Privacy Policy

1. Scope

This policy explains how AtoMemory processes information when you visit the aPaper website, use an account, or use related research features, and how you can manage that information. Third-party sign-in or model services that you use directly are also subject to the privacy rules of their respective providers.

We process information according to the purpose of each specific feature. Creating an account, using the local research workspace and enabling external model services involve different scopes of data, which are described separately below.

2. Information We Process and Its Purposes

Account and Verification

Registration, sign-in, email binding and password recovery involve processing the email address, username, authentication credentials and verification status you provide, in order to confirm account ownership, establish sessions, restore access and send necessary security notices. Each account also has a stable aPaper ID. Passwords are verified by the authentication service; in applicable password flows, we keep protected security records used to check for matters such as recent reuse.

Profile and Support Communications

We process the nickname, avatar and linked sign-in methods you set, in order to display and maintain your profile. When you contact support, we use the contact details, problem description and necessary verification information you provide to handle the request. Please do not send passwords, verification codes, access keys or unrelated sensitive information in support messages. Community issues and comments you submit are publicly visible together with your displayed author name.

Research Content and Research Memory

Papers, notes and research memory are managed by the app's local data mechanisms. Once networked or AI features are enabled, relevant queries, selected content or context may be sent to the external services those features use. Configuring models, enabling automatic processing and initiating specific operations affect the scope of what is actually sent.

Research memory can be viewed and edited through the entry points the product provides. Turning the feature off stops its further use and updating; turning the feature off should not be taken to mean that all saved content has been deleted.

Service Operation and Website Access

To deliver web pages, protect accounts, control abuse and troubleshoot faults, the service processes necessary network connection information, request times, operation results and error information. The website also uses basic access and performance metrics to improve page quality; when external page resources are loaded, the relevant services also receive the connection information needed to complete the request.

3. Google and GitHub Sign-in

After you choose and authorize third-party sign-in, we obtain the stable account identifier, nickname, account name and basic email information returned by the provider, for authentication, the display of linked methods and the handling of account conflicts.

Google sign-in uses the basic identity scopes openid, email and profile, and does not request to read Gmail messages, Google Drive files or contacts. Third-party sign-in by itself does not automatically enable the reading of research content or model services.

An email address returned by a third party is not the same as an independently verified aPaper bound email. We do not merge accounts merely because the returned email addresses match; binding an email and linking other sign-in methods require completing the verification flows the product requires.

4. External Models and Content Processing

When you use a model service you have configured, the app sends the requests, content or context needed to complete the task to the selected service endpoint. That provider's processing, retention and possible further use of such data are subject to its own policies and to your agreement with it.

Please check the service endpoint and its data rules before configuring and using it, and avoid sending sensitive content to services that are not suitable for processing the materials concerned. Account sign-in and email verification are identity services and are not equivalent to authorization for model inference. For more on feature boundaries, see the Service Agreement.

5. Service Partners and Processing Locations

We use professional service providers for authentication, cloud data and avatar storage, server hosting, network delivery and transactional email. Current providers include Supabase, Alibaba Cloud, Cloudflare and Resend; Google and GitHub are used for the third-party sign-in you choose, and model service providers depend on your actual configuration.

Service partners process the relevant information to the extent required to provide the corresponding features. The account and profile services currently use a cloud project in the Singapore region; network delivery, email and the external services you choose may process data in other regions.

6. Retention and Security

How long information is retained depends on its purpose, account status, security needs and applicable requirements. Account data is used to maintain accounts that still exist; verification codes and temporary credentials expire according to their respective validity periods. The expiry of a credential does not mean that related security records, email delivery records or backups are deleted at the same time.

We protect information with measures such as access control, encrypted transmission and protected credential management. Different services and backups have their own storage mechanisms; when handling a deletion request, we will explain which data can be deleted and which information must continue to be retained. No technical measure can eliminate all security risks.

7. Your Choices and Requests

You can use the product's existing entry points to view or correct your data and to manage linked sign-in methods and research memory, and you can also request access to, correction of or deletion of account information at support@apaper.ai.

To prevent impersonation, account deletion requires a new verification code sent to your independently verified aPaper email. You can request immediate deletion or deletion after seven days in Account & Security. Both options sign you out; signing in before the seven-day deadline cancels scheduled deletion. Support can also help with access, correction and deletion requests. We will explain any limits that apply to backups or security records when handling a request.

You can also revoke authorization in Google or GitHub. Revoking authorization is not the same as deleting your aPaper account; existing sessions continue to be handled according to the corresponding revocation and expiry mechanisms.

8. Policy Updates and Contact

When this policy is updated, the date will be marked. If the purposes or methods of information processing change significantly, we will provide a corresponding explanation and, where applicable, ask for your confirmation.

aPaper is maintained by AtoMemory. For requests concerning this policy or the processing of personal information, please contact support@apaper.ai.

