Privacy Policy

Effective date: 5 October 2026. This policy covers citereal.ai ("CiteReal", "we"). Questions go to davie@daviechen.com.

What you give us

• Account data. When you sign in with Google or GitHub we receive your name, email address and avatar from that provider. Email sign-in stores your email address and a hashed password or one-time code.
• Reference text and claims. The reference lists, claims and documents you paste or upload are the input to the product. We need them to run a check.
• Payment data. If you buy credits or a plan, Stripe processes the payment. We store your Stripe customer ID, the plan, and the invoice history. We never see or store card numbers.
• Support messages. Messages sent through the contact page are delivered to our support mailbox.

What happens to pasted text and uploads

To verify a reference, parts of it are sent to third-party scholarly databases as search queries: Crossref, OpenAlex, PubMed (NCBI), arXiv and Semantic Scholar. Each query contains the fields of that reference (title, authors, identifiers), not your account identity.

To parse references and to rank sources, text is sent to a large-language-model API (Google Gemini, with OpenAI as a fallback). These requests are used only to produce your result. We do not use your text to train models, and our providers' API terms do not permit them to train on it either.

• Without an account: the check runs and the result is returned. The run is stored with a hashed IP address for the daily free quota and is not linked to a person.
• With an account: the input and result are stored in your history so you can reopen and export them. You can delete runs from your account at any time; deleting your account deletes them.

Uploaded PDF and Word files are read in memory to extract the reference section and are not kept after the extraction.

Where data is stored

• Database: Neon (PostgreSQL), hosted in the United States.
• Hosting and request logs: Vercel.
• Transactional email (sign-in codes, receipts): Resend.
• Payments: Stripe.

Cookies and analytics

We set the cookies needed to keep you signed in and to protect forms. If analytics are enabled, they are first-party or privacy-preserving page-view counts; see the Cookie Policy for what is active.

Retention

Account data stays until you delete your account. Check history stays until you delete it or your account. Anonymous quota records are kept for 7 days. Payment records are kept as long as tax and accounting rules require.

Your choices

You can export or delete your history, update your profile, and delete your account from the settings pages. For anything else, email davie@daviechen.com and we will respond within 30 days.

Changes

If this policy changes materially we will post the new version here with a new effective date.