Privacy Policy

1. What we collect

• Account: name, email address and password (stored hashed by our sign-in provider).
• Researcher profile: institution, country, career stage and research fields, if you add them.
• Your content: manuscripts and journal guidelines you upload, the reports generated for them, imported references, screening decisions, full-text PDFs, extraction and appraisal data, saved grants, project summaries, drafts and notes.
• Workspaces: membership, and the email addresses of people you invite.
• Support: if you send a request to the admin from the help assistant, the summary, the conversation so far and the page you were on. Other help assistant chats aren't stored.
• Billing: your plan, subscription status and Stripe customer ID. Card details are held by Stripe.
• Usage and diagnostics: an activity history shown on your dashboard, grant search counts and AI usage (tokens and cost per request) for plan limits and daily AI allowances, and error reports (the page, time and your user ID) so we can fix problems.

2. How we use it

• To provide the service you signed up for: reviews, screening, grant matching and drafting (performance of our contract with you).
• To take payments and enforce plan limits (contract).
• To keep the service secure and working, and fix errors (our legitimate interests).
• To send essential account and billing messages. We don't send marketing without your consent.
• To meet legal obligations, such as tax records.

3. AI processing

When you request a review, a suggestion or a draft, the relevant content is sent to Anthropic's Claude API to generate it. Under Anthropic's commercial terms, content sent through the API is not used to train their models by default. We don't use your content to train models either. No decision with legal or similarly significant effect is made about you automatically.

The help assistant is also powered by Claude. To answer you it can read your plan and usage, the status of your work and your finished AI reports, but not the full text of manuscripts or articles, and it can't change anything. Your questions and what it looks up are sent to Anthropic in the same way.

4. Who we share it with

We don't sell personal data. We use these service providers, who process data on our instructions:

These providers may process data outside Uganda, including in the United States and the European Union, under contractual safeguards. We may also disclose data where the law requires it.

If you choose to contact the admin on WhatsApp, the help assistant opens WhatsApp on your device with a message ready for you to send. We don't send anything to WhatsApp ourselves. If you send it, your name, email, phone number and the message reach the admin through WhatsApp, under WhatsApp's own terms and privacy policy.

5. Workspaces and co-reviewers

If you join a team workspace, its other members can see your manuscripts and reports, saved grants and the systematic reviews you lead. Co-reviewers on a systematic review see that review's articles and resolved conflicts, but not each other's screening decisions until both have decided. The system owner can see account details (name, email, institution, plan and usage) to run the service, and any support requests you send.

6. Cookies and local storage

We only use what's needed for the app to work. There are no analytics or advertising cookies.

We measure how the app is used with Vercel Web Analytics, which sets no cookies and doesn't identify you: it counts page visits (without query strings) and a few product events such as “manuscript submitted”, with no names, emails or content.

• Sign-in cookies (Supabase) keep you signed in.
• onboarding_dismissed remembers that you hid the getting-started checklist.
• theme (stored in your browser, not a cookie) remembers your light or dark choice.

If we ever add analytics that use cookies or identify you, we'll ask for your consent first.

7. How long we keep it

• Your account and content are kept while your account is open, including support requests you send to the admin.
• When you delete your account, your profile, content and uploaded files are deleted straight away. Copies may remain in encrypted backups for up to 30 days.
• Payment records are kept by Stripe and by us for as long as tax law requires.
• Systematic reviews you lead are deleted with your account, for all their members.

8. Your rights

Under Uganda's Data Protection and Privacy Act 2019 and, where it applies, the EU and UK GDPR, you can ask to access, correct, export or delete your data, and object to or restrict some processing.

• Export: Account → Your data → Download my data.
• Correct: edit your researcher profile on the Account page.
• Delete: Account → Your data → Delete my account.
• For anything else, email support@example.com. We reply within 30 days.

9. Security

Data is encrypted in transit and at rest. Each user can only read their own data, enforced in the database; sharing happens only through the workspace and co-reviewer features you choose to use. Uploaded files are kept in private storage.

10. Contact and complaints

Contact ApwonyCoch AI at support@example.com or Kampala, Uganda. If you're unhappy with how we handle your data you can complain to Uganda's Personal Data Protection Office, or to your local data protection authority. We'll tell you about material changes to this policy in the app.