Trust
How CiteMe Handles Your Files
Theses, drafts, and unpublished manuscripts are sensitive documents. This page explains exactly what happens to a file you give CiteMe — what stays in your browser, what reaches our servers, what is stored, and for how long. No badges, just the actual mechanics.
The short version
- ✓Uploaded PDFs are processed in memory and discarded — the file is never written to our storage unless you explicitly save it to your Pro library
- ✓When we only need to identify a paper (DOI, ISBN, PMID, title), the scan runs entirely in your browser — the PDF never leaves your device
- ✓Everything travels over HTTPS (TLS); library files are encrypted at rest
- ✓We never use your documents to train models, and we never sell your data
- ✓You can delete your data at any time — or ask us to
1. What happens to your file, flow by flow
| What you do | Where it runs | What leaves your browser | What we keep |
|---|---|---|---|
| Search a citation (text, DOI, ISBN, URL) | Our servers + academic databases | The query you typed | Request logs with hashed IPs, up to 90 days |
| Turn a PDF into a citation (identify the paper) | Your browser | Only the detected DOI, ISBN, PMID, or title — never the file | Nothing from the file |
| Extract a bibliography (PDF to BibTeX/RIS, Reference Checker, the free reader) | Our extraction server | The PDF, over HTTPS | The file is not written to storage. We keep the extracted references in a processing cache for up to 90 days, and a SHA-256 fingerprint of the file (which cannot reconstruct it) for up to 12 months for quota accounting |
| Upload a PDF whose bibliography our parser cannot extract (including scanned and unusual-layout PDFs) | Google Gemini API (fallback only) | The PDF is sent to Google for structured extraction when our parser returns no references after a longer processing attempt, or when you explicitly request OCR | Same as above — the reference cache and fingerprint, never the file |
| Save a PDF to your library (Pro, opt-in) | Supabase Storage | The file you chose to save | Stored encrypted at rest until you delete it |
2. Who touches your file
- Vercel — hosts the application and terminates HTTPS. Your file passes through during upload; it is not persisted there.
- Our extraction server (hosted at Hetzner) — a dedicated server we operate, running the open-source GROBID engine that parses bibliography sections. The PDF is processed transiently and not written to disk storage.
- Google Gemini API — receives a PDF only as an extraction fallback when our parser returns no references after a longer processing attempt (including scanned and unusual-layout files), or when you explicitly request OCR. It is used solely for structured text extraction.
- Supabase — stores your account, citations, and (Pro, opt-in) library PDFs, encrypted at rest.
- Upstash (Redis) — rate limiting and quota counters using hashed identifiers; never sees file contents.
The full subprocessor list, including analytics and payments, is in our Privacy Policy.
3. Encryption
- In transit: every request — browser to CiteMe, CiteMe to the extraction server, CiteMe to third-party APIs — travels over HTTPS/TLS.
- At rest: database records and library PDFs are encrypted at rest by our storage provider (Supabase, AES-256).
4. Deleting your data
- Library items and uploaded PDFs can be deleted from your account at any time; deleting your account permanently deletes all of them.
- Processing caches and fingerprints expire automatically on the schedules listed above — no action needed.
- For anything else — including deletion requests for data tied to anonymous usage — email privacy@citeme.app.
5. What we don't do
- We don't use your documents or references to train models.
- We don't sell or share your personal data with advertisers.
- We don't keep uploaded files after processing — not even "temporarily for support purposes".
- We don't read your documents. Extraction is automated; no human looks at your files.
6. Reporting a security issue
If you believe you have found a vulnerability in CiteMe, email support@citeme.app with the details. We read every report and will respond as quickly as we can.
Related: Privacy Policy · Terms of Service