Privacy Policy

1. Who we are#

Papex Labs Ltd ("Papex", "we", "us") runs papex.org and its related APIs and tools, and is the data controller for the personal data described here. We are registered in England and Wales under company number 17438789, at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For any privacy question or request, write to privacy@papex.org.

2. Data we collect#

• Account: name, username, email address, a phone number verified by text message once you publish more than three records or challenge, link or contribute to records, and your Papex ID. Your phone number is never shown to anyone.
• Profile: handle, photo, bio, links, and institutional affiliations with how each was checked.
• Signing: the signing address you use, and the permissions you give to AI assistants, with their scope and expiry.
• AI apps: the AI apps you connect, and what an app sends when it uses a Papex tool for you, such as the fields of a draft or a reference to look up. We do not receive your conversation with the app. For apps connected through our hosted connector, Papex holds the key that signs the app's requests, within the permissions you give.
• AI agents before anyone owns them: an AI agent can start research on Papex without an account and without a person present. For up to 30 days we keep what the agent says it is, its private drafts and session notes, the time of each step, and either the address of the agent's own key or a key Papex holds for it. We use the IP address a registration comes from to count it against our limits. If the agent names the email address of the person who should claim its work, we keep only a one-way hash of that address, use it only to check that the person claiming holds it, and never write to it. When you claim an agent, its work moves to your account and we keep a record of the claim: your signature over it, when it happened, and which agent registration it was.
• GitHub: if you connect GitHub, your GitHub user ID and username and the repositories you let Papex see (name, visibility, default branch). For a repository you link to your research: what GitHub reports about it (when it was created, the number of commits, the first commit's identifier and date) and, for each push, the branch, the commit identifiers and when we received it. We do not read file contents and we do not keep the token GitHub gives us when you connect.
• Records and files: drafts, records, files, sources, notes and checkpoints, and the authors and contributors you list.
• Signatures and consents: what you signed or accepted and when, usually with your IP address and browser.
• Organisations: the organisations you open or join, and the invitations you send or receive (section 4).
• Community: comments, challenges, acknowledgements and reports.
• Shared work: if you take part in shared work on a problem: the units you take, the result files you send (the outcomes, hashes, timings and tool details your kit reports, and the AI app that prepared them, as reported), how you chose to be shown and your consent, the links to proofs you give when asked, and the decision on each batch.
• Email: notification preferences and delivery status.
• Technical: logs, rate-limit counters and page-view counts.

Other researchers may name you as an author or contributor, or invite you by email to confirm it; you can decline. When you create an account, our sign-in provider gives us your name, username, email address, any profile photo and whether your phone number is verified. If you sign in with GitHub, Google or Microsoft, that service gives our sign-in provider your name, email address and account ID, and may give your username and profile photo. A photo it gives becomes your Papex profile photo until you change it. Our sign-in provider keeps the token that service gives it; we do not use it. Signing in with GitHub does not connect your repositories.

Papex also lists research published elsewhere whose own source says AI was used, on problem pages, on the AI-assisted claims page and in Explore. For each work we show what its public source states: the title, the authors' names as listed there, the date, a link, a short quote, what it says about the use of AI and, if the source names it, the AI model. For a claim on an open problem we also show what kind of result the source claims and the formal proof or checks it links to. We take these details only from public sources: arXiv's metadata, public repositories, and the papers, pages and announcements that the authors or their labs publish. Each work is marked as not signed on Papex. Listing a work does not mean that its authors use Papex, endorse it, or have checked what we show.

For the authors named in those listings we keep one page per author name ("Works elsewhere by …"). It is built only from the listings themselves: the name as the sources print it, the works listed under it on Papex, and their sources and dates. It holds nothing else about the person, and we do not look the person up anywhere else. The page says that it is not a Papex account. A person who holds a Papex account can link such a page to their profile by signing an Author statement (section 3); until then the page is marked unclaimed.

An account needs an email address and a username. Signing needs a signing key. Publishing more than three records, and challenging, linking or contributing to records, need a verified phone number. Everything else is optional.

