Privacy Policy

1. Who We Are

Novaralis is a personalized research intelligence platform that helps students, clinicians, and researchers discover and organize scientific literature. References to "Novaralis," "we," "us," or "our" in this policy refer to the founder of Novaralis, who currently operates the platform as an individual pending incorporation. Our contact email is hello@novaralis.com.

2. Information We Collect

Account information. When you create an account, we collect your name, email address, and password. Passwords are hashed using industry-standard one-way hashing via Supabase Auth — we never store or see your plaintext password.

Profile information. You may optionally provide your institution, role, and research interests. This is used to personalize your research feed and digest.

Usage data. We collect information about how you use Novaralis, including searches, saved articles, projects you create, and in-app actions. This helps us improve the platform.

Feedback. If you submit feedback through the app, we store that message along with your account email.

Cookies and session data. We use essential session cookies to keep you logged in. These are set by Supabase Auth and are strictly necessary for the Service to function. We do not use advertising or tracking cookies. See Section 6 for more detail.

3. How We Use Your Information

• To provide, maintain, and improve the Novaralis platform
• To personalize your research feed, digest, and article recommendations
• To send transactional emails (account confirmation, password resets, weekly digest if opted in)
• To respond to your feedback and support requests
• To understand how the platform is used and where to improve it
• To detect and prevent fraud, abuse, and security incidents
• To comply with applicable laws and legal obligations

We do not sell your personal information to third parties. We do not use your data for advertising profiling.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal bases for processing your personal data are:

• Contract performance: Processing necessary to provide the Service you signed up for (account management, search, saved articles)
• Legitimate interests: Improving the platform, detecting fraud, ensuring security
• Consent: Sending the weekly email digest (you can withdraw consent by opting out in Settings at any time)
• Legal obligation: Complying with applicable laws

5. Cookies and Tracking

We use only the following cookies:

• Session cookies (Supabase Auth): Strictly necessary to authenticate your session. These are set when you log in and deleted when you log out or the session expires. Named sb-[projectRef]-auth-token.

We do not use:

• Advertising or tracking cookies
• Third-party analytics cookies (e.g., Google Analytics)
• Social media tracking pixels

6. Third-Party Services We Use

To operate Novaralis, we share data with the following third-party service providers. These providers process data only as necessary to provide their services and are bound by their own privacy policies.

• Supabase (US) — authentication, database storage, and Edge Functions. Your account data and research content are stored here. Privacy policy
• Vercel (US) — platform hosting and deployment. Serves the web application. Privacy policy
• Resend (US) — transactional email delivery (account confirmation, password resets, weekly digest). Your email address is transmitted to Resend to deliver emails. Privacy policy
• Anthropic (US) — AI assistant powered by Claude. When you use the AI research assistant feature, the article abstracts you select and your research question are sent to Anthropic's API to generate a response. When you use Diagrams, the sketch, photo or description you submit is sent to Anthropic to be read. It is not stored by Novaralis; only the finished diagram is saved, if you choose to save it. When you use Histology study notes, the name of the tissue you searched is sent to Anthropic. We do not send your name, email, or account details to Anthropic. Privacy policy
• PubMed / NCBI (US Government) — article search. Your search queries are sent directly from your browser to NCBI's public API. When NCBI is too busy to answer your browser, the same query is sent through our servers instead.
• Europe PMC (UK/EU) — article search. Your search queries are proxied through our servers to Europe PMC's API.
• Crossref (US) — article metadata. Queries proxied through our servers.
• OpenAlex (US) — article discovery. Queries proxied through our servers.
• arXiv (US) — preprint search (physics, mathematics, computer science, and related fields). Your search queries are proxied through our servers.
• PsyArXiv (US) — psychology preprint search (from the Center for Open Science), found through Crossref's index. Your search queries are proxied through our servers to Crossref.
• DOAJ (EU/UK) — open-access journal search (Directory of Open Access Journals). Your search queries are proxied through our servers.
• U.S. Food and Drug Administration (openFDA) and RxNav (US National Library of Medicine) — drug labels, and food recalls and adverse-event reports. When you look up a drug on the Pharmacology page, its name is sent to both; when you search recalls and reports on the Nutrition page, what you type is sent to openFDA. Nothing identifying you is sent.
• USDA FoodData Central (US Department of Agriculture) and the Dietary Supplement Label Database (US National Institutes of Health) — food composition and supplement labels. When you search foods or supplements on the Nutrition page, what you type is sent to them. Nothing identifying you is sent.
• Clinical Table Search Service (US National Library of Medicine) — diagnosis codes. When you search on the Diagnosis codes page, the words or code you type are sent to it. Nothing identifying you is sent.
• PubChem (US National Library of Medicine) — chemical identification and hazard data. When you identify a chemical structure or look up hazards, the structure or compound name is sent to PubChem. Nothing identifying you is sent.
• Wikimedia Commons (Wikimedia Foundation, US) and Open-i (US National Library of Medicine) — histology slide images. When you search on the Histology page, the tissue you type is sent to both to find slides, and the identifiers of the matching papers are sent to Europe PMC to check each figure's licence. The images then load in your browser directly from Wikimedia and the National Library of Medicine, which receive your IP address as any website you visit does. Nothing identifying you is sent with the search.
• PostHog (US) — product analytics and error reporting. We record which pages you visit and which features you use (for example that an evidence table was built), tied to your account ID. We do not send PostHog your name, email address, search terms, notes, or document contents, and PostHog is configured to store nothing on your device — no analytics cookies are set. Privacy policy
• Upstash (US) — rate limiting and short-term caching of search results. To enforce per-account limits we send Upstash your account ID and a counter; to avoid re-querying the databases above for an identical search, a copy of that search's results is held for up to 12 hours. We do not send Upstash your name, email address, notes, or document contents. Privacy policy
• Cloudflare (US) — bot protection on our sign-in and sign-up forms (Turnstile). When you sign in or create an account, your browser contacts Cloudflare to complete a verification check. Cloudflare does not host this site and does not route its traffic. Privacy policy

