Privacy and KVKK notice

Paperlog is an independent limited alpha operated from Türkiye. For this alpha, the Paperlog operator acts as data controller. Privacy requests can be submitted through the contact form.

Information we process

We process the email, display name, profile image, and provider account identifier supplied when you sign in with Google, GitHub, or ChatGPT; optional profile information; ratings; reader notes; replies; helpful votes; follows; saved papers and lists; code-experience reports; notifications; moderation reports; contact requests; timestamps; and security records needed to operate the service. For app-owned Google and GitHub sign-in, Paperlog also stores an encrypted provider token, a session token, session expiry, and limited device or network information such as browser user agent and IP address. Paper and author metadata comes from OpenAlex. Paperlog never receives your identity-provider password.

Why we process it

We use this information to authenticate writers, publish attributed reader activity, maintain profiles and reading lists, prevent abuse, respond to requests, and secure Paperlog. The legal basis may include providing the requested service, legitimate interests in operating a safe alpha, legal obligations, and consent where specifically requested.

Visibility

Your display name, optional profile fields, ratings, reader notes, replies, engagement labels, public lists, and code-experience reports are public. Your login email, private notifications, reports, and moderation records are not displayed. Do not include sensitive personal data in public content.

Processors and international transfers

Paperlog uses OpenAI Sites and Cloudflare for managed hosting, Google, GitHub, and OpenAI for authentication when selected, and OpenAlex for scholarly metadata. These providers may process data outside Türkiye. The operator will assess and maintain the transfer safeguards required by applicable law before a broad public launch.

Retention and account deletion

Profile information and community activity remain while your Paperlog account is active. App-owned sign-in sessions expire after seven days unless refreshed through use. The authenticated account control immediately removes account-linked records from Paperlog’s live application database, including your external-authentication user, linked-provider and session records, profile, logs, saved papers, replies, helpful votes, follows, lists, reproducibility reports, metadata corrections, author claims, submitted reports, notifications, contact requests submitted with the same email, and application rate-limit records. Deletion does not delete your Google, GitHub, ChatGPT, or other identity-provider account. Hosting security logs and backup copies, if maintained by the infrastructure provider, may remain inaccessible to ordinary application users until the provider’s protected retention cycle expires. They must not be restored as active account data after a deletion.

Application rate-limit records use a one-way hash of the account email and are automatically removed after 30 days or immediately with account deletion. Paper and author metadata is not removed because it comes from public scholarly sources and is not created as part of the reader account. Moderation audit entries that do not contain the deleted reader’s email may remain to document administrative actions.

Your rights and requests

Signed-in readers can download their Paperlog-held account data or delete the account from their profile. You may also request access, correction, deletion, restriction, or information about processing through the contact form. We may need to verify that the requester controls the relevant account or email before disclosing or changing data. Requests will be answered as soon as practicable and no later than the applicable legal period.

Security and children

Paperlog uses access controls and limited data collection, but no internet service is risk-free. This alpha is intended only for users aged 18 or older.