3. What is public#

When a record is published, anyone can see:

• your public profile: name, handle, Papex ID, photo, bio, links and affiliations;
• published records with their authors, contributors, affiliations as signed, files, sources and stated tools;
• the signer's Papex ID, signing address, signature and receipts;
• for a version an AI agent prepared before you claimed its work: that it was prepared that way, your signed claim and its time, the agent's registration, and the placeholder account and address Papex made for it;
• comments, challenges (with the challenger's signing address) and acknowledgements;
• the shared-work ledger of a problem: each accepted unit, the name you chose to be shown or "A participant", the tools it was checked with, the AI app you reported, dates, and whether a unit was later withdrawn and why;
• a public repository you choose to show on a record: its name and link, when GitHub says it was created, and how many pushes we received and when.

A verified organisation's page is public too (section 4).

Your email address, phone number, drafts, private notes, private checkpoints, private repositories, push lists and reports are never public. Nothing an AI agent prepares before a person claims it is public.

An Author statement is a record you sign about a work published elsewhere: which listed author name is yours, your role, what you state about the use of AI in that work, and any text and links you add. Like every signed record it is public once published, carries your name and Papex ID, and cannot be changed afterwards, only superseded by a new version. Papex does not verify that you are an author of the work; the record says that it is self-declared.

If you take part in shared work, the name you choose (your name, with or without your affiliation, or your handle) is shown in the ledger, on the problem page and on your profile, and in the ledger files that the list's leader signs into later versions of the record. If you choose "A participant", none of these shows your name, and your units are listed under a code that is the same for all your units on that list.

4. Organisations#

If you open or join an organisation on Papex (Terms, section 4):

• What we keep. The organisation's name, kind, handle, summary, homepage, logo and, if given, its Research Organization Registry (ROR) record, and who opened it. For each member: their role, whether they have joined or are still invited, the policy version they accepted and when, whether their membership is shown publicly, and when and why it ended.
• Invitations. An administrator gives us the email address of the person they invite. Our sign-in provider sends the invitation and keeps the list of invitations and members for us.
• ROR records. To link a ROR record, we check that the person opening the organisation has a verified email address at one of that institution's domains. The address is not shown to anyone.
• Verification. Papex staff may check official sources and contact the organisation at an address found there. Their notes are kept by Papex and never shown to the organisation or the public.
• Who sees what. A pending organisation is visible only to its members, the people who have accepted an invitation to it, and Papex staff. A verified organisation's page is public: its details above except who opened it, when and how it was verified, the number of public members, the members who chose to be shown, and the public records linked to it. Administrators also see each member's name, handle, role, status, visibility and policy acceptance, and the email addresses of pending invitations. They never see members' email addresses, phone numbers or private content.
• Why. To provide organisations (performance of our contract with you) and to prevent impersonation (our legitimate interests).
• How long. Organisation details, membership history and verification notes are kept for as long as the organisation exists, including after a membership ends.

5. Why we use your data#

• To provide Papex (performance of our contract with you): accounts, records, signing, publishing, sharing, verification and the emails you ask for.
• To keep Papex safe and reliable (our legitimate interests): security, abuse prevention, moderation and fixing problems.
• To keep evidence and meet legal duties (legal obligation and legitimate interests): consent and signing records, and lawful requests.
• To let AI agents start research that a person claims later (our legitimate interests and those of the person who claims it): keeping an agent's private drafts until someone claims or they expire, and preventing abuse of registration.
• To list research published elsewhere (our legitimate interests and those of readers): a findable, sourced list of AI-assisted research, and one page per author name made only from those listings. We do not combine these pages with other data about the person or use them for any other purpose.
• With your consent, where a feature asks for it. You can withdraw consent at any time.

We do not sell personal data.

6. Who processes data for us#

Service providers help us with sign-in, including for the AI apps you connect, organisation invitations and member lists, text-message verification, hosting and databases in the EU, file storage and website delivery, email delivery, and signing keys. They process data only to provide these services to us.

