Privacy Policy

Last updated: 28 June 2026

In short: PaperMap is local-first. Your research PDFs, library, notes, highlights, and AI keys stay on your own computer. We do not run a server that stores your research, we do not require an account, and the app contains no advertising or behavioural tracking. The limited personal data involved in buying a license is handled by our checkout provider, Lemon Squeezy, acting as merchant of record.

This Privacy Policy explains how Aditya Parupudi ("we", "us", "the developer") handles information in connection with the PaperMap desktop application (the "Software") and the website at papermap.adityaparupudi.com (the "Website"). By using the Software or Website, you acknowledge this Policy. If you do not agree, do not use them.

1. Information we do not collect

Because PaperMap is local-first, the following stay on your device and are never sent to us or stored on any server we operate:

• Your PDF files and the contents of your research folder;
• Your library, projects, citation maps, notes, highlights, tags, and AI-generated summaries;
• Your AI provider API keys (e.g. Google Gemini, OpenAI, Anthropic) and any other keys you enter;
• Your usage of the app. We do not embed analytics, telemetry, advertising, fingerprinting, or behavioural tracking in the Software.

We do not operate user accounts and do not collect a username or password.

2. Purchasing a license (handled by Lemon Squeezy)

Payments and license issuance are processed by Lemon Squeezy, which acts as the merchant of record for your purchase. When you buy or redeem a license, Lemon Squeezy collects and processes the information needed for the transaction — such as your name, email address, billing/location details for tax, and payment information. We never see or store your full payment card details. We receive limited order-related information from Lemon Squeezy, such as your email address, license key status, and order metadata, in order to provide support and manage licenses. Lemon Squeezy's handling of your data is governed by its own privacy policy.

3. License activation and validation

To unlock and keep PaperMap licensed, the Software contacts Lemon Squeezy's license service. When you activate, validate, or deactivate a license, the Software sends your license key and a device/instance label (a basic name derived from your computer, e.g. its hostname or user name) to Lemon Squeezy. This is used solely to verify your license and enforce the per-license device limit. It is not used to track your activity inside the app.

4. Third-party services you choose to use

PaperMap can connect to external services at your direction to find and summarise literature. When you use those features, relevant data is sent to the service you have chosen:

• Academic databases — when you search or fetch papers, your search terms and identifiers (e.g. titles, DOIs) are sent to services such as OpenAlex, Semantic Scholar, arXiv, CORE, and PubMed. As a courtesy required by some of these APIs, the Software may include a generic contact address (papermap@adityaparupudi.com) so the service can reach the operator if needed.
• AI summaries — when you ask PaperMap to summarise a paper or chat about your library, the relevant text or PDF content and your prompt are sent to the AI provider you have configured, using your own API key. Your key is stored locally and is sent only to that provider; we never receive it.

These third parties are independent controllers of the data they receive. We do not control them and are not responsible for their practices, availability, accuracy, or costs. Your use of them is governed by their own terms and privacy policies. You are responsible for reviewing those policies and for any fees or usage limits associated with keys you provide.

5. The Website

The Website is a static marketing page hosted by Vercel. It does not set advertising or behavioural-tracking cookies and does not run third-party advertising analytics. Standard server logs (such as IP address and request data) may be processed by our hosting and infrastructure providers for security and to deliver the site. If you email us or use a contact form, the message and your email address are processed so we can respond. Download links are served from GitHub. These providers process data under their own policies.

6. Legal bases for processing (EEA/UK)

Where the EU/UK GDPR applies, we rely on: performance of a contract (to provide and license the Software and respond to support); legitimate interests (to operate, secure, and improve the Software and Website, and to prevent abuse), balanced against your rights; and consent where required, which you may withdraw at any time.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. If you are in California, you may have rights to know, delete, and correct personal information, and to opt out of "sale" or "sharing" of personal information — we do not sell or share your personal information. To exercise any right, email papermap@adityaparupudi.com. We may need to verify your identity. You also have the right to lodge a complaint with your local data protection authority. Note that much of your PaperMap data never reaches us — it lives only on your device, where it is under your control.

8. Data retention

We retain the limited order and support information described above only for as long as necessary to provide licensing and support, to comply with legal, tax, and accounting obligations, and to resolve disputes, after which it is deleted or anonymised. Transaction records are retained by Lemon Squeezy under its own policies. Your local app data is retained on your device until you delete it; you control it entirely.

9. International transfers

We and our providers (including Lemon Squeezy, hosting, and the third-party services you choose) may process information in countries other than your own, which may have different data-protection laws. Where required, such transfers are made under appropriate safeguards.

10. Children

The Software and Website are not directed to children, and we do not knowingly collect personal data from children under the age of 16 (or the minimum age in your jurisdiction). If you believe a child has provided us personal data, contact us and we will delete it.

11. Security

We take reasonable measures to protect the limited information we handle. Because PaperMap is local-first, the most sensitive material (your research, notes, and keys) never leaves your device, and securing your device and backups is your responsibility. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You use the Software and any connected services at your own risk.

12. Do Not Track

The Software does not track you across services, and the Website does not respond to "Do Not Track" browser signals because there is no cross-site tracking to disable.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date above will change, and material changes will be posted on this page. Your continued use after an update constitutes acceptance of the revised Policy.

14. Contact

Data controller: Aditya Parupudi. For any privacy question or request, contact papermap@adityaparupudi.com.

This Policy works together with our Terms and Conditions.