Privacy policy

The short version

• Your manuscript is never used to train any model: not ours, not our providers'. The backend refuses to send manuscript text to a provider whose terms do not forbid training on it.
• No person at Edyth reads your manuscript. Reviews are produced by machines and read by you. We look only if you send us something yourself.
• We do not sell, share, license, or show your manuscript or your reviews to anyone else, and we claim no rights in them.
• When you delete a manuscript, it goes at once, with a receipt of what went. You can also set a term after which untouched manuscripts delete themselves, and you can delete the whole account.

What we hold

We hold only what the service needs to work.

• Your account: your email address; a display name; and, if you sign in with Google, the name and avatar Google shares. Your profile, if you fill it in: institution, country, discipline, professional rank, ORCID. All of these are optional except the address.
• Your manuscripts: the file you upload or the text you paste, the text and figures we extract from it, and everything made from them: reviews, comments, your marks on comments, reference checks, journal and literature suggestions, and the instructions you give the reviewer.
• Your credits: a ledger of credits granted, bought and spent, with the cost of each run; and references to your Stripe payments. Card details never reach us; Stripe holds them.
• Feedback you send us, with any screenshots you attach.
• Technical records: server logs with the time, the address the request came from, the browser, and which routes were called. They never contain manuscript text. They are rotated automatically and kept only for security and troubleshooting.

What we never do

We do not use your manuscript, your reviews, or anything else you give us to train, fine-tune, evaluate, or improve any model, ours or anyone else's. We do not build datasets from it. We do not read it. We do not sell it, rent it, share it with other users, or pass it to advertisers or data brokers. We do not use it for any purpose other than producing the review you asked for and keeping your account working.

This is not a preference we could change quietly: the backend carries a policy guard that will not send manuscript text to a model whose terms do not forbid training on it, and refuses to run rather than fall through to such a model.

Who processes data for us

We rely on a small set of providers, each for one job, and each receives only what that job needs: hosting, file storage and the database (all in the United States); the language models that write the review and the text-recognition service that reads scanned PDFs, all under terms that forbid training on what we send and limit any retention to short-lived abuse monitoring; bibliographic databases and a web search service, which receive reference titles and short search phrases, never the manuscript; a payment processor, which holds card details so that we never do; and an email service for account mail.

The backend can reach no host outside this set. The full list, with what each provider receives, is available on request at [email protected].

Where it is kept

Your manuscripts, reviews and account are stored in the United States. They travel only over encrypted connections, and rest on infrastructure that encrypts at rest. They are never moved for convenience.

How long

• Manuscripts and everything made from them: until you delete them. In your profile you can choose a term of thirty, ninety, one hundred and eighty, or three hundred and sixty-five days after which a manuscript you have not touched is deleted for you, with the same receipt.
• Deletion is immediate on our live systems: the file, the extracted text, the figures, every review, and every record that named the manuscript. Backup copies held by our database provider expire within thirty days.
• At the model providers: OpenAI may keep a request for up to thirty days for abuse monitoring; Fireworks keeps nothing. The text-recognition service keeps nothing beyond the request.
• Credits and payment records: while the account exists. Stripe keeps its own records of payments for as long as tax law requires it to.
• Server logs: rotated automatically by size; they never contain manuscript text.
• When you delete the account, every manuscript, review, comment, credit record, feedback thread and the sign-in itself are removed, and you are shown a receipt. Nothing that identifies you is kept afterwards.

Sharing that you choose

A review is private until you share it. If you create a share link, anyone holding the link can read the sections you chose to share, and nothing else; you can revoke the link at any time. Downloads you make are yours to pass on.

Cookies

We set the cookies needed to keep you signed in and to remember interface preferences.

Your rights

You can delete any manuscript, and the whole account, from the app at any time. To receive a copy of what we hold about you, or to correct it, write to [email protected] from the address on your account.

Residents of the European Economic Area, the United Kingdom, California and other jurisdictions with data protection laws have additional rights to access, correct, restrict or object; write to [email protected].

Children

Edyth is for researchers and students in higher education. We do not knowingly collect data from anyone under 16.

Changes and contact

We will announce material changes on the site and, for changes to what happens to manuscripts, by email before they take effect. Questions: [email protected].