Privacy

Your account. Your email address, the user id your sign-in provider gives us, and the rest of the record it hands back with them — for a Google account that is your display name and a link to your profile picture, both of which the Settings page shows back to you. No password, and no OAuth tokens.

Your API key, as a fingerprint only. We store a SHA-256 hash of it, never the key itself. Nobody at our end can read your key back, which is also why a lost key cannot be recovered and has to be replaced.

What you upload. Your results summary, data description, methods and plots, kept as files so you can see later what a paper was written from.

What the pipeline produces. The paper — PDF, LaTeX source and the bibliography it cites — plus the job’s status, title, and its log and error output if a run fails. Your plots are not returned as part of it; they are kept as what you uploaded, above.

These live in Google Cloud Storage and Firestore, in Google’s us-central1 region (Iowa, USA). They are not sold, not shared with advertisers, and not used to train anything of ours.

Writing a paper is not something that happens only on our servers. The pipeline calls external AI services, and the content of your submission goes with the request:

• Google (Gemini) and OpenAI — the models that write the paper. They receive your data description, methods and results, and the drafts produced from them.
• Perplexity or Valency — only if you turn on citations. Whichever of the two you pick beside Add citations receives the paper text in order to find references for it. Perplexity is the default.

We do not send your name or your email address to any of them, and we do not send your account id either.

We record the requests themselves. Every call the pipeline makes to those services is logged to our own tracing system, so that a paper that comes back wrong can be diagnosed and its cost accounted for. Those records include the prompt sent and the answer returned — and the prompt contains the text you submitted.

Unlike your papers, these records are not deleted on a schedule. Your retention setting governs the paper, its files and your uploads; it does not reach the trace of the request that produced them. They are kept on our own infrastructure, readable only by the team, and are not shared. We would rather say this plainly than let the retention setting imply more than it covers.

The same is true of Apollo’s ideas, if you use it. Apollo keeps every research idea it generates for you — its title and full description — in a store it consults later, so it can tell you when a new idea resembles one you have already seen. That is what its novelty score is built from, so those ideas are kept: deleting an Apollo session removes the session, and your retention setting governs the session, but neither removes the ideas from that store. Ask us if you want them erased.

Removing your name from a request does not make it anonymous. A results summary and a set of figures from unpublished work are a description of exactly what you are working on, and often of who you are. Treat anything you upload as something the providers above have seen.

If a piece of work is sensitive enough that this matters — patient-derived data, anything under an embargo or a collaboration agreement, anything you have not cleared for a third-party AI service — do not put it in here.

Delete a paper. Every document has a Delete button. It removes the job, everything you uploaded for it, and everything it produced, from our storage.

Two limits on that, both real. A download link the app has already handed your browser keeps working until it expires, which is up to an hour after you delete — the link is signed in advance and deletion cannot recall it. And a delete that cannot remove every file does not pretend it did: the files it managed to remove are gone, but the document stays in your list and you are told it failed, rather than the paper vanishing with an object left behind in storage. Pressing Delete again retries what is left. Email us if it keeps failing.

It does not reach the copies other people hold. Deleting here cannot remove anything already sent to Google, OpenAI, Perplexity or Valency — their retention is governed by their own terms, not ours. Nor does it remove the operational logs described below. We would rather say so than let the button imply otherwise.

Revoke your API key at any time on denario.empyrean-labs.io. A revoked key stops working within about fifteen minutes.

Delete your account, or ask for a copy of your data, by emailing us. There is no self-service button for either yet.

A year after you last opened it, unless you choose shorter. A paper, the files it produced, and the plots and results you uploaded with it are deleted that long after the last time anyone looked at that paper — not that long after you wrote it.

The difference matters if you work the way most people do. A paper submitted in June and revised in November when the reviews arrive is still in use, and opening it puts the full period back on the clock. Nothing you are still working with expires underneath you. What goes is what nobody has opened for that long.

You can shorten it. Settings offers 30, 90 or 180 days instead of a year. Choosing one moves everything you have already written onto the shorter schedule, not only what you write afterwards. You cannot choose longer than a year — that is the maximum this service keeps anything at all.

You can still delete anything sooner yourself, and that is immediate. The deletion happens whether or not we do anything: it is a rule set on the storage itself, so it does not depend on us remembering to run something.

No analytics, no tracking cookies, no advertising code, no third-party session recording. We do not have a mailing list and we do not sell data.

Our hosting providers keep ordinary web-server logs — IP address, browser, and timing — as every web host does. We do not use them to build a profile of you.

Our servers also log more than timings, and you should know what. When a run fails, the error text goes to Google Cloud Logging so we can find out why, and when the server rejects one of your files it logs the name of that file. A filename can say as much about unpublished work as the file does. We strip our own credentials out of that text before it is written, but not yours. These logs live outside the job document, so Delete does not reach them, and we have not set a retention rule on them — they last as long as Google Cloud Logging keeps them by default.

• Google Firebase — sign-in and account records
• Google Cloud (Cloud Run, Cloud Storage, Firestore, Cloud Logging) — compute, storage and operational logs
• Vercel — hosting for this website
• Google Gemini, OpenAI — paper generation
• Perplexity, Valency — citation search, when enabled; one or the other

Questions, deletion requests, or anything on this page that looks wrong: denario.astropilot.ai@gmail.com.