Privacy Policy
Last updated 13 November 2026
ResearchMaxer is made for unpublished work, so the short version is this: your manuscripts and sources are yours. They are read only to check your citations, only you and the people you invite can open them, they are never used to train AI models, and when you delete them they are gone.
Who we are
ResearchMaxer (researchmaxer.com) is run by SmileMaxer LLC, a company in the United States (“we”, “us”). We decide how the information described here is used, so for data-protection law we are its controller. You can reach us at support@researchmaxer.com.
What we collect
Your account
- Your email address, which is how you sign in. We send a 6-digit code to it; the code is stored only in scrambled (hashed) form and stops working after 10 minutes. There are no passwords.
- A display name, taken from the part of your email address before the @.
- Your plan, how much of it you have used this period, and how much storage your files take.
Your papers
- Your manuscript. Your browser reads the Word or PDF file and sends us its text; the file itself is not uploaded. We keep that text with the paper.
- The sources you add: each PDF file and the text read from it.
- What the check finds: the cited sentences, the passages found in each source, the verdicts and support ratings, and the notes written about them.
- What you and your co-authors add: review marks and notes, figures and their legends, reference lists, citation styles, the paper’s title, and the email addresses of the people you invite.
Payments
If you buy a plan, you pay on Stripe’s own page. Stripe collects your card details and billing address; we never see or store your card number. We keep the Stripe customer and subscription numbers, your plan, whether it is monthly or annual, when it renews, and whether a payment failed.
How the service is used
- An activity log for running the site: sign-ups, sign-ins, uploads (with their size and page count), plan changes and admin actions. It never holds paper titles, file names or text from a paper.
- AI usage records: for each AI request, the account, the paper’s internal number, the amount of text sent and received, and its cost. Not the text itself.
- Limits: counters that stop too many requests at once. To stop one network from asking for sign-in codes for many addresses, a one-way hash of the network address is counted for up to a day; the address itself is not stored.
- Error reports, described below.
We do not use analytics, advertising or tracking tools, and we do not buy information about you from anyone.
How we use it
- To provide the service: sign you in, read your manuscript, find the passage behind each citation, show it to you and the people you invite, format your references and export your files.
- To bill you for a paid plan, through Stripe.
- To send you email you need: sign-in codes and, if you ask for it, a note that a problem you ran into has been fixed. We do not send marketing email.
- To keep the service secure and fair: enforce plan limits and spending limits, stop abuse, and find and fix errors.
- To meet legal duties, such as keeping tax records of payments.
We do not sell your information, we do not show you ads, and we do not use your manuscripts or sources to train AI models, ours or anyone else’s. We do not read your papers. The admin console we use to run the site shows accounts, plans, usage and errors, but never paper titles, file names or text. We would look at a paper only if you ask us to in order to help you, or if the law requires it.
Where the law asks for a legal basis (for example the GDPR in the European Union and the United Kingdom), we rely on: performing our contract with you (providing the service and billing), our legitimate interests (security, preventing abuse, fixing errors, improving reliability), and legal obligations (tax and accounting records).
The AI that reads your papers
To find the passage behind a citation, the text of your manuscript and of the source is sent to Claude, an AI model made by Anthropic, through Anthropic’s commercial API. Under its commercial terms, Anthropic does not train its models on data sent this way, and keeps it only for a limited time for safety and legal reasons before deleting it. Only the text needed for the check is sent: never your email address or billing details. The same applies if you ask ResearchMaxer to write a citation style from a journal’s rules: the rules you paste are sent.
Every quote the AI returns is checked word for word against the source text before it is shown. Verdicts and support ratings are the AI’s estimates; the Terms say more about relying on them.
Who else handles it
We use a few companies to run the service. Each handles your information only to provide its part, under its own privacy and security commitments:
| Company | What it does for us | What it handles |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, content delivery, network security | Everything stored by the site; your network address when you visit |
| Anthropic, PBC | The AI model (Claude) that reads manuscripts and sources | The text of the manuscript and sources being checked |
| Stripe, Inc. | Payments and billing | Your email address, card and billing details, invoices |
| Resend (Plus Five Five, Inc.) | Sending email | Your email address and the emails we send you |
The app also loads two open-source programs for reading files in your browser (PDF.js and JSZip) from Cloudflare’s public library service (cdnjs.cloudflare.com). Fonts are served by ResearchMaxer itself.
