Policies

Privacy

Paperwright keeps what it needs to hold your papers and sign you in, and nothing to sell. This page says what that is.

Your papers

Everything you write and bring in, and everything the AI desks write for you: the question, the outline, the text, your sources and notes on them, your data and analyses, figures, tables, versions and statements. They are yours, and unpublished work stays unpublished. Paperwright never trains a model on your work, never sells it, and sends it to no one but the AI provider you choose, under that provider's terms. You can export a paper whole at any time, and deleting it deletes it.

To find and verify sources, Paperwright sends what you search for and the identifiers of your references (a DOI, a PubMed or arXiv id, an ISBN) to the scholarly indexes that answer: OpenAlex, Crossref, DataCite, PubMed, arXiv, Unpaywall and Open Library. It sends them no text of your paper and nothing that names you.

Visiting the site

Reading these pages sets no cookies, and Paperwright runs no analytics or trackers. Vercel, which serves the site, keeps ordinary request logs for a short time.

Your account

• Your email address, when the account was made and when you last signed in.
• Your sessions: a random token in an HttpOnly cookie called __Host-pw_session, of which we keep only a hash, with the browser's name ("Chrome on macOS") and when it was last used.
• A sign-in code while it is waiting, kept for 10 minutes as a keyed hash, never as the code itself.
• A log of sign-in events by account id with the first part of the IP address only (a /24 or a /48), keeping about the last 10,000.

Your model keys

If you give Paperwright a key for Anthropic, OpenAI, Google, OpenRouter or another provider, it is sealed at rest with AES-256-GCM, opened only to call that provider on your behalf, and never shown back to you beyond its last four characters. What the desks send to your provider is your paper and your instructions, under that provider's own terms. If you use your Claude plan through the connector, Paperwright never sees your Claude login.

Your plan

Paperwright is made by Atypic, and its paid plans are sold by Atypic through Link: Sold through Link, LLC, an affiliate of Stripe, is the merchant of record. Atypic's billing service keeps which plan you're on, whether it renews and when, and how many papers you have, under your account's id; it never sees your writing. When you upgrade, your email address goes to Stripe so Checkout knows you, and you enter your payment details on Stripe's page: Paperwright never sees your card. Stripe and Link use them to take the payment, work out tax, prevent fraud and send your receipts, under Link's privacy policy and Stripe's. Each time you upgrade, Paperwright keeps a record that you agreed Pro renews until you cancel: when, and at what price, by your account's id. It is kept four years, even after the account is deleted, as the law asks.

Who handles it

• Vercel runs the site and its functions, in the United States.
• Upstash stores accounts and papers in Redis, in the United States (us-east-1).
• OpenAlex, Crossref, DataCite, PubMed, arXiv, Unpaywall and Open Library answer searches and identifiers, as above.
• Resend sends the sign-in emails.
• Atypic's billing service, on Vercel and Supabase in the United States, keeps your plan.
• Stripe and Link take payments for Pro.
• The AI provider you choose receives what the desks send it.

Deleting it

On your account page, delete the account: it removes the account, every paper, every session, every key and every connection, at once. The sign-in log keeps only the event and the account id. If you have Pro, cancel it first; Link keeps the record of your payments, as the law asks of it.

This page covers Paperwright; Atypic's privacy policy covers Atypic as a whole. Questions, or a request about your data: support@atypic.ai. The terms say what Paperwright is used and sold on.

Updated 24 October 2026.