CiteStack Privacy Policy (Draft)

Last updated: 2026-02-10
Company: Signal & Form LLC ("we", "us")
Product: CiteStack (the "Service")

Draft notice: This document is a working draft. Before publishing, confirm whether you want analytics/cookies and your intended minimum age.

1) Scope

This Privacy Policy explains how we collect, use, disclose, and protect information when you use CiteStack, including when you create an account, save sources (URLs, pasted text), upload files (e.g., PDFs), and run extraction/enrichment features.

2) Information we collect

2.1 Account and profile information

• Email address and authentication identifiers (via Supabase Auth).
• Basic account preferences/settings you provide.

2.2 Content you submit

When you use the Service, you may submit:

• URLs you save.
• Pasted text you submit.
• Uploaded files (e.g., PDFs) stored in Supabase Storage.
• Collections, tags, titles, notes or edits you make.

2.3 Extracted and derived data

To provide the Service, we process submitted content to generate and store:

• Extracted page metadata (e.g., title, domain) and extracted text.
• Cleaned text (may be truncated for storage/processing limits).
• AI-generated enrichments such as: summaries/abstracts, key points/bullets, quotes with context (e.g., “why it matters”), and tags.
• Comparison outputs between sources when you request comparisons.

2.4 Usage and device data

We collect basic operational data necessary to run and secure the Service, such as:

• Request logs (IP address, timestamps, user agent).
• Events related to job processing (queued/running/succeeded/failed).
• Diagnostic and error logs.

We currently do not use third-party analytics tracking tools (e.g., Google Analytics) on the Service.

3) How we use information

We use information to:

• Provide and maintain the Service (capture, extract, enrich, search, organize, cite).
• Authenticate users and enforce access controls (RLS by user_id).
• Store and retrieve your library items, collections, and files.
• Run background jobs for extraction/enrichment.
• Improve reliability, prevent abuse, and debug issues.
• Communicate with you about the Service (support, critical notices).
• Send product updates, tips, and marketing emails to users who have opted in.

4) AI processing and third parties

4.1 OpenAI (or other AI providers)

When you run enrichment or comparison features, the Service may send relevant extracted/cleaned text (or a truncated portion) to an AI provider (e.g., OpenAI) to generate outputs.

We do not use your content to train our own models.

We may use AI providers (e.g., OpenAI) to generate enrichments and comparisons. Content is sent only as needed to provide these features.

4.2 Supabase

We use Supabase for:

• Authentication
• Database storage (Postgres)
• File storage (Supabase Storage)

5) How we share information

We may share information:

• With service providers (e.g., AI provider, Supabase, email/support tooling) solely to operate the Service.
• If required by law, legal process, or to protect rights/safety.
• In connection with a merger, acquisition, or sale of assets (with notice as required).

We do not sell your personal information.

6) Data retention

By default, we retain your account data and library content until you delete it or close your account, subject to limited retention for backups and logs.

Operational logs may be retained for a limited period for security and reliability.

Before publishing, define a concrete log retention window (e.g., 30/90 days).

7) Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information. However, no system can be guaranteed 100% secure.

8) Your choices and rights

Depending on your location, you may have rights to:

• Access, correct, or delete your information.
• Export your content.
• Object to or restrict certain processing.

You can delete items/files within the Service. You may request account deletion by contacting us. If you opted in to marketing emails, you can unsubscribe at any time from your Account settings (Marketing emails) or by emailing us at the contact below.

9) Children’s privacy

CiteStack is not intended for children under 13 (or the minimum age required in your jurisdiction). We primarily expect users to be college students and older. If you believe a child has provided personal information, contact us.

10) International transfers

If you access the Service from outside the United States, your information may be processed in the United States or other locations where our providers operate.

11) Changes

We may update this policy from time to time. We will update the “Last updated” date and may provide additional notice for material changes.

12) Contact

Privacy contact: jack@signalandformllc.com
Mailing address: Signal & Form LLC, 8 Echo Cove, Grapevine, TX 76051