Privacy Policy

What we collect

• Account information. If you sign in, we get your email address from Google via Supabase Auth (the authentication provider we use). We don't ask for or store a password — Google handles authentication.
• Content you submit. The DOIs, ISBNs, URLs, and reference text you paste in to be formatted. This is processed to generate your citations; we don't use it to build advertising profiles.
• Usage data. Request counts and, for unauthenticated visitors, IP address — used only to enforce the free tier's daily lookup limit.

Cookies and tracking

We use essential cookies and local storage strictly to keep you logged in and to ensure the security of your session via Supabase. Google Analytics only runs if you accept it in the cookie banner shown on your first visit — your choice is remembered in local storage, and no analytics cookies are set unless you accept. We do not use tracking or advertising cookies for marketing purposes.

Data retention

We retain your account information for as long as your account is active. The reference text you submit is processed in real-time to generate your citations and may be temporarily stored in our database logs to maintain your citation history, monitor rate limits, and troubleshoot errors.

Who we share it with

We don't sell your data to anyone. We do share the minimum necessary with:

• OpenAI. Batch and single-source extraction sends the reference text you submit to OpenAI's API for processing. This is how messy, unstructured citations get parsed into structured data.
• Crossref and OpenLibrary. Single-source lookups query these public academic databases with the DOI, ISBN, or URL you provide — nothing else about you is sent.
• Upstash. We use Upstash's Redis service internally to keep the number of simultaneous lookups to citation databases within their usage limits. It only stores short-lived, anonymous request counters — no personal data or identifiers pass through it.
• Paddle.com. If you subscribe to Premium, Paddle acts as our Merchant of Record and handles payment in full. We never see or store your card details — Paddle collects your billing and tax information directly, under its own privacy policy.
• Supabase. Our database and authentication provider. Your account row and citation-related data live on Supabase's infrastructure.
• Google Analytics. We use Google Analytics to understand how visitors use our site (see Cookies and tracking above). It never receives the reference text you submit.

Data security and international transfers

We strive to use commercially acceptable means to protect your personal information, but no method of transmission over the Internet is 100% secure. By using MakeCitation, you acknowledge that your data may be transferred to and processed in countries outside of your own (e.g., on servers located in the US or EU) where our third-party sub-processors operate.

Legal requirements

We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect the rights or property of MakeCitation, or prevent possible wrongdoing.

Your rights

You can request to access, correct, export, or delete your account and associated personal data at any time by emailing support@makecitation.org. We'll confirm once it's done.

Changes to this policy

If we make a material change to what we collect or how we use it, we'll update this page and revise the date above.