin through that link. New link ends the old link at once, and Stop sharing ends every membership. Members who switch on updates get an email with the manuscript’s title and the decision or stage change you logged.
• A manuscript someone shares with you appears on your board, read-only, for as long as its author keeps sharing it with you. Its author sees your name and email address and gets an email with your name when you join; other members do not see them. It never appears in your calendar feed, deadline reminders, push notifications, supervisor links or the counts on your board; the only email it can cause is the update email, if you switch that on. It disappears if the author removes you, stops sharing, or deletes the manuscript or their account, and Leave removes it whenever you like.
• A work you mark public is readable by anyone holding its link. Turning sharing off makes the link stop working at once; turning it on again revives the same link.
• Your publication page at /u/your-name lists the works you have marked public, under your name. It is a public web page: search engines can index it if they find it. The embeddable version of the same list asks search engines not to.
• A supervisor link shows anyone holding it the titles of all your works — including ones you have not made public — which stage each is in, and your open deadlines, including the decision an automatic revision deadline was created from. It never shows your notes, reviewer comments or files. Delete it in Settings and it dies at once.
• Your calendar feed needs no password and carries your deadline titles and the manuscript titles they belong to. If you subscribe to it in Google Calendar, Outlook or Apple Calendar, that provider fetches and stores those titles under your own account there. Treat the link as private; you can regenerate it in Settings, which kills the old one.

Co-authors and other people you record

Papertrek stores the co-authors you enter or import, usually a name and sometimes an ORCID iD, affiliation or role, as part of your records. Some of it arrives from Crossref or ORCID metadata rather than from you. It is there to describe your work. If you mark a work public, the names on it appear on its public page. If you share a manuscript with co-authors, the people who join see the names and roles recorded on it, together with its submissions, decisions and stage history, never an ORCID iD, affiliation or email address. It is never used to build a profile or to contact anyone, no entry is ever linked to a Papertrek account, and nobody is told whether a co-author has one. Papertrek has no way to reach a co-author who has no account, so this page, linked from every invitation page, is how they are told. We keep and show these entries on the basis of legitimate interest, Art. 6(1)(f) GDPR: yours and ours in describing your work correctly, and that of a paper’s authors in being kept informed about it. They are kept for as long as the researcher who entered them keeps them, and members stop seeing them when they leave or sharing ends. A co-author who finds themselves on a page of yours or in a shared manuscript can write to the address below: within a month, we will correct or remove the entry together with the researcher who entered it, or keep their name out of what members see. They can also object under Art. 21 GDPR and complain to a supervisory authority.

How long it is kept

• Your account and everything in it: until you delete it.
• Login sessions, with their IP address and browser: up to 30 days.
• Bug reports: until you delete your account.
• Invite links: until they expire, 30 days after they were created, or until you replace them, stop sharing or delete the manuscript; expired links are deleted within a day.
• Memberships, with the member’s name and email address: until the member leaves, the author removes them or stops sharing, or the manuscript or either account is deleted.
• The note that a removed member may not rejoin: until the link it guards expires or is replaced (at most 30 days), sharing stops, or either account is deleted.
• An invitation waiting on a new account: until you join or dismiss it, and never longer than the link itself is valid (at most 30 days).
• Notification subscriptions: until you turn them off on that device or remove it in Settings, at the latest 90 days after that browser last opened Papertrek, and with the account.
• Anonymous counters and visit statistics: kept indefinitely — they contain no personal data to expire.
• Encrypted backups: 14 days on the server, 90 days offsite, then deleted. They exist to survive a dead machine and are never opened to restore one account.

Your data, and your rights

Settings has a one-click JSON export — your account, works, submissions, rounds, deadlines, work history (stage changes and dated notes), authors, journals, files, your ORCID connection, notification devices, bug reports, sharing links, the people who joined manuscripts you share (name, email address, date joined) and the manuscripts you have joined (author, title, date joined, your email setting) — and account deletion. Deletion is permanent and immediate: there is no soft-delete, and no backup we will restore for you afterwards. Deleting your account also takes you off every manuscript you joined, and takes every manuscript you shared off its members’ boards. Export first if you want a copy.

You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to how it is used, and to take it elsewhere. Export and deletion are the two buttons in Settings. For anything else — including correcting your name or email address, which has no button yet — write to the address below and it will be done. You may also complain to a supervisory authority; for the operator that is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, though you may approach the authority where you live.

Who is responsible, and how to reach us

Papertrek is operated by Dr. Marian Sauter, Schlößlesgasse 3, 89077 Ulm, Germany — the controller in the sense of Art. 4(7) GDPR. Write to contact@papertrek.app about anything on this page; full details are in the imprint.