Privacy Policy
Last updated August 28, 2026
This page explains what LittReview (operated by Cohere Solutions) collects, why, and who it's shared with — written plainly rather than in dense legal boilerplate.
We do not sell your data — not to advertisers, not to data brokers, not to anyone, for any reason. Everything below exists to run the product for you, not to monetize you.
Information we collect
Account information
When you register, we store your username, an optional email address, and a hashed (not plaintext) password. If you enable two-factor authentication, we store the TOTP secret needed to verify codes.
Content you provide
Saved citation maps, notes and drafts, uploaded documents (papers, audio, BibTeX files) and what's extracted from them (text, references), and team memberships are stored so the product can show them back to you. If you share a note with another user or file it under a team, the people you've given access to can see it — that's the point of the feature, and it's opt-in on your part each time.
Optional bring-your-own-AI settings
If you configure your own AI endpoint under Settings, we store that endpoint URL, API key, and model name so the feature keeps working across sessions. You can change or remove it any time. When you use it, the paper text and question involved are sent, per request, to the endpoint you configured — not logged or stored anywhere on our side beyond answering that one request.
Optional OpenAlex / Semantic Scholar API keys
If you add your own API key for either source under Settings (to raise your personal rate limits), we store it against your account and use it only for searches you make.
Optional Zotero connection
If you connect your Zotero library, we store your Zotero user ID and API key so pushes and pulls keep working. This is used only to push papers you choose to Zotero, or pull your library in as seed candidates when you ask.
Optional Google Drive connection
If you explicitly connect Google Drive to store upload originals there, we store the OAuth access/refresh tokens needed to do that. We request only the narrower drive.file scope — access to files this app creates, not your whole Drive.
Demo accounts and waiting list
Demo accounts are provisioned by us and expire automatically. If you join the waiting list or submit a blog contribution, we store the name, email, and message you provide, so we can follow up.
What we don't collect
LittReview runs no third-party analytics or advertising trackers — no Google Analytics, no ad pixels, no session-replay tools. The only cookie set is a functional session cookie that keeps you signed in — not used for tracking or advertising.
How we use it
- To run the product: search, mapping, uploads, notes, teams, and account features.
- To authenticate and secure your account, including optional two-factor authentication.
- To respond to demo, waiting-list, and blog-contribution requests.
Who your data is shared with
We do not sell, rent, or trade your data to anyone, for any reason. It's shared only where strictly necessary to run the service itself:
- Academic sources: search queries are sent to OpenAlex, Semantic Scholar, Crossref, arXiv, DBLP, CORE, DOAJ, HAL, and J-STAGE to run federated search — the same as searching each of those directly. No account identity is attached to those requests beyond your optional personal API key.
- Citation verification's web-search fallback: when a reference can't be matched in the academic sources above, its title is checked against our own self-hosted search index as a last resort — never a third-party search engine.
- Your own AI provider: only if you configure bring-your-own-AI, as described above.
- Your own Zotero account, or Google Drive: only if you explicitly connect either.
LittReview has no AI training pipeline of any kind. We never use your documents, notes, or searches to train a model — ours or anyone else's. Abstract summaries, AI-generated-text detection, and audio transcription all run on our own local pipeline, not a third-party model. The only time your data reaches an external AI model at all is if you explicitly connect one yourself (bring-your-own-AI) — and even then, whether that model's provider trains on what it receives is that provider's policy, not ours.
Data retention and deletion
We keep account and content data for as long as your account is active. To request deletion of your account and associated data, use the delete option in Settings, or email [email protected].
Security
Passwords are stored hashed, not in plaintext. Two-factor authentication is available for regular accounts, and required for administrator accounts, which are kept in a separate credential store entirely independent of regular user accounts.
Not professional advice
LittReview's summaries, citation checks, and AI-assisted features are aids for your own research — they don't substitute for your own reading of the source material or for advice from a qualified professional in your field.
Children's privacy
LittReview is not directed at children, and we don't knowingly collect information from anyone under 16.
Changes to this policy
If we make material changes to this policy, we'll update the date at the top of this page.
Contact
Questions about this policy or your data: [email protected].