Privacy Policy
Effective date: 28 July 2026 Last updated: 28 July 2026
This policy explains what personal data Offprint collects, why we collect it, who we share it with, and what control you have over it. It applies to the Offprint mobile app and to readoffprint.com.
Offprint is operated by [LEGAL_ENTITY], based in Illinois, United States, who is the data controller for the purposes of the UK and EU GDPR. You can reach us at support@readoffprint.com.
The short version: we collect the minimum we need to run a social feed for researchers. We do not sell your data, we do not run advertising, we do not use third-party analytics or tracking SDKs, and we do not use your content to train AI models.
1. What we collect and why
Information you give us
| What | Why we need it | Legal basis (UK/EU GDPR) |
|---|---|---|
| Email address | To create your account and sign you in — we email you a sign-in link or code. Also for service notices. | Performance of a contract |
| Your name (first, middle, last) | Offprint uses real names; your name is shown on your profile and next to everything you post. | Performance of a contract |
| Profile details — bio, discipline, profile picture | To populate your public profile. All optional. | Performance of a contract |
| Research interests / tags | To choose which papers appear in your feed. | Performance of a contract |
| ORCID iD and the name and affiliation on your ORCID record | Only if you choose to link ORCID. Used to verify you are the author you say you are and to show a verified badge. | Consent |
| Your posts — reposts, comments, discussion contributions | To display them, publicly, as the core function of the service. | Performance of a contract |
| Direct and group messages | To deliver them to the people you send them to. | Performance of a contract |
| Bookmarks, follows, and preferences | To save your collections and remember your settings. | Performance of a contract |
Information we collect automatically
| What | Why |
|---|---|
| Account timestamps — when you signed up, accepted these terms, completed onboarding, last updated your profile | To operate the account and keep a record that you accepted our terms |
| Device push token | To deliver message notifications, if you turn them on. Handled by Stream and Apple — we do not store it ourselves. |
| Server logs — IP address, request time, user agent, error traces | Security, abuse prevention, rate limiting, and debugging. Kept briefly. |
We do not use third-party analytics, advertising SDKs, cookies for tracking, or cross-app tracking. We do not collect your location, contacts, photos (beyond a profile picture or file you deliberately send), or health data.
2. What is public
Please be aware that the following are public — visible to anyone using Offprint, and potentially indexed on the open web:
- your name, profile picture, bio, discipline, and ORCID badge;
- your reposts, comments, and discussion contributions;
- your follower and following counts.
Your email address is never shown publicly. Your direct messages are not public.
3. Who we share it with
We use a small number of third-party providers ("sub-processors") to run Offprint. They process your data only on our instructions and under contracts that require them to provide the same or equivalent protection for your data as this policy and applicable law require. We do not sell your personal data, and we do not share it for anyone else's marketing.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Our main database, and storage for profile pictures | US / EU |
| Fly.io | Hosts our API servers | US / EU |
| Elastic Cloud | Search index — includes your public profile so people can find you | US / EU |
| Stream (Stream.io) | Direct and group messaging, message attachments, and message push notifications | US |
| Resend | Sends your sign-in emails and service notices | US |
| Apple (APNs) | Delivers push notifications to your device | US |
| Cloudflare | Hosts readoffprint.com, including this page | Global |
| ORCID | Only if you link your ORCID — we exchange your ORCID iD with them | US |
| Modal | AI enrichment of paper metadata. Your personal data is not sent here. | US |
We may also disclose personal data where we are legally required to — for example in response to a valid court order — or where we reasonably need to in order to investigate a violation of our Terms of Service, prevent fraud, or protect someone's safety.
If Offprint is ever acquired or merged, your data may transfer to the new owner. We will tell you before that happens and before your data becomes subject to a different privacy policy.
4. International transfers
Offprint is operated from the United States, and our providers are largely US-based. If you use Offprint from outside the US, your personal data is transferred to the US and processed there.
Where data is transferred out of the UK or EEA, we rely on appropriate safeguards — the UK International Data Transfer Agreement / Addendum, the EU Standard Contractual Clauses, or an adequacy decision (such as the EU-US and UK-US Data Privacy Framework) as applicable. You can ask us for details of the safeguards in place.
5. How long we keep it
- Your account data is kept for as long as your account is open.
- Server logs are kept for up to 30 days, then deleted.
- Sign-in tokens expire within minutes and are deleted after use.
- Deleted content is removed from the live service immediately and purged from encrypted backups within 30 days.
6. Deleting your account and your data
You can delete your account at any time from within the app: Profile → Delete account.
When you do, we permanently delete your profile, your name, your email address, your reposts, your comments, your bookmarks, your follows, your messages, and your search index entry. This cannot be undone.
Two things to be aware of:
- Where you have replied to someone else's discussion, we may keep the structure of the thread so it still reads coherently, but your contribution is removed and no longer attributed to you.
- We may retain a minimal record where the law requires it, or where we need it to enforce a ban on someone we have removed for abuse.
You can also ask us to delete your data by emailing support@readoffprint.com.
7. Your rights
We extend the rights below to everyone who uses Offprint, wherever you live — not only to users in places where the law requires it.
You have the right to:
- access the personal data we hold about you;
- correct anything inaccurate — most of it you can edit directly in the app;
- delete your data ("right to erasure");
- restrict or object to how we use it, including any processing based on legitimate interests;
- port your data to another service in a machine-readable format;
- withdraw consent at any time where we rely on it — you can unlink ORCID in the app, and turn off push and email notifications in your settings. Withdrawing consent does not affect processing done beforehand.
To exercise any of these, email support@readoffprint.com. We will respond within one month.
If you are in the UK or EEA, these rights are guaranteed to you by the UK and EU GDPR, and you can complain to a supervisory authority if you think we have handled your data badly. In the UK that is the Information Commissioner's Office; in the EEA it is your national data protection authority.
If you are in the United States, your rights vary by state. Several states — including California, Colorado, Connecticut, Virginia and others — grant rights to know, delete, correct, and opt out, and a right not to be discriminated against for exercising them. We give every US user those rights regardless of which state you live in. We do not sell or share personal information, as those terms are defined under California and other state privacy laws, and we never have. You may also contact your state attorney general with a complaint.
8. Security
Data is encrypted in transit (HTTPS/TLS) and at rest. Sign-in uses one-time links and codes rather than passwords, which removes a whole class of password-reuse risk — but it does mean your email inbox is the key to your account, so please secure it.
Access to production data is limited to those who need it. No system is perfectly secure; if a breach affects your personal data and poses a risk to you, we will notify you and the relevant regulator as the law requires.
9. Children
Offprint is not for children. You must be at least 16 to use it, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, email support@readoffprint.com and we will delete it.
10. Changes to this policy
We may update this policy. If a change materially affects how we use your personal data, we will notify you in the app or by email before it takes effect. The "last updated" date above tells you when it last changed.
11. Contact us
Email: support@readoffprint.com
We are a small team and we read everything sent to that address.