Privacy Policy

Rivul is a research writing platform. For the purposes of the UK and EU General Data Protection Regulation, Rivul is the controller of the personal data described below, and the companies named further down are its processors.

Questions about privacy, and every request to see, correct, export or delete your data, go to support@rivul.ai.

Your account. If you register with an email address, we store that address, the name you typed, and a bcrypt hash of your password. We never store the password itself and cannot recover it. If you sign in with Google, we store the email address and name Google returns, and the OAuth tokens Google issues so the sign-in works. We do not store your Google profile picture. We also store a flag recording whether the address has been verified, and a counter that invalidates old sign-in sessions after a password change.

Your work. The documents you write, stored as editor content; the paper brief that steers autocomplete; your references and their bibliographic fields; your saved searches and paper alerts; and your reading annotations, meaning the passage you highlighted and any note you attached to it.

Your library. The PDFs you upload or fetch, kept as files; the text extracted from each of them, including text recovered by optical character recognition when a scan has no text layer; a content hash used to spot a duplicate upload; and the metadata that travels with a paper, such as title, authors, year, DOI, abstract and citation count. The extracted text is also split into overlapping passages of roughly four thousand characters and stored alongside a numeric embedding of each passage, which is what makes semantic search over your own library work.

Usage. Counts of AI actions and autocomplete completions per day, the token counts the AI provider reports for each call, and an internal running cost figure. These enforce your plan's allowance and cap what the service can spend on any one account.

Account activity. A security log of events such as sign-in success and failure, password change, email verification, quota exhaustion, document and library deletion, account export, and account deletion. Each row holds the event name, a small amount of metadata, and a timestamp. For sign-in events that metadata includes the email address the attempt was made with. The log has a column for an IP address and nothing in the codebase writes to it, so in practice it is always empty.

Technical data. Our server logs record a request identifier, the route class with identifiers stripped out, the HTTP method and status, and how long the request took. Where the middleware redirects a request or refuses it for exceeding a rate limit, the log line for that decision also records the client IP address. IP addresses are additionally used as short-lived rate-limiting counter keys, so that one visitor cannot exhaust the service for everyone.

Payment data, once billing opens. Stripe's hosted checkout collects card details on Stripe's own pages, and no card number ever reaches a Rivul server. What we store is Stripe's customer identifier and the state of your subscription: status, whether it bills monthly or yearly, the price it is on, when the current period ends, whether it is set to cancel, and whether the last payment failed.

We do not ask for, and do not want, special-category data as defined by GDPR Article 9. Please do not put patient records, identifiable human-subject data or similar material into a Rivul document or library unless you are authorised to process it and satisfied that this policy is adequate for it.

The database is PostgreSQL hosted by Supabase, which runs it on Amazon Web Services. It holds your account record, documents, references, library catalogue and extracted PDF text, annotations, usage counters, the activity log, and the passage embeddings.

The PDF files themselves are in a private Google Cloud Storage bucket, one object per file, under a path derived from your account identifier. The bucket is not public and there is no unauthenticated route to an object in it. When your browser uploads a large PDF it does so directly to Google Cloud Storage using a signed URL that Rivul mints for that one object and that expires after fifteen minutes; this exists because the hosting platform caps request bodies at about four and a half megabytes.

The application itself runs on Vercel.

If data residency governs whether you may use Rivul for a particular project, write to support@rivul.ai and ask before you upload anything.

This list is meant to be complete. If you find something that reaches a company not named here, that is a bug in this page and we want to hear about it.

Google, as the provider of the Gemini API, receives the text needed to answer an AI request: the passage you selected, the surrounding draft, and any library excerpts used to ground the answer. It also receives the extracted text of a library document, in passages, when that document is embedded for semantic search. Google Cloud Storage, separately, holds your PDF files.

Supabase hosts the database described above and therefore stores everything in it.

Vercel hosts and serves the application, processes every request, and captures our server logs. Vercel Web Analytics and Vercel Speed Insights receive the anonymous page-level measurements described under analytics below.

Resend sends our transactional email, which means it receives your email address and the contents of the message: email verification, password reset, and subscription renewal notices. Nothing marketing is sent through it.

Upstash, when configured, provides the Redis cache that holds scholarly metadata, search results and query embeddings for up to twenty-four hours, together with the rate-limiting counters. Your search text and the text you ask a question about can therefore sit in that cache for the life of the entry. When Upstash is not configured, the same cache is held in the application's own memory and disappears with the process.

