Privacy notice
Draft This page is a draft and may change.
This page explains what CiteDesk keeps on your computer, what is sent to whom when you use an account or sync, and which third-party services the app contacts.
Scope and stage
- This notice covers the CiteDesk app, this website, the User Center, and the sign-in service and sync service that we operate.
- This is the team's internal closed beta with data resets, not a public release. Data in the official services may be wiped and rebuilt. Keep your own copy of anything important; the app can export a library backup.
Data on your computer
- Your documents are Markdown files in a workspace folder. The library, attachments, notes and annotations are in the app's data folder, kept on your own computer.
- Until you create or join a sync space, the library and workspaces are not automatically uploaded to sync storage. Online features such as identifier lookup, full-text retrieval and saving web pages send the information described below.
- Signing in, signing out or switching accounts does not delete local references or documents. Sync that you have already enabled may resume after sign-in.
Account
Accounts are managed by the sign-in service that we operate. Using an account involves the following:
- When you register or sign in, your username, email address, password and verification codes are sent to the CiteDesk sign-in service. Passwords are not stored in plain text. You enter this information on the sign-in page in your browser; the CiteDesk desktop app does not receive the password entered there.
- The sign-in service keeps the login records it needs to prevent account misuse, such as sign-in time, source address and device information. These records are kept for at most 90 days and are then deleted automatically.
- The app stores its sign-in credentials on your computer. The long-lived token is kept in a file in the app's profile folder that only you can read and write; before your first login (or before sync credentials are first saved) you choose whether it is also encrypted with the system keychain (encrypted, the file cannot be used on another computer; unencrypted, anyone who copies or obtains the file can use it to log in to the account). It is used only in the app's main process; the web part of the app cannot read it.
- The User Center website uses only the cookies that are necessary to keep you signed in and to prevent cross-site request forgery. They are not used for statistics or tracking.
- Some emails (email verification, password recovery, security notices) are sent through a third-party email delivery service, which receives the recipient address and the message.
- The sign-in and registration pages use a third-party human-verification service, which receives the browser information needed for the check and the source address.
Sync
- Signing in does not create a sync space. To start syncing, you must explicitly create or join a space. Sync that you have already enabled may resume after sign-in.
- There are two routes: your own S3-compatible storage or WebDAV (the data goes only between your chosen storage provider and your devices, and we cannot see it), or our sync service.
- End-to-end encryption is on by default. In an end-to-end encrypted space, the sync service can see random object identifiers, object sizes and counts, version counts and replacement relationships, deletion status, objects changed together, write and access times, account identifiers and source addresses. It cannot read reference fields, note or annotation text, attachment contents or filenames, workspace text or paths, collection names or members, saved search conditions, space names, or the relationships between objects.
- If you choose plain text when creating a space, or choose to have CiteDesk keep the key, things differ. In a plain-text space the server can read everything. When CiteDesk keeps the key, the data is still stored in the encrypted format, but the server also stores a copy of the master key, so the operator can technically open that space's data. The app says this when you create the space, and you must bind an authenticator before choosing it.
- You keep the recovery code. If you lose it for an end-to-end encrypted space and have no other authorized device, the data cannot be recovered.
- The official sync service stores object bytes in a third-party object storage service. The app uploads directly through short-lived addresses issued by our service; what is uploaded is data in the sync format (ciphertext in end-to-end encrypted spaces).
- History is kept for a retention period, currently 90 days. Older superseded versions are cleaned up by the server.
Third-party services the app contacts
These are the services the app contacts directly when you use the matching feature. The app contains no analytics, advertising or tracking code.
| Service | When | What is sent |
|---|---|---|
| Zotero's style and translator repository | At startup and when you press Update now, if automatic update checks are on | The identifiers, update times and addresses of the styles installed on this computer, and the time of the last check; no references |
| Zotero's retraction list | At startup, and after a reference is added or its DOI or PMID changes | A list update request; when checking, only the first few digits of the SHA-1 hash of a DOI and of a PMID. The DOI itself does not leave your computer |
| OpenAlex, Europe PMC, Semantic Scholar and CORE | When Find Full Text is used and the source is enabled; enabled by default | The reference DOI; enabled sources are queried together |
| Unpaywall | When Find Full Text is used after enabling Unpaywall and entering an email address in settings | The reference DOI and the email address you entered |
| arXiv, bioRxiv and medRxiv | When preprint full-text retrieval is enabled and the reference has a matching identifier or DOI; enabled by default | The arXiv identifier, or the DOI sent to bioRxiv or medRxiv |
| Identifier services and catalogs (DOI, ISBN, arXiv, PubMed and others) | When you add references by identifier | The identifier you typed |
| Publisher and other web pages | When you add from a URL, browse in the browse window, or download attachments | The web request itself (the address, and the cookies the site gave you) |
| Our sign-in service and User Center | When you sign in or use the User Center | What the Account section above describes |
| Our sync service | When a space on our sync service syncs | What the Sync section above describes |
This website
- The website has no analytics, advertising or third-party scripts, and sets no cookies.
- When you choose a language, this website saves only that language preference in your browser to use on future visits. It is not used for statistics or tracking.
- The download, release notes and announcements pages use a short script to read versions and announcements from the User Center's public interface. The request carries no cookies and no sign-in information.
- The website's server may record the time, source address and requested page in its access log to troubleshoot problems. It is kept for at most 90 days and is then deleted automatically.
Feedback and diagnostics
The app's feedback feature sends only the text you write and the diagnostic summary you confirm: app version, system and architecture, sync state, counts of pending uploads and downloads, and fixed problem codes. Feedback contains no reference content, paths, names or account identifiers. To limit abuse, the server counts requests per salted hash of the source address and clears the counts when they expire.
Retention and deletion
- You can delete your account in the User Center. This stops sync writes for the account, clears its sync data and sign-in sessions, and finally deletes the identity. To stop a deleted account from being opened again, we keep a hash record whose content cannot be restored.
- Older data in server backups disappears when the backups rotate. Deleting an account does not instantly erase every backup.
- Signing out or deleting your account does not affect the reference data on your computer.
- Login records, server operation logs and access logs are kept for at most 90 days and are then deleted automatically.
- Actions the operator takes in the admin console, and the sending of account security notice emails (sent after your email address or password is changed), are written to an operations log. It records only the action, the result and hashed identifiers, with no email address, password or reference content. It is kept long term for traceability and is not subject to the 90-day limit.
- For sync spaces where CiteDesk holds the key, the records of requests to retrieve the key and their results are kept for one year.
- The text of feedback you submit is kept for the period the operator sets, currently one year.
Your rights
In the User Center you can view and edit your profile, manage signed-in devices and authenticators, see your sync spaces, and delete your account. Under Korea's Personal Information Protection Act you may ask to access, correct, delete or suspend the processing of your personal information. Please use the contact below.
Overseas transfers
Using these providers means that some of your information (email address, source address, browser information needed for verification, and the data of an official sync space) is handled by third-party providers, which may include providers outside Korea.
Contact and changes
If you have a question about this notice or your personal information, or want to exercise the rights above, write to contact@mail.citedesk.app. This notice changes as the service changes; rely on the latest version of this page.