Privacy policy
Last updated 31 August 2026
Novelty Scan compares a research idea against published literature and returns a score, a written review, and the papers it compared against. Doing that means holding your account, the text you submit, and the report it produced — and, while a scan runs, sending that text to the providers named below. This page says exactly what that involves.
The short version
- Your account is an email address, and either a password or a Google sign-in.
- The research text you submit is stored against your account, along with the report the scan produced, so that History can show it back to you.
- When a scan runs, your text is sent to OpenAI and search terms drawn from it are sent to Semantic Scholar. That is how the scan works; there is no way to run one without it.
- There is no analytics, no advertising, no third-party tracker and no profiling anywhere on this site. The only cookies are the ones that keep you signed in.
- Nothing here is sold, rented, or shared for anyone else’s marketing.
What is stored
Your account
Your email address, and a password stored only as a hash by Supabase Auth, which handles accounts for this site. If you choose Continue with Google instead, Google returns your email address and an account identifier, and that is what the account is made from — no password is created. Supabase also records ordinary authentication events, such as when a session was issued or refreshed.
What you submit for a scan
The title you give a scan, whether you submitted an idea or an abstract, and the research text itself — between 80 and 12,000 characters. It is stored against your account for as long as the scan exists, which is what allows a report to be reopened from History rather than run again.
The report a scan produces
The novelty score and label, the written review, the stated limitations, and the papers the scan matched to your submission, with their titles, authors, years, links and citation counts. A run that ended without a report stores the reason it stopped instead.
How much of the month you have used
Each account may start a limited number of scans per calendar month, so one row is written per started scan recording the account and the month. It is deliberately kept apart from the scans themselves, which is why removing scans does not give a month’s allowance back. It holds no part of your submission.
Issue reports
When you use Report an issue, what is stored is the kind of report, your message, the path of the page you were on — the path only, never the query string — and, when you were looking at one, which scan the report was about.
Server records
The providers hosting this site keep the standard records any web server keeps: IP address, time, requested address and browser user agent. They are used to operate and secure the service, not to build a profile of you.
What it is used for
- Running the scan you asked for and showing you the report.
- Letting you reopen earlier scans from History.
- Counting scans against the monthly allowance, so the cost of running the service stays bounded.
- Reading and answering issue reports, and diagnosing runs that failed.
- Keeping accounts secure and preventing abuse of the scanner.
That is the whole list. Your submissions are not used to train any model of ours — there is none. They are not used for advertising, and they are not analysed to build a profile of you or your research.
If you are in the UK or the EEA: we process your account and your scans to provide the service you asked for (performance of a contract), and we keep server records and enforce the monthly allowance because a service that cannot defend itself cannot be offered at all (legitimate interests). Where consent is the right basis, you will be asked for it first.
Who else sees it
These are the providers involved in running a scan or keeping your account:
- Supabase
- Accounts, sign-in, and the database holding your scans, reports and issue reports.
- OpenAI
- While a scan runs, your submitted text is sent for the check that reads whether a submission is research at all, for the keyword and embedding steps that find candidate papers, and for the review that produces the score and its reasoning.
- Semantic Scholar (Allen Institute for AI)
- Search terms derived from your submission, used to retrieve candidate papers.
- Only if you choose to sign in with Google, and only for that sign-in.
- Hosting providers
- The infrastructure running this site and the scanner behind it.
These providers process data on our behalf and may do so outside your country, including in the United States, under the transfer terms in their own agreements. Beyond them, data is disclosed only where the law requires it, and we do not sell it to anyone.
Cookies and tracking
This site sets no analytics, advertising or tracking cookies, embeds no third-party trackers or pixels, and does not attempt to identify you across other websites. That is why you were not shown a cookie banner: everything set below is strictly necessary to deliver the service you asked for.
Cookies that are set
sb-…(first party, from Supabase Auth)- Hold the session that keeps you signed in. They are written when you log in, refreshed as you browse so a returning visit does not ask you to sign in again, and cleared when you log out. One that has become unreadable is discarded rather than reused.
That is the complete list. Clearing them signs you out and does nothing else; your scans are held against your account, not against the browser.
Stored in your browser, never sent to us
Your light or dark appearance choice is kept in your browser’s local storage under novelty-scan-theme, so the page opens the way you left it. It stays on the device and is never transmitted.
Signing in with Google
Choosing Continue with Google sends you to Google, which sets its own cookies on its own domains under its own privacy policy. Nothing about that is under this site’s control, and it happens only if you choose that button.
Because nothing here tracks you, there is no behaviour for a “Do Not Track” or Global Privacy Control signal to change.
How long it is kept
- Scans and their reports are kept until the account they belong to is deleted. The workspace does not yet offer a way to remove a single scan; ask using the contact below and it will be removed for you.
- Deleting your account removes what belongs to it — its scans, the papers attached to them, its usage rows and its issue reports — because each is tied to the account in the database and goes with it.
- An issue report outlives the scan it named. If a scan is removed, the report of what went wrong with it survives with the link to it dropped. That is deliberate: the message is the thing worth keeping.
- Server records are kept for the short period our hosting providers retain them, for security and operational purposes.
Your choices and rights
You can ask for a copy of what is held about you, ask for it to be corrected, ask for your account and its scans to be deleted, or object to a particular use of it. Depending on where you live these may be rights you hold under the UK GDPR, the EU GDPR, or a state privacy law; where they are not, we will still honour a request of this kind.
Send your request to Report an issue in the workspace, saying which of these you want. We may need to confirm you control the account before acting, since the request concerns its contents. If you think a request was handled badly, you can complain to your local data protection authority.
How it is protected
Every table holding your data has row-level security enabled in the database, so an account can read only its own rows even if a request asks for somebody else’s. The key capable of bypassing that never reaches a browser; it stays on the server and is used only to write down whether a run finished or failed. Passwords are hashed by Supabase Auth, and traffic to the site is encrypted in transit.
None of that is a guarantee. No system is beyond compromise, and a submission you would not be comfortable seeing outside your control should not be pasted into it.
Children
Novelty Scan is a tool for research work and is not directed at children. Accounts are not knowingly created for anyone under 16; if you believe one has been, let us know at Report an issue in the workspace and it will be removed.
Changes to this policy
When this policy changes, the date at the top changes with it. A change that affects what is collected or who receives it will be described on this page rather than made quietly, and continuing to use the service after such a change means the updated policy applies.
Contact
Questions about this policy, requests about your data, and reports of a run that misbehaved all go through Report an issue in the workspace. It sits beside the scan form, inside every finished report and on a scan that failed, and it attaches the scan you were looking at.