Appendix: Service Regions

aPaper is offered in the following countries and regions (excluding mainland China), listed in alphabetical order:

• Afghanistan
• Åland Islands
• Albania
• Algeria
• American Samoa
• Andorra
• Angola
• Anguilla
• Antarctica
• Antigua & Barbuda
• Argentina
• Armenia
• Aruba
• Australia
• Austria
• Azerbaijan
• Bahamas
• Bahrain
• Bangladesh
• Barbados
• Belarus
• Belgium
• Belize
• Benin
• Bermuda
• Bhutan
• Bolivia
• Bosnia & Herzegovina
• Botswana
• Bouvet Island
• Brazil
• British Indian Ocean Territory
• British Virgin Islands
• Brunei
• Bulgaria
• Burkina Faso
• Burundi
• Cambodia
• Cameroon
• Canada
• Cape Verde
• Caribbean Netherlands
• Cayman Islands
• Central African Republic
• Chad
• Chile
• Christmas Island
• Cocos (Keeling) Islands
• Colombia
• Comoros
• Congo - Brazzaville
• Congo - Kinshasa
• Cook Islands
• Costa Rica
• Côte d’Ivoire
• Croatia
• Cuba
• Curaçao
• Cyprus
• Czechia
• Denmark
• Djibouti
• Dominica
• Dominican Republic
• Ecuador
• Egypt
• El Salvador
• Equatorial Guinea
• Eritrea
• Estonia
• Eswatini
• Ethiopia
• Falkland Islands
• Faroe Islands
• Fiji
• Finland
• France
• French Guiana
• French Polynesia
• French Southern Territories
• Gabon
• Gambia
• Georgia
• Germany
• Ghana
• Gibraltar
• Greece
• Greenland
• Grenada
• Guadeloupe
• Guam
• Guatemala
• Guernsey
• Guinea
• Guinea-Bissau
• Guyana
• Haiti
• Heard & McDonald Islands
• Honduras
• Hong Kong SAR China
• Hungary
• Iceland
• India
• Indonesia
• Iran
• Iraq
• Ireland
• Isle of Man
• Israel
• Italy
• Jamaica
• Japan
• Jersey
• Jordan
• Kazakhstan
• Kenya
• Kiribati
• Kuwait
• Kyrgyzstan
• Laos
• Latvia
• Lebanon
• Lesotho
• Liberia
• Libya
• Liechtenstein
• Lithuania
• Luxembourg
• Macao SAR China
• Madagascar
• Malawi
• Malaysia
• Maldives
• Mali
• Malta
• Marshall Islands
• Martinique
• Mauritania
• Mauritius
• Mayotte
• Mexico
• Micronesia
• Moldova
• Monaco
• Mongolia
• Montenegro
• Montserrat
• Morocco
• Mozambique
• Myanmar (Burma)
• Namibia
• Nauru
• Nepal
• Netherlands
• New Caledonia
• New Zealand
• Nicaragua
• Niger
• Nigeria
• Niue
• Norfolk Island
• North Korea
• North Macedonia
• Northern Mariana Islands
• Norway
• Oman
• Pakistan
• Palau
• Palestinian Territories
• Panama
• Papua New Guinea
• Paraguay
• Peru
• Philippines
• Pitcairn Islands
• Poland
• Portugal
• Puerto Rico
• Qatar
• Réunion
• Romania
• Russia
• Rwanda
• Samoa
• San Marino
• São Tomé & Príncipe
• Saudi Arabia
• Senegal
• Serbia
• Seychelles
• Sierra Leone
• Singapore
• Sint Maarten
• Slovakia
• Slovenia
• Solomon Islands
• Somalia
• South Africa
• South Georgia & South Sandwich Islands
• South Korea
• South Sudan
• Spain
• Sri Lanka
• St. Barthélemy
• St. Helena
• St. Kitts & Nevis
• St. Lucia
• St. Martin
• St. Pierre & Miquelon
• St. Vincent & Grenadines
• Sudan
• Suriname
• Svalbard & Jan Mayen
• Sweden
• Switzerland
• Syria
• Taiwan
• Tajikistan
• Tanzania
• Thailand
• Timor-Leste
• Togo
• Tokelau
• Tonga
• Trinidad & Tobago
• Tunisia
• Türkiye
• Turkmenistan
• Turks & Caicos Islands
• Tuvalu
• U.S. Outlying Islands
• U.S. Virgin Islands
• Uganda
• Ukraine
• United Arab Emirates
• United Kingdom
• United States
• Uruguay
• Uzbekistan
• Vanuatu
• Vatican City
• Venezuela
• Vietnam
• Wallis & Futuna
• Western Sahara
• Yemen
• Zambia
• Zimbabwe