Stripe, once billing opens, is the payment processor. Stripe collects and holds your card details and billing address on its own systems, under its own privacy policy. Stripe is not the merchant of record for Rivul.

An error-monitoring service receives crash reports when one is configured, using an endpoint compatible with Sentry, which the operator may also point at a self-hosted instance so that nothing leaves. See the error monitoring section for exactly what is in a report.

The scholarly databases named in the research databases section receive lookup queries and identifiers.

DeepSeek appears in the source code as an alternative AI provider and is switched off. Routing any text to it requires a deliberate configuration flag, and the application refuses to start in production if a DeepSeek key is present without that flag having been set one way or the other, precisely so that sending drafts to a second company in a different country cannot happen as a side effect of a cost decision. If that ever changes, this page changes first.

Rivul does not train any model on your drafts, your library or your prompts. There is no training pipeline in the product and no dataset assembled from user content. We do not sell your content, and we do not share it with anyone for their own purposes.

The question that matters more is what the AI provider does, because that is where your text actually goes. Rivul uses Google's Gemini API. Google's Gemini API Additional Terms of Service draw a hard line between paid and unpaid use. On the paid tier, which means the API project has an active Cloud Billing account, Google states that it does not use your prompts, system instructions, cached content or responses to improve its products, and processes them as a data processor under the Google Cloud Data Processing Addendum. On the unpaid tier, Google states the opposite: it uses submitted content and generated responses to develop and improve Google products and machine learning technologies, and human reviewers may read and annotate that content.

Rivul runs against the paid tier. That is a configuration fact about the API key the service holds and not something the source code can prove, so treat it as a commitment we are making rather than a property of the software: if it were ever untrue, this paragraph would be the one we had broken. If you are working on something where the difference is material, ask at support@rivul.ai and you will get a direct answer.

One consequence worth stating plainly, because it is easy to miss. Embedding happens automatically when you add a PDF to your library, not only when you press an AI button. Uploading a document, fetching one by DOI or arXiv identifier, or re-extracting one sends that document's extracted text to Google's embedding model in passages. If you have a manuscript you are not willing to send to Google at all, do not put it in your Rivul library.

Under GDPR Article 6, our bases are as follows, and the intended reading is that almost everything here is contract rather than consent, because almost everything here is the product working.

Performance of a contract, Article 6(1)(b). Storing and serving your documents, references, library and annotations. Sending your text to the AI provider when you ask for AI output, and embedding your library so that grounding and semantic search function. Fetching citation metadata. Authenticating you and keeping your session alive. Taking payment and managing your subscription.

Legitimate interests, Article 6(1)(f). Enforcing usage allowances and spend caps, without which one account can exhaust a shared resource. Rate limiting, and keeping the security activity log, both of which protect every account including yours. Aggregate analytics and error monitoring, in the minimised forms described below, to know whether the service works. Caching scholarly metadata to avoid hammering public research infrastructure. Our interest in each case is running a service that stays up and is not abused, and the processing is scoped to that.

Legal obligation, Article 6(1)(c). Retaining what tax and accounting law requires of payment records, and responding to copyright takedown notices as described on the copyright page.

Consent, Article 6(1)(a). Only where you connect an optional integration, which today means Zotero. Nothing is sent to Zotero unless you connect it, and disconnecting it stops that.

We do not use your data for automated decision-making that has a legal or similarly significant effect on you, and we do not profile you for advertising. There is no advertising in Rivul.

Citations in Rivul come from publisher metadata rather than from a language model, which means the product asks public scholarly APIs a great many questions. What travels to them is identifiers and search terms. Your draft does not.

Crossref receives DOIs and title or author search strings. DataCite receives DOIs. OpenAlex receives your literature search queries. Semantic Scholar receives search queries and paper identifiers, including when you ask for papers similar to one you hold. arXiv receives search queries and arXiv identifiers, and serves PDFs you choose to fetch. Unpaywall receives a DOI when the product looks for a legally free copy of a paywalled paper, together with a contact address that is Rivul's own, never yours. Resolving a DOI goes through doi.org.

Two of these deserve more than a line. First, some of these lookups happen in your own browser rather than on our server, which is the case for the citation popover and parts of the paper search. When that happens the request comes from your device, so the database sees your IP address and your browser's own headers directly, and Rivul is not in the middle of it. Second, a scheduled job runs once a day and checks every DOI in every library against retraction registers, currently the Retraction Watch dataset and Crossref. That job therefore sends the DOIs of papers in your library, and nothing else about you, to those sources. It is how a paper in your library gets flagged as retracted before you cite it.

Where a database asks integrations to identify themselves, Rivul sends a contact email address belonging to Rivul, so that these services can reach the operator rather than throttle everyone. No user's address is ever used for that.

Rivul sets no advertising cookies, has no tracking pixels, and is not connected to any advertising network. The only cookie the product relies on is the session cookie that keeps you signed in. Browser-local settings remember your light or dark theme and whether this browser has already counted a first-use milestone.

Page-level measurement is Vercel Web Analytics and Vercel Speed Insights, both cookie-free and aggregate. They record a page path, the referring site, an approximate country, a device type and page-load timings. They do not receive your email address, your documents, your library or your account identifier.

Two protections are worth naming because they are the ones that would otherwise leak something. Query strings and URL fragments are stripped before anything is recorded, so a link that happens to carry a token or an address does not reach the analytics provider. And the password-reset and email-verification pages are excluded from measurement entirely, so a page view carrying a one-time token is never sent at all.

Product events count this fixed funnel: clicking the primary call to action; submitting registration; waiting on email verification; completing sign-in; and the first time this browser adds a PDF, inserts a citation, accepts a grounded result, completes an export, or requests Pro access. Properties are fixed labels such as button position, export format, or product surface. No event carries an email, account or document identifier, manuscript text, PDF text, search query, source title, DOI, or file name. Registration events are deliberately identical for a new address and an address that already has an account, so the funnel cannot be used to work out who has an account.

When a crash reporter is configured, a report contains the error message, the error type, a stack trace, which boundary caught it, the request identifier, the route class, and your opaque account identifier. Message fields are cut to five hundred characters and stack traces to two thousand.

The design point is that the report is built from a fixed allowlist of fields rather than by excluding known-bad ones, so a field nobody thought about is dropped rather than transmitted. Nested objects and arrays are discarded outright, because that is the shape in which a request body or a document would arrive. Text is scrubbed for anything resembling a connection string, a bearer token, a key or an email address before it leaves. Your email address is never attached, and your IP address is never attached, because reports are sent from our server rather than from your browser.

A client-side crash beacons the same shape from your browser: the message, the error name, the stack, the boundary, and the path you were on. Not the page's contents, not what you had typed, not a token.

Your account, documents, library, annotations and references are kept for as long as your account exists. There is no automatic expiry on your work and we do not delete an inactive account without telling you.

The security activity log is purged automatically after ninety days by a daily scheduled job.

Cached scholarly metadata, search results and query embeddings expire on their own, within twenty-four hours, and query embeddings within one hour. Rate-limiting counters expire within minutes.

Server logs are held by Vercel for the period its platform provides, which is short and is a property of the hosting plan rather than something Rivul configures. Previous versions of this page claimed a ninety-day retention for server logs; that figure belonged to the activity log above and was wrong here, and stating it correctly is more useful to you than restating it.

Payment records are retained by Stripe under its own terms and for as long as tax and accounting law requires.

Database backups may hold a copy of deleted content until the backup itself ages out. The storage bucket may be configured with object versioning, in which case a deleted file remains recoverable for a bounded window before it is expired. Deletion from the live systems is immediate; deletion from backups follows the backup cycle.

You can delete your account yourself, from settings, without asking anyone. It asks for your current password first, or, if you signed up through Google and so have no password, for you to type your email address. There is no waiting period and no retention offer.

What it removes. Every PDF file in your library, deleted from cloud storage twice over: once for each file the database knows about, and then again as a sweep of the whole storage folder belonging to your account, so that a file no database row points at is caught rather than left behind. Then, in a single database transaction, the passage embeddings computed from your library and the account row itself, which cascades to your workspaces, every document and its references, your entire library catalogue and extracted text, your annotations, usage counters, saved searches, paper alerts, pending email tokens, connected sign-in providers, sessions, and the local mirror of your subscription. Because it is one transaction, either all of it happens or none of it does; a failure leaves an account you can delete again rather than orphaned text with no owner.

If the storage sweep cannot confirm that every file is gone, that is recorded and raised as an error rather than reported to you as success, and the response tells you the sweep was incomplete. An erasure that quietly half-worked is the failure mode this is built to avoid, because nothing in the product would otherwise ever show it.

