DRAFT, pending review by Lean Discovery Group LLC. Not yet in effect. Written as a starting point and not legal advice; we recommend review by a qualified lawyer before publishing. Items marked TBD by owner still need a decision.

Citeproof Privacy Policy

Last updated: [DATE: set when Ethan approves]

Citeproof is operated by Lean Discovery Group LLC (Richmond, Virginia, USA), "we" or "us". This policy explains what we collect when you use the Citeproof website and the Citeproof app in ChatGPT, why, who we share it with, how long we keep it, and the choices you have. Questions: ethan@leandiscoverygroup.com.

1. What we collect

• Text you submit for checking. When you ask Citeproof to check a draft or reference list, the text is processed to extract the references. We store the extracted references, any claim you ask about, and the check results. We do not store the full text you paste.
• Account information (only if you sign in): your email address, an account ID from our sign-in provider, and your time-zone setting.
• Usage counts: how many checks you have used in the current period, so we can apply plan limits. For people who use Citeproof in ChatGPT without signing in, ChatGPT gives us an anonymized identifier for your ChatGPT account; we store only a one-way hash of it, next to your check count. We cannot use it to identify you.
• Billing (Pro plan only): payment is handled by Stripe on Stripe-hosted pages. We never see or store your card number. We store your Stripe customer and subscription IDs and your subscription status and renewal date.
• Technical logs: our hosting provider keeps short-lived request logs (for example, time, requested page and IP address) for security and to keep the service running.

We do not collect sensitive personal data, precise location, contacts, or your ChatGPT conversation history.

2. How we use it

Only to provide Citeproof: run checks and show results, apply plan limits, keep history and exports for Pro users, process subscriptions, respond to support requests, and protect the service from abuse. We do not sell personal data, show ads, or build advertising or behavioral profiles. We do not use your submitted text to train AI models.

3. Citeproof in ChatGPT

When you use Citeproof inside ChatGPT, ChatGPT sends Citeproof only the text and parameters needed for the request (for example, the references to check). Citeproof does not request, reconstruct or store your wider conversation. Tool results return only what's needed to answer your request. If you link a Citeproof account in ChatGPT, we receive an access token that identifies your Citeproof account, and we use it only to apply your plan, history and exports. You can unlink at any time in ChatGPT's settings. ChatGPT's own handling of your data is covered by OpenAI's privacy policy.

4. Who we share it with

We share data only with service providers that help us run Citeproof, each limited to what they need:

• Bibliographic databases (Crossref, DataCite and OpenAlex, plus doi.org): we send reference details such as titles, authors, years and DOIs to look up records. We never send your full text or your identity.
• Vercel: hosting.
• Upstash: database for accounts, usage counts and check results.
• Stripe: subscription payments and billing.
• Clerk: sign-in and account linking (once enabled).
• OpenAI: when you use Citeproof in ChatGPT, results are returned to ChatGPT so it can answer you.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or the service.

5. How long we keep it

• Check results for Free and anonymous use: 24 hours (so you can ask follow-up questions), then deleted automatically.
• Check history for Pro users: 180 days, then deleted automatically.
• Usage counts: until one week after the period resets.
• Account information: while your account is open. If you ask us to delete it, we delete it within 30 days.
• Billing records: kept by Stripe, and by us only as long as needed for tax and accounting obligations.

6. Your choices and rights

You can use Citeproof in ChatGPT without an account. Signed-in users can cancel a subscription at any time from the billing portal on the Account page. To access, correct, export or delete your data, email ethan@leandiscoverygroup.com from your account email. Depending on where you live, you may have additional rights; we will honor applicable requests. [TBD by owner, with counsel: state-specific and international (GDPR/UK) rights wording, and whether Citeproof is offered outside the US.]

7. Security

Data is encrypted in transit (HTTPS). Access to production systems is limited to the operator. No system is perfectly secure, but we work to protect your data.

8. Children

Citeproof is not intended for children under 13, and we do not knowingly collect their personal data.

9. Changes

We will post changes here and update the date above. If a change is material, we will give notice on the website before it takes effect.