Privacy

The operator, its address and the contact for questions about anything on this page are in the Legal notice.

• Your email address, because signing in is a link sent to it.
• The name you choose to display, which you set and can change.
• The documents you upload, their extracted text, and what is derived from them.
• The reviews you run on a document, and the reports they produce.
• Your chats with your libraries, and the answers given back.
• A record of what the service spent on your behalf, so the readouts can be honest.

• The handle you choose is public: it is the name of your public address. It is chosen by you, never made from your email address, and a handle you leave stays reserved to you so the old address still finds you.
• Your display name is shown on your public profile, while the profile is switched on.
• A bio you write is shown on your public profile. It is plain text of at most 500 characters. Your profile is off until you turn it on, and a profile that is off shows nothing.
• A website you add is shown on your public profile as a link. Only an https address is accepted.
• An ORCID iD you add is shown on your public profile exactly as you entered it. Only its format is checked: nothing confirms that the iD exists or is yours, so it is never shown as verified.
• An avatar you upload is shown on your public profile. It is a PNG or JPEG of at most 256 KB and 1024 pixels on its longest side. Everything but the picture itself, such as the camera, place and time a photo carries, is removed before it is kept.
• The libraries you have published are listed on your public profile with their title and description, a reviewed one marked as such. Your private and shared libraries, your chats and your reading are not.

• Signing in sets one cookie, the session cookie. Only the server can read it, you need it to stay signed in, and the service sets no other cookie.
• A session lasts 30 days. Using the service extends it, at most once a day, so it ends 30 days after you were last active. Signing out ends it at once.
• The session record holds your browser’s user-agent string. It holds no IP address.
• A session that has expired is deleted by a scheduled pass that runs every 15 minutes.

• A sign-in link works once and expires after 30 minutes. The place you were going is held only until the link expires.
• To limit abuse, requests are counted against a keyed digest of the sender’s IP address. The digest is kept for the length of the counting window, then deleted. The address itself is not stored.
• A sign-in that was verified but never completed an account leaves a bare record that is deleted after 30 days.
• Your documents, their extracted text, your reviews, chats and spend record are kept while your account exists. What happens to each when you erase the account is listed below.
• The reading service’s answer for a document is cached in the service’s own storage, so the same document is read once.

Your documents are stored on our infrastructure and their pages are sent to a reading service to extract the text. XResearch never uses it to train a model.

Every processor the service uses, and what actually reaches it.

XResearch never trains a model on your uploads, and sends your documents to a provider only to read them, search them and answer you.

• Every request to a text model asks for zero data retention and refuses training use, and a model with no endpoint that offers it is not called. Zero retention here means no persistent storage of the prompt or the answer and no training; brief in-memory caching of a prompt is permitted. The provider keeps billing and operational metadata separately. (OpenRouter zero-data-retention endpoint list, read 2026-10-27)
• The reading of uploaded pages by Mistral has no recorded retention or training term, so none is claimed for it.
• Cloudflare states that Workers AI does not keep the text it turns into search vectors, or the vectors, after answering the request, and does not train on them. It may keep operational metadata that holds no content. This covers Workers AI only: the AI Gateway in front of it is listed apart. (Cloudflare Workers AI data usage: zero data retention of inputs and outputs, and no training on Customer Content, read 2026-11-02)
• Whether Cloudflare’s AI Gateway logs the requests that pass through it has not been observed, so nothing is claimed about it.
• The background worker’s logs are archived in the service’s own storage. No expiry for them has been observed, so none is claimed.

• ORCID: sign-in and linking an iD are not live; nothing is sent to ORCID.
• Google: sign-in with Google is not live; nothing is sent to Google.

• no analytics, of any kind
• no advertising, and nothing is sold or shared for it
• no third-party fonts: the typefaces are served from this domain
• no third-party scripts beyond Cloudflare Turnstile, and only where it is configured
• no personal data in production server logs

The account is disconnected at once and cannot be restored. The rest is removed over the following days.

• Your email address, your display name, your public handle with every handle you left, your public profile (bio, website, ORCID iD and avatar) and any linked ORCID iD, at once.
• Every session of your account, at once.
• Reviews and other work still running for you, which are cancelled.
• Your memberships of libraries and workspaces, your shelves and what is on them, and your chats.

• The event log and what you authored, validated or attested to (claims, annotations, drafts, projects and feature requests), which stay under an internal identifier that no longer names you.
• The stored copy of a document that was admitted to the corpus.
• Your consent record, your allowance and spend record, your roles and the invitation you redeemed, under the same internal identifier.
• The log of your uploads, the notices shown to you and the short-lived working records of uploads in progress, under the same internal identifier.

To have a specific document removed, follow the process in the Legal notice.