Who can see your papers
A paper can be opened by its owner and by the people the owner invites, and by no one else. People on a paper see its manuscript text, sources, findings, figures, references, everyone’s marks and notes, and the email addresses of the others on it. There is no public sharing, no directory and no search across accounts.
We share information outside the providers above only if the law requires it (for example a valid court order, and we will tell you unless we are not allowed to), to protect the rights or safety of people or of the service, or as part of a sale or merger of the business, in which case this policy continues to apply to your information.
Cookies and browser storage
- One sign-in cookie (
rm_session) keeps you signed in for up to 30 days. It cannot be read by scripts, is sent only over secure connections, and is not sent with requests from other sites. - Your language choice, if you pick one, is saved in your browser (
rm_lang).
These are needed for the site to work, so there is no cookie banner. There are no advertising or tracking cookies.
Error reports
When something breaks, for example a PDF that cannot be read or a check that fails on our side, the site records an error report so we can fix it, and emails us when a new kind of error appears. A report holds: what kind of step failed, the error’s own message, the lines of our own program involved, and a few facts about the file and your browser (its type such as PDF or Word, its size, its number of pages, the program that made the PDF, the browser and its version). It does not hold your file, any text from your papers, or file names; email addresses and long quoted text are removed from error messages before they are kept.
If you tick “Email me when it is fixed”, we keep that request with the error and email you once when it is marked fixed, then delete the request.
How long we keep it
- Your papers and files are kept until you delete them. Removing a source deletes its PDF and text from storage straight away; deleting a paper deletes everything in it; deleting your account deletes every paper you own. Our database host keeps automatic recovery copies for up to 30 days, after which deleted data is gone from those too.
- Your account is kept until you delete it, under Plan and billing in the app. Deleting it also removes your marks and notes on other people’s papers. Files you added to someone else’s paper stay with that paper, because they are part of it.
- After an account is deleted we keep: the activity log with your account taken off it, AI cost records (amounts only), and a one-way hash of your email address so the free start cannot be claimed again by closing and reopening an account. The address cannot be read back from the hash. Stripe keeps invoices and payment records as tax law requires.
- Sign-in codes expire after 10 minutes and are replaced by the next one; sessions end after 30 days or when you sign out.
- Error reports and the activity log hold no paper content and are kept as long as they are useful for running and securing the service.
How we protect it
- Every connection is encrypted (HTTPS only, with HSTS), and stored files and data are encrypted at rest by our host.
- Files are never public. Each request for a file is checked against who is signed in and whether they are on that paper.
- Sign-in uses one-time codes sent to your email, so there is no password to steal or reuse. Codes are stored hashed, allow 5 tries, and are limited per address and per network.
- The sign-in cookie cannot be read by scripts or sent by other sites, and every request that changes something must carry a header other sites cannot add.
- The pages refuse scripts from anywhere but ResearchMaxer and one public library service, which limits what an injected script could do.
- Spending limits on the AI and plan limits on every account are enforced on the server.
- Payments are handled entirely by Stripe.
No system is perfectly secure. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires. To report a security problem, email support@researchmaxer.com (see also security.txt).
Your rights and choices
You can see, change and delete your papers in the app at any time, export your references and figures, and delete your account. You can also email us to ask for a copy of the information we hold about you, to correct it, to delete it, or to object to or restrict how we use it. We answer within 30 days. We may need to confirm the request comes from your email address.
If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to data portability and to complain to your data-protection authority. If you are in California or another US state with a privacy law, you have the rights that law gives you; we do not sell or share personal information for advertising, and we will not treat you differently for using your rights.
Where data is processed
We and our providers are in the United States, and Cloudflare serves the site from data centres around the world. If you use ResearchMaxer from outside the United States, your information is transferred there. Where the law requires it, these transfers rely on the providers’ standard contractual clauses or equivalent safeguards.
Children
ResearchMaxer is for researchers and students aged 16 or older. We do not knowingly collect information from anyone younger. If you think a child has given us information, email us and we will delete it.
Changes to this policy
If we change this policy, we will post the new version here with a new date. If a change matters to how your information is used, we will email account holders before it takes effect.
Contact
SmileMaxer LLC, support@researchmaxer.com.