Privacy Policy
Elicit AI is built and operated by younes EL MAZGUALDI, an independent developer based in Morocco ("we", "us"). This policy explains what we collect when you use Elicit AI, why we collect it, who processes it for us, how long we keep it, and the choices you have. We do not sell your data, we do not show ads, and the app contains no advertising or tracking SDKs.
1. What we collect
Account
You sign in with Sign in with Apple. We receive the stable identifier Apple assigns to you for our app, your email address (or the private relay address Apple creates if you choose "Hide My Email"), and, the first time only and only if you share it, your name. We do not receive your Apple ID password. When you sign in we also store the authorization token Apple issues, encrypted, so that we can revoke it with Apple when you delete your account.
Sessions and sign-in records
Each sign-in creates a session on your device, identified by a token (we store only a hash of it). For security we record the time, IP address and app/device description of sign-ins, token refreshes and sign-outs.
Content you create or upload
- Search queries, filters, search history and saved searches.
- Research questions you ask the research agent, follow-up questions, and the answers, evidence tables and citation checks it produces.
- PDFs you upload or import, the text and passages we extract from them (including text recognised by OCR for scanned pages), your highlights, annotations and chat messages about them, and the answers given.
- Extraction tables, reports, library collections, tags, notes, reading progress, systematic-review screening decisions and routines.
Device and diagnostics
Every request to our servers carries the app version, platform and your chosen language so we can return compatible, localised results. If you send a support report from the app we receive the message you write and a diagnostic summary (device model, OS and app version, language, and recent error codes with user content removed). If you enable push notifications we store the device push token Apple gives us and your notification preferences.
Subscription and usage
We record your plan, its source (App Store), status and expiry, and the RevenueCat customer identifier linked to your account. We never see your payment card or Apple Account details; Apple handles payment. We count how many times you use each feature (for example searches per day or OCR pages per month) and the estimated cost of the AI calls made on your behalf, so that plan limits can be applied fairly.
2. Why we use it
- To provide the service: run your searches, read and index your PDFs, answer your questions, generate reports, sync your library across your devices and deliver notifications you asked for.
- To apply your plan: check that you have an active subscription and keep usage within its limits.
- To keep accounts secure: detect stolen or replayed sessions, abuse and misuse of allowances.
- To support you: answer your messages and diagnose problems you report.
- To meet legal obligations: keep the accounting records that purchases require.
Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (the Terms of Use), our legitimate interests in security, fraud prevention and improving the service, consent where we ask for it (for example push notifications), and legal obligation for accounting records.
3. Who processes it for us
We share data only with the providers listed below, each limited to what their service needs. None of them may use your data for their own purposes.
| Provider | What they receive | Purpose |
|---|---|---|
| Hetzner Online GmbH (Nuremberg, Germany) | All data stored by the service | Hosting of our servers and database |
| Apple | Sign in with Apple identifiers; purchase and subscription records; push notification tokens and the notification text | Authentication, App Store payments, push notifications |
| RevenueCat | An anonymous customer identifier tied to your account, App Store purchase and entitlement data | Subscription management and receipt validation |
| AI model providers (Anthropic and OpenAI) | Your research question or chat message and the paper text, passages or document excerpts needed to answer it (see section 4) | Generating answers, summaries, extractions, reports and OCR fallback |
| Scholarly data sources: OpenAlex, Crossref, PubMed / NCBI, Europe PMC, arXiv, ClinicalTrials.gov, Semantic Scholar, Unpaywall | Your search terms, filters and the identifiers (DOI, PMID, arXiv id) of papers you open; our contact email as these services require | Finding papers, metadata, citations and open-access full text |
| Cloudflare | DNS lookups for our domain only (traffic is not proxied through Cloudflare) | Domain name service |
We may also disclose data when the law requires it, or to protect the rights and safety of our users or the public. If the service is ever transferred to another operator, your data would move with it under this policy and you would be notified in the app.
4. How AI features use your data
The research agent, PDF chat, data extraction, report generation and (when enabled) OCR fallback are performed by large language models hosted by the AI providers above. For each request we send only what is needed: your question, the relevant excerpts of the papers or documents involved, and instructions. We do not send your name, email or account identifiers to AI providers, and we do not allow them to train on your data. AI answers are generated automatically and can be wrong; the app always shows the sources an answer was based on so you can check them.
5. How long we keep it
- Account, library, documents and research content: for as long as your account exists.
- Sessions: sign-in sessions expire after 60 days of inactivity and are deleted when you sign out.
- Sign-in and security records: kept while your account exists; anonymised (your account reference removed) when the account is deleted.
- Purchase and AI cost records: kept for the period accounting law requires, anonymised after account deletion.
- Support reports: kept only as long as needed to resolve your request.
- Offline copies on your device (downloaded PDFs, cached results): stay on your device until you clear them in Settings → Storage & offline, sign out, or delete the app.
6. Deleting your account
Open the app, go to Settings → Delete account and confirm. Deletion is scheduled after a 7-day grace period during which you can cancel it by signing back in. When the period ends we permanently delete your account, library, documents, uploaded files, research history, chats, reports, notification settings and device tokens, revoke your Sign in with Apple authorisation with Apple, and anonymise the records we must keep (section 5). Active subscriptions are billed by Apple and must be cancelled separately in your Apple Account settings; deleting the account does not cancel them. You can also email contact@heytech.work from the address linked to your account and we will delete it for you.
7. Your rights
Depending on where you live (including the EU/EEA, UK, Switzerland, Brazil, California and other US states), you may have the right to access, correct, export or delete your personal data, to restrict or object to certain processing, and to withdraw consent. In the app you can view and edit your profile, export your library (BibTeX, RIS, CSL-JSON), your extraction tables (CSV, XLSX) and your reports (PDF, DOCX, Markdown), and delete your account. For anything else, email contact@heytech.work; we answer within 30 days. If you are in the EU/EEA or UK you may also complain to your data-protection authority. We do not discriminate against you for exercising these rights. We do not sell or share personal data for cross-context behavioural advertising.
8. Security
All traffic between the app and our servers is encrypted with TLS. Session tokens are stored only as hashes and rotate on every refresh; reuse of an old token revokes the session. Credentials and Apple tokens stored on our side are encrypted at rest. Uploaded files are scanned and parsed in an isolated process. Access to production systems is limited to the operator and protected with multi-factor authentication. No system is perfectly secure; if we learn of a breach affecting you we will notify you as the law requires.
9. Where data is stored
Our servers and database are located in Germany (European Union). Apple, RevenueCat and the AI and scholarly providers listed above operate internationally, including in the United States; where European data-protection law applies, transfers to them rely on their standard contractual clauses or adequacy decisions.
10. Children
Elicit AI is not directed to children under 13 (or the higher minimum age for digital services where you live) and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
11. Changes
When we change this policy we update the effective date above and, for material changes, tell you in the app before they take effect. Continued use after that means you accept the updated policy.
12. Contact
younes EL MAZGUALDI · Elicit AI – Scientific Research
Email: contact@heytech.work