Privacy Policy

01What is stored about you

Only what the product needs to work. When you make an account and use it, the following is held:

• Your email address, and a display name if you set one.
• Your discipline and the sub-specialties you chose during onboarding.
• Which papers you saved, and any private note you wrote on one.
• Collections you created and which papers are in them.
• Which full summaries you opened, recorded as a paper reference and a month — this is what the free monthly allowance counts.
• Whether you accepted the acknowledgements at sign-up, and when.
• If you subscribe: your subscription status, plan, renewal date, and a Stripe customer reference.

Card details are never seen by this service. Payment is handled entirely by Stripe. No card number, expiry or security code ever reaches Applied Evidence's servers.

02The one analytics tool

Microsoft Clarity records how the site is used — which pages were opened in what order, where the cursor moved, what was clicked, how far the page was scrolled — so the parts of the product that confuse people can be found and fixed. Almost nothing you write reaches it: Clarity masks every text box and drop-down in every mode, and your notes, your collection names and the search term echoed back above your results are masked on top of that. Masked content is never uploaded at all.

One thing does get through, and it should be said plainly. A search puts what you searched for into the page address, and Clarity records page addresses. So a search term is seen by Microsoft even though the search box itself is masked. That is the strongest reason to take the warning below literally and keep patient details out of the search box.

Clarity also sets some Microsoft cookies that Microsoft uses for advertising on its own services. That is Microsoft's doing rather than this site's, and it is the honest price of a free tool. Your browser's Global Privacy Control signal is honoured, and Microsoft's own opt-out at optout.aboutads.info covers it too.

03What is deliberately not collected

There is no advertising pixel and no ad network on this site, and your data is never sold.

Nothing about you is used by Applied Evidence to train any AI model. Summaries are generated from published research by language models, most of them run by commercial AI providers, and no user data is part of that process or sent to any AI provider. What Microsoft does with the interaction data Clarity collects is governed by the Microsoft Privacy Statement, not by this policy.

04Who else holds it

Five companies hold some part of your data. Each is named because you are entitled to know who actually has your information:

• Supabase — the database and sign-in system. Your account and everything above lives here, in a data centre in the eastern United States.
• Vercel — hosting. It serves the site and keeps short-lived request logs.
• Stripe — payments, and the legal seller of the subscription. Stripe holds your card details, billing address and payment history under its own privacy policy.
• Google — only if you choose to sign in with Google, in which case Google confirms your identity and shares your email address.
• Microsoft — analytics, through Clarity. It receives how you moved through the site: pages, clicks, scrolling and cursor movement, with what you typed masked out before anything is sent, apart from a search term, which travels in the page address. Microsoft holds this as its own data controller, under its own privacy statement, rather than on Applied Evidence's behalf.

05Where it is, and how long it stays

Data is stored in the United States. If you are outside the US, using this service means your information is transferred to and held there, under United States law.

Your data is kept for as long as your account exists. Delete the account and it goes immediately — see below. Payment records are retained by Stripe for the period tax and accounting law requires, which is outside anyone's ability to waive.

06Taking your data, and deleting it

Download it. Account → Download my data gives you a JSON file containing your profile, every saved paper, every note, your collections, your reading history and your subscription status. No request, no waiting.

Delete it. Account → Delete account removes your profile, saved papers, notes, collections and reading history, and cancels any active subscription. This is immediate and permanent — there is no recovery window and no backup you can be restored from. Download a copy first if you want one.

Wherever you live, you may ask what is held about you, ask for it to be corrected, or ask for it to be erased, through the contact form at appliedevidence.com/contact. California residents have specific rights under the CCPA and CPRA to know, delete, and correct personal information, and not to be discriminated against for exercising them. Applied Evidence does not sell personal information. The one exception worth naming is that Clarity sets Microsoft cookies which Microsoft also uses for advertising on its own services; if you would rather it did not, your browser's Global Privacy Control signal is honoured, and Microsoft's opt-out is at optout.aboutads.info.

07Cookies

Two kinds of cookie are set: the ones that keep you signed in, and the ones Microsoft Clarity uses to join your page views into a single session. There is no advertising cookie set by this site itself — the Microsoft cookies described above are Microsoft's.

If you are in the United Kingdom, the European Economic Area or Switzerland, Clarity sets no cookies at all unless it is told you have consented. There is no consent banner on this site to tell it that, so for now it sets none, and your visit is recorded only as page views that are not joined together. Nothing about the site behaves differently for you.

Your browser also stores small conveniences locally — a remembered filter, an unsent note — which never leave your device.

08Security, honestly stated

Access is enforced by the database itself: each account's rows are readable only by that account, checked by Postgres rather than by application code, so a bug in the site cannot expose one person's library to another. Traffic is encrypted in transit and data is encrypted at rest by the hosting providers.

No system is perfectly secure, and this one is operated by one person rather than a security team. That is a reason to keep patient information out of it.

09Children

This service is for professionals and students aged 18 or over. It is not directed at children and accounts are not knowingly created for them. If you believe a child has created one, tell us through the contact form at appliedevidence.com/contact and it will be deleted.

10Changes

If this policy changes in a way that materially affects you, the change will be shown in the product before it takes effect. The version date is at the foot of this page.