What it does not remove, stated because a policy that only lists the reassuring half is not worth reading. Rows in the security activity log survive, with the link to your account severed so that they no longer identify you, until the ninety-day purge reaches them; one of those rows is the record of the deletion itself, holding the row counts removed and the Stripe customer reference, because proof that an erasure happened has to outlive the thing it is proof of. Cached search results and embeddings survive until their own expiry, within twenty-four hours. Copies inside database backups survive until the backup ages out. Records held by Stripe, and any error reports already sent to the monitoring service, are governed by those companies' retention rather than ours.

If you have a paid subscription, deleting the account cancels it immediately, before any of the rest of this happens, and stops every future charge. If Stripe cannot be reached, the deletion is refused so a charge cannot outlive the account. The unused part of the current period is not refunded automatically — that follows the Refund and Cancellation Policy — but a charge that arrives after the deletion is refunded in full if you write to support@rivul.ai.

Export your work before you delete it, because deletion is not reversible. The export is described next.

If you are in the UK, the European Economic Area or a jurisdiction with comparable law, you have the right to know what we hold, to get a copy, to correct it, to have it erased, to receive it in a portable form, to restrict or object to certain processing, and to withdraw a consent you gave. We extend the same handling to everyone, wherever they are, because operating two standards would mean building the worse one.

Three of these you can exercise yourself, right now, without contacting us, which we consider the point. Access and portability: settings has an export that produces a single ZIP containing your account record, one file per paper as both structured data and Markdown, the text extracted from each library PDF, your annotations, saved searches, alerts, usage totals and recent account activity. It also contains a plain-English note explaining what is in it and what is not, including anything the size limit forced it to leave out. The original PDF files are not included, since they are the publishers' files and you already hold your own copies; the archive lists every one of them with its filename, content hash, DOI and source URL, so it is a complete catalogue. Your password hash, sign-in tokens and connected-account credentials are excluded on purpose, because exporting credentials is a security hole rather than a portability feature. Erasure: the account deletion described above. Correction: your name, email and password are editable in settings, and every document and library item can be edited or deleted individually.

For anything else, including restriction, objection, or a question about a specific piece of processing, write to support@rivul.ai. We aim to answer within thirty days, which is the GDPR deadline. We do not charge for a request and we do not require a particular form of words.

If you think we have got it wrong, you can complain to your national data protection authority. In the EU that is the authority for the country you live in; in the UK it is the Information Commissioner's Office. We would rather you told us first, but that is your right and not conditional on doing so.

Rivul's providers are United States companies, and processing your data will involve transferring it to, or making it accessible from, the United States, whichever region your data is stored in.

For transfers out of the UK or the European Economic Area, the mechanism relied on is the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, as incorporated into each provider's data processing terms. Google, Vercel, Supabase, Stripe, Resend and Upstash each publish a data processing agreement containing them.

Rivul is built for academic researchers and is not directed at children. You must be at least sixteen years old to hold an account, or older where your country sets a higher age for consenting to online services on your own behalf. We do not knowingly collect personal data from a child. If you believe a child has created an account, write to support@rivul.ai and it will be deleted.

What is actually true, rather than the usual list of adjectives. All traffic is served over HTTPS. Passwords are stored as bcrypt hashes and are not recoverable, by us or by anyone with the database. Email verification and password-reset tokens are stored hashed, are one-time, and expire. Changing a password invalidates every session issued before the change. The PDF bucket is private, and a browser reaches an object in it only through a short-lived signed URL scoped to that single object. Card data never touches a Rivul server, because checkout is hosted by Stripe.

Data at rest is encrypted by the storage providers, which is to say by Supabase and Google Cloud Storage as part of their platforms, rather than by an additional layer Rivul applies on top. Earlier versions of this page said Rivul encrypts sensitive credentials at rest; that described a per-user API key feature which has since been removed from the product, and it is no longer accurate, so it is gone.

Rivul is a small operation and this is worth saying rather than implying otherwise. There is no security certification, no SOC 2 report, and no penetration test to point at. No system is perfectly secure. You are responsible for keeping your own credentials confidential, and using a password you have not used elsewhere is the single most effective thing you can do.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within seventy-two hours of becoming aware of it, as GDPR Article 33 requires, and we will notify you directly, by email to the address on your account, without undue delay where Article 34 requires it or where we judge that you would want to know.

A notification will say what happened, what data was involved, what we have done about it, and what we suggest you do. It will not wait until the investigation is complete, because a late complete answer is worse than a prompt partial one.

When this policy changes we will post the new version here with a new last-updated date at the top. If a change materially reduces your protections or widens what we do with your content, we will email account holders before it takes effect rather than relying on you to notice.

Contact for anything on this page, including every request under the rights section: support@rivul.ai.