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account. Upon deletion, your data is removed from our active systems immediately, and any residual copies in encrypted backups are purged within 30 days.
• Research content (projects, notes, saved articles, documents): Projects you own, and everything in them, are deleted from active systems immediately when you delete your account, unless you first hand a project over to someone on it. What you add to a project someone else owns (documents, articles, screening decisions, comments) is part of their project: it stays there after you leave or delete your account, no longer linked to you. To have something you added removed, ask the project's owner or email us. On a Lab plan, a project you put in your lab can be read by the lab's admins, and if you leave the lab or delete your account it passes to one of them instead of leaving or being deleted.
• Feedback submissions: Retained for up to 2 years for product improvement purposes, then deleted. If you delete your account, your email address is removed from any feedback you submitted and the message is no longer linked to you.
• Server logs: Retained for up to 90 days for security and debugging, then automatically purged.

8. Data Security

We implement reasonable technical and organizational security measures to protect your data, including:

• All data in transit is encrypted via TLS/HTTPS
• Database access is protected by Row-Level Security (RLS) — each user can only access their own data
• Passwords are never stored in plaintext; they are protected with industry-standard one-way hashing
• Service role keys and API credentials are stored in server-side environment variables, never exposed to the browser
• HTTP security headers are enforced on all responses (CSP, HSTS, X-Frame-Options, etc.)

While we take reasonable precautions, no system is perfectly secure. Please use a strong, unique password for your account and enable any two-factor authentication when available.

9. International Data Transfers

Novaralis is operated from the United States. If you access the Service from outside the United States — including from the European Economic Area (EEA) or United Kingdom — your data will be transferred to and processed in the United States. The US may not have data protection laws equivalent to those in your country. By using the Service, you consent to this transfer. For EEA/UK users, where such transfers require additional safeguards, we use service providers that offer Standard Contractual Clauses (SCCs).

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

All users:

• Access and update your profile information in the Settings panel
• Delete your account and all associated data via Settings → Delete Account
• Opt out of the weekly email digest at any time in Settings

EEA / UK users (GDPR):

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request that we limit how we process your data
• Right to data portability: Download everything you have put into Novaralis as a JSON file at any time, from Settings → Download my data. You can also request it by email.
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: For processing based on consent (e.g., email digest), withdraw at any time

California residents (CCPA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to opt out of the "sale" of personal information — We do not sell your personal information.
• Right to non-discrimination for exercising your CCPA rights

To exercise any of these rights, email us at hello@novaralis.com. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before fulfilling certain requests.

11. Children's Privacy

Novaralis is not directed to anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from someone under 18, we will delete that information. If you believe we may have information from or about someone under 18, please contact us at hello@novaralis.com.

12. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and, where required by law, the relevant supervisory authority, within the timeframes required by applicable law (72 hours under GDPR where applicable). Notifications will be sent to the email address associated with your account.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice in the app at least 30 days before changes take effect. Continued use of Novaralis after the effective date of a material change constitutes your acceptance of the updated policy. The "Last updated" date at the top of this page will always reflect the most recent revision.

14. Contact

Questions, concerns, or requests regarding this policy? Please reach us at hello@novaralis.com. If you are an EEA resident and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority.