Privacy Policy

Version 2026-09-30

This policy explains what personal data Evidence Hub (the "Service") collects, why, who receives it, and the choices you have. The controller of your data is the operator of Evidence Hub ("we", "us"). You can reach us at [email protected].

1. What we collect

Account data

• Email address and name, which you give us when you register (or which Google gives us if you use "Continue with Google").
• Password, stored only as a salted scrypt hash. We cannot read it. Accounts made with Google have no password unless you set one.
• Google account identifier, if you sign in with Google.
• Sign-up details: when you accepted the Terms and Privacy Policy and which version, when you last signed in, and whether your email is verified.
• Short-lived codes we email you for verification and password reset (stored only as hashes).

Content and activity in your account

• Studies you save and the folders you organise them in; which studies you have opened.
• Your chat messages with the AI about a study, and the AI's answers.
• PDFs you upload or ask us to fetch for a study, and the analyses, figures and tables extracted from them.
• Daily usage counters for AI features, kept for about two days to apply fair-use limits.
• Usage statistics: a record of which features you use and when (for example signing in, searching, opening or saving a study, adding or opening a PDF, asking the AI), without your search words or chat text. Administrators see it in aggregate and in a list of the most active accounts, to understand how the Service is used and to run it.

Search queries

The words you search for are sent to the research sources described below. We keep a general log of searches (the search terms and the number of results, not linked to your account) for about 90 days, and cached results and relevance scores for a shorter time.

So that you can continue where you left off, your account also keeps your single most recent search (its words, filters and your place in the results) for as long as you do not dismiss it or delete your account. It is not a history, and the home page only offers it for a week.

Technical data

Like any web service, our servers and hosting provider process your IP address and browser details to deliver the Service. We use IP addresses in memory to limit repeated sign-in attempts. To count visits we store, for each page view, the page, the referring website, the device type (desktop, mobile or tablet) and a pseudonym made from your IP address and browser that changes every day, so a visit can be counted once per day but not followed from one day to the next; the IP address itself is not stored. This is done on our own servers: we do not use advertising or third-party analytics trackers, and set no cookie for it.

2. Cookies and local storage

• Session cookie (eh_session): keeps you signed in for up to 14 days. Strictly necessary; HttpOnly.
• Google sign-in cookie (eh_oauth): short-lived, only while you sign in with Google.
• Theme preference (eh.theme, in your browser's local storage): remembers light or dark mode.
• CAPTCHA: on sign-up and password reset, Cloudflare Turnstile may set its own cookie or storage entry to tell people from bots (see section 4).

Because we only use these for the Service to work, we do not show a cookie banner.

3. Why we use your data

• To provide the Service you signed up for: your account, saved studies, chat, uploads (performance of a contract).
• To understand and improve the Service: count visits and see which features are used (our legitimate interest).
• To keep it secure and fair: verify emails, block abuse and disposable addresses, throttle sign-in attempts, apply usage limits, and stop bots with a CAPTCHA (our legitimate interest).
• To email you verification and password-reset codes. We do not send marketing email.
• To meet legal obligations and to establish or defend legal claims.

We do not sell your personal data.

4. Who receives your data

We use these service providers to run the Service. Each receives only what it needs.

• Supabase (database and file storage): stores all account data, saved items, chats and uploaded files.
• Our email (SMTP) provider: receives your email address and the message we send you.
• Cloudflare Turnstile (CAPTCHA): receives a token, your IP address and browser signals when you sign up or reset a password.
• Google, if you choose "Continue with Google": handles that sign-in under its own privacy policy.
• Research sources: your search terms are sent to PubMed and NCBI (including spelling suggestions), Europe PMC, Semantic Scholar, ClinicalTrials.gov, OpenAlex and arXiv. OpenAlex and Unpaywall also receive your account email address as the contact address they ask API users to supply. If you do not want this, do not use the Service.
• AI providers: to write summaries, overviews, data extractions, relevance scores and chat answers, we send them study text (titles, abstracts, and full text or PDFs where relevant), your chat messages, and PDFs you upload. Depending on how the Service is configured, this is processed by a model run by us, or by a cloud provider such as Anthropic, OpenRouter or MiniMax. Do not upload or type anything into the Service that you do not want processed this way, and never include health or other sensitive details about yourself or others.
• Hosting and infrastructure providers that run our servers and network.

These providers may be located outside your country, including in the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses. We may also disclose data when required by law or to protect rights and safety.

5. How long we keep it

• Your account and its content: until you delete your account. Deleting it removes your profile, sessions, saved studies, folders, viewing history, chat history, usage counters and your private uploaded files, along with the figures and tables extracted from them.
• Open-access copies you triggered that are public and shared with other users may remain, but are no longer linked to you.
• Sessions: expire after 14 days.
• Usage statistics and visit counts: about 13 months. When you delete your account, your usage statistics stay only as anonymous counts, no longer linked to you.
• General search log: about 90 days. Cached search results and scores: days to weeks.
• Backups: deleted data may remain in encrypted backups kept by our hosting provider until they are rotated out.

6. Your rights and choices

Depending on where you live (for example in the EU, UK or California), you may have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict some processing, and withdraw consent where we rely on it. You can:

• Delete your account and data yourself at any time on the Account page.
• Change your password on the Account page, or reset it from the sign-in page if you forget it.
• Ask us for a copy of your data, or use any other right, by emailing [email protected]. We will reply within the time the law requires.

If you think we have handled your data unlawfully, you can complain to your local data protection authority.

7. Security

Passwords are hashed with scrypt, session tokens are stored only as hashes, connections use HTTPS, and files are kept in a private storage bucket. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

8. Children

The Service is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

9. Changes to this policy

We may update this policy. When the change is material we will tell you in the Service or by email, and the version above will change.

10. Contact

the operator of Evidence Hub · [email protected]