Privacy Policy

CiteSeek stores the text extracted from documents you upload, never the original files. Everything is hosted in the EU. Answers are generated by Google’s Gemini API, which means the text of your documents and your questions is sent to Google. This deployment is on Google’s paid tier, so that content is not used to train or improve their models. Deleting your account deletes everything on our servers, immediately and for real. Local mode is the exception, and deliberately so: those documents stay in your browser, so you delete them there.

• Your account — your email address, a session record, and, if a sign-in provider supplied them, a profile name and a link to the profile picture held by that provider. The picture itself is never copied here and is not shown anywhere in the app; what is stored is the address of it. With an email link you type the address yourself, and there is no provider, no name and no picture.
• Your linked accounts — for each provider you sign in with, its name, your account id there, and the tokens it issued when you signed in. Those tokens are what proves the link is yours; nothing in this project uses them to read anything from your account at that provider. They are deleted with your account, and signing in with an email link creates none of this.
• Extracted text — when you upload a document, it is parsed and the text is stored. The uploaded file itself is discarded once parsing finishes and is never written to disk or object storage.
• Passages and embeddings — the text split into passages, each with a numeric vector used to find relevant ones. The vectors are derived from your text and are stored alongside it.
• Conversations — your questions, the answers, and which passages each answer cited.
• Sign-in links — asking for one stores your address, a hash of the link and an expiry, so the link can be checked when you click it. It lasts 15 minutes; the row is deleted when the link is used, and expired rows are cleared out as later requests arrive, clicked or not.
• Usage counts — how many provider calls were made and how many tokens they used, kept for 30 days and then deleted. These carry no document or message content.

Guests are the exception: a guest session is a signed cookie, listed below, and nothing about a guest is written to the database at all. A guest’s conversation lives in their browser and is gone on reload.

Every cookie this site sets is listed here. None is for analytics or advertising, and none belongs to anyone else. Over HTTPS the Auth.js names carry a __Secure- or __Host- prefix.

• authjs.session-token — keeps you signed in for 30 days from when you sign in, however often you visit in between. It holds a random key to your session record, not your details.
• authjs.csrf-token and authjs.callback-url — set while you sign in, to turn away forged sign-in requests and to remember where to send you afterward. They last until you close the browser.
• authjs.pkce.code_verifier — set when you sign in with a provider, so its reply can be matched to the sign-in you started, for 15 minutes.
• citeseek.guest — lets you into the demo without an account, for a day.
• citeseek_theme — the color theme you picked, set only when you pick one, for a year.

The application runs in Frankfurt (Vercel fra1) and the database is a Neon Postgres instance in the same region, both pinned in configuration rather than left to a default. Where a sub-processor stores what we send it is a separate question from where we send it — the sender is the one where the two differ, and its entry below says so.

Documents added in local mode are stored in your browser, not on our servers. They are never uploaded, no processor below receives them, and none of the hosting above applies to them.

One thing does leave: your browser downloads two models from Hugging Face, which sees those requests the way any website you visit does — about 128 MB to index a document, and about 756 MB more before it can answer one, each fetched once and then cached. No document text is sent: they are downloads of public files, in that direction only.

Two consequences worth being direct about. That storage belongs to the browser profile, not to your account — signing out does not clear it, and anyone else using this browser on this computer can open local mode and read what is there. And deleting your account does not remove it, because the deletion runs on our servers and this data never reached them.

Delete it yourself with Delete everything on the local mode page. That removes the documents, their passages and their embeddings from this browser, with no recovery.

• Google (Gemini API) — receives the text of retrieved passages and your question in order to generate an answer, and receives document text in order to produce embeddings. See the warning below.
• Vercel — hosts the application and terminates requests.
• Neon — hosts the database.
• GitHub or Google — whichever you sign in with, if you use one at all, and only to confirm who you are. An email link uses neither. Signing in with Google puts Google on this list twice, for two unrelated reasons.
• Scaleway — receives your email address in order to send you a sign-in link, and only when you ask for one. Its Transactional Email service sends from Paris (fr-par), and its data processing agreement places its services in the European Union by default and obliges it to tell us in advance before storing personal data outside it. That is a commitment with notice, not a guarantee that data never leaves.

This deployment runs on Google’s paid tier, billed from an account in the EEA. Under those terms Google does not use submitted prompts or uploaded content to train or improve its models; it processes them to return an answer and for the retention their terms define, and nothing else.

Until August 2026 this ran on the free tier, whose terms do allow submitted content to be used for product improvement, and this page said so. The tier changed because a policy that has to ask people not to upload anything sensitive is a request rather than a protection.

What has not changed: the text still leaves this application and reaches Google, and no policy makes that untrue. The demo workspace is still read-only and seeded with a fictional document.

Deleting a document removes its text, its passages and their embeddings. Deleting your account removes the account, its workspaces, every document in them, every conversation, every usage record belonging to it, and any unused sign-in link for its address — in one operation, with no soft-delete and no recovery window. The one record it cannot reach is the count of sign-in links requested, which is kept against a hash of the network address rather than an account, and is deleted on the same 30-day schedule regardless. You can do it yourself from the account page.

It does not reach documents stored in your browser by local mode, which never left your machine for us to delete. Those are removed from the local mode page.

• Document contents and message bodies are never written to logs.
• There is no analytics, advertising or third-party tracking.
• Nothing is sold or shared beyond the processors listed above.

Every way to reach this project, and to act without reaching it, is on the contact page. You can delete everything yourself from the account page without asking anyone.