Privacy Policy

This policy explains what information Incipit collects, how we use it, who we share it with, and your rights regarding your data. We've written this in plain language because we want you to actually read it.

Account information. When you sign in with Google or Apple, we receive your name and email address from the authentication provider. We do not receive or store your Google or Apple password.

Documents you upload. When you upload a scan, photograph, or PDF, we store the original file on secure servers hosted by Supabase. We also store the metadata extracted from that document (title, date, author, publication, entities, language, and other fields), your verification decisions on each field, your research notes, provenance information, and the metadata changelog.

Research profile. When you set up your research context (your topic, time period, countries, and research goals), we store that information to shape how Incipit analyzes your documents.

Usage data. We collect basic information about how you use the service, such as when you sign in, how many documents you've uploaded, and which features you use. We use this to understand how the product is being used and to improve it.

To provide the service. Your documents are processed by AI (Anthropic's Claude API) to extract metadata, identify entities, and surface connections between documents. Your research profile is included in this processing to shape the analysis. This is the core function of Incipit and the primary reason we process your data.

To maintain your account. Your name and email are used to identify your account and communicate with you about the service (such as important updates or changes to these policies).

To improve Incipit. Aggregated, anonymized usage data helps us understand how the product is used and what to build next. We do not use your individual documents, metadata, or research notes for this purpose.

Incipit relies on the following third-party services to function:

Anthropic (Claude API). Your uploaded documents are sent to Anthropic's API for AI processing. This includes the document image and your research context. Anthropic's data usage policy applies to this processing. As of this writing, Anthropic does not use API inputs to train their models. You can review Anthropic's privacy policy at anthropic.com.

Supabase. Your documents, metadata, and account information are stored on servers provided by Supabase. Supabase provides the database and file storage infrastructure. You can review Supabase's privacy policy at supabase.com.

Vercel. The Incipit web application is hosted on Vercel. Vercel handles the delivery of the application to your browser. You can review Vercel's privacy policy at vercel.com.

Google and Apple (authentication). Sign-in is handled through Google or Apple OAuth. We receive only your name and email from these providers. We do not access your Google Drive, Apple iCloud, contacts, or any other data from these services.

We do not sell your data. Not your documents, not your metadata, not your email, not your usage patterns. We have no advertising business and no intention of building one.

We do not share your documents with other users. Your archive is private to your account. Other Incipit users cannot see, search, or access your documents.

We do not use your documents to train AI models. Your uploaded documents and metadata are processed by the Claude API to provide the service. They are not used as training data for any AI model, by us or by our providers.

We do not access your documents for our own purposes. We may access account data for technical support or to investigate abuse reports, but we do not browse, read, or analyze your research documents for any purpose other than providing the service to you.

We use industry-standard security practices to protect your data, including encrypted connections (HTTPS), secure authentication through Google and Apple OAuth, and hosted infrastructure from providers (Supabase, Vercel) that maintain their own security certifications. However, no system is completely secure. We cannot guarantee absolute security of your data and encourage you to maintain your own backups of important research documents.

We retain your data for as long as your account is active. If you delete your account, we will delete your documents, metadata, research profile, and account information within 30 days. Automated backups may retain data for up to an additional 30 days before being purged. After that, your data is permanently gone.

Access. You can view all of your documents, metadata, and account information within the Incipit application at any time.

Correction. You can edit your metadata and research profile at any time through the application.

Deletion. You can request deletion of your account and all associated data by contacting us. We will process deletion requests within 30 days.

Export. We intend to provide data export functionality in a future update. In the meantime, you can contact us to request an export of your data.

Incipit is not designed for or directed at children under 13. We do not knowingly collect information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly.

Incipit is operated from the United States. If you are accessing the service from outside the United States, your data will be transferred to and processed in the United States. By using Incipit, you consent to this transfer. If you are located in the European Economic Area, United Kingdom, or other regions with data protection laws, you have certain rights regarding your personal data as described in Section 8.

We may update this privacy policy as Incipit evolves. When we make significant changes, we will notify you through the service or via email. The effective date at the top of this page will be updated accordingly.

If you have questions about this privacy policy or how your data is handled, contact us at the email address provided in your account settings or through the Incipit website.