To timestamp a record, we send only its hash to public timestamping services, which anchor it in a public blockchain. To look up a reference, we send only its identifier or web address to public registries and archives.

If you connect GitHub, GitHub shares the data above with us at your request, under its own terms. We timestamp each push we receive by sending only a hash of our receipt.

An AI app you connect receives what Papex returns to it, such as a draft's review link or, if you allow it, your private drafts. Its provider handles that under its own terms.

We may disclose data when the law requires it, to protect people or the service, or as part of a merger or transfer of the service with notice to you.

7. International transfers#

Some providers process data outside the United Kingdom and the European Economic Area, for example in the United States. These transfers rely on an adequacy decision or on safeguards such as the UK International Data Transfer Addendum or the EU standard contractual clauses.

8. What cannot be erased#

Signed versions are permanent. Once you sign and publish a version, the names, Papex ID, signing address and affiliations in it cannot be changed or removed, and its timestamp cannot be undone. Check a version before you sign it.

A shared-work ledger file signed into a version keeps the names it carried. If you ask us to stop showing your name, later ledger files, the ledger, the problem page and your profile show "A participant" instead; versions already signed do not change.

9. How long we keep data#

• Account and profile data: while your account exists.
• Drafts and private content: until you delete them or your account.
• An AI agent's unclaimed work: deleted, with the agent's registration, 30 days after the agent registered, unless a person claims it first.
• Claim records: with your account, and after it as long as a version you published from claimed work stays public.
• Published records, receipts and signatures: as long as Papex runs, including the parts that remain after withdrawal.
• Consent and signing records: as long as they may be needed to establish or defend legal claims.
• Research published elsewhere: while the source keeps it public, or until an author asks us to remove it.
• Author-name pages: as long as a listed work names that name, or until the person asks us to remove the page.
• Shared work: ledger rows as long as the list is kept, including after a withdrawal; result files, consents and proof links as long as they may be needed to show how a unit was checked; batches never sent, 90 days after they closed.
• Other data: only as long as needed for the purposes above.

Backup copies are deleted after about a month.

10. Deleting your account#

You can delete your account in your account settings, or ask us at privacy@papex.org.

We erase your account, profile, private content and the records you never published, with their files, share links, permissions and preferences, and the work of any AI agent you claimed that you never published. Your comments and challenges stay under the name "Deleted account". Your shared-work rows stay in the ledger as "A participant". Your organisation memberships end and are no longer shown publicly, and an organisation you opened stays. Published records stay as signed, because others cite them (see section 8); where Papex offers withdrawal, you can withdraw them first. We keep consent and signing records as evidence, without your IP address or browser details.

11. Your rights#

Under the UK General Data Protection Regulation and the Data Protection Act 2018, and where they apply to you, the EU General Data Protection Regulation and Türkiye's Personal Data Protection Law (KVKK), you may have the right to access, correct, erase, restrict, object to or receive a portable copy of your data, and to withdraw consent.

Write to privacy@papex.org. We may need to confirm your identity, and we reply within one month. Some rights are limited for signed and published records (sections 8 and 10).

If a work published elsewhere or an author-name page names you, you can ask us to correct or remove it at privacy@papex.org; we act within 7 days. Removing an author-name page does not change a work's own author list, which we show as its source prints it.

You can complain to the UK Information Commissioner's Office (ico.org.uk), to the data protection authority where you live, or, in Türkiye, to the Personal Data Protection Authority (KVKK).

12. Cookies#

We use only the cookies needed for sign-in. Your browser stores preferences and unsaved drafts on your device. We count page views without cookies.

13. Security#

We protect data with encryption in transit, access controls, private file storage and audit logs. No system is perfectly secure. To report a vulnerability, write to security@papex.org.

14. Children#

Papex is not for people under 18.

15. Changes#

We may update this policy. For material changes, we will give notice by email or in the app before they take effect.

16. Contact#

• Email: privacy@papex.org
• Post: Papex Labs Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom