Citeproof Privacy Policy

Last updated: October 7, 2026

Citeproof is operated by Lean Discovery Group LLC (Seaford, Virginia, USA), "we" or "us". This policy explains what we collect when you use the Citeproof website and the Citeproof app in ChatGPT, why, who we share it with, how long we keep it, and the choices you have. Questions: ethan@leandiscoverygroup.com.

1. What we collect

• Text you submit for checking. When you ask Citeproof to check a draft or reference list, the text is processed to extract the references. We store the extracted references, any claim you ask about, and the check results. We do not store the full text you paste.
• Account information (only if you sign in): your email address, an account ID from our sign-in provider, and your time-zone setting.
• Usage counts: how many checks you have used in the current period, so we can apply usage limits. For people who use Citeproof in ChatGPT without signing in, ChatGPT gives us an anonymized identifier for your ChatGPT account; we store only a one-way hash of it, next to your check count. We cannot use it to identify you.
• Technical logs: our hosting provider keeps short-lived request logs (for example, time, requested page and IP address) for security and to keep the service running.

We do not collect sensitive personal data, precise location, contacts, or your ChatGPT conversation history.

2. How we use it

Only to provide Citeproof: run checks and show results, apply usage limits, provide check history and exports, respond to support requests, and protect the service from abuse. We do not sell personal data, show ads, or build advertising or behavioral profiles. We do not use your submitted text to train AI models.

3. Citeproof in ChatGPT

When you use Citeproof inside ChatGPT, ChatGPT sends Citeproof only the text and parameters needed for the request (for example, the references to check). Citeproof does not request, reconstruct or store your wider conversation. Tool results return only what's needed to answer your request. If you link a Citeproof account in ChatGPT, we receive an access token that identifies your Citeproof account, and we use it only to apply your usage limits, history and exports. You can unlink at any time in ChatGPT's settings. ChatGPT's own handling of your data is covered by OpenAI's privacy policy.

4. Who we share it with

We share data only with service providers that help us run Citeproof, each limited to what they need:

• Bibliographic databases (Crossref, DataCite, OpenAlex and Semantic Scholar, plus doi.org): we send reference details such as titles, authors, years and DOIs to look up records. We never send your full text or your identity.
• Vercel: hosting.
• Upstash: database for accounts, usage counts and check results.
• Clerk: sign-in and account linking (once enabled).
• OpenAI: when you use Citeproof in ChatGPT, results are returned to ChatGPT so it can answer you.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or the service.

5. How long we keep it

• Check results not kept in an account history: 24 hours (so you can ask follow-up questions), then deleted automatically.
• Check history kept in an account: 180 days, then deleted automatically.
• Usage counts: until one week after the period resets.
• Account information: while your account is open. If you ask us to delete it, we delete it within 30 days.

6. Your choices and rights

You can use Citeproof in ChatGPT without an account. To access, correct, export or delete your data, email ethan@leandiscoverygroup.com from your account email.

Citeproof is available worldwide. Depending on where you live, including the EU/EEA and UK (under the GDPR and UK GDPR) and US states such as California, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict our processing of it, and withdraw consent at any time where we rely on consent. To exercise any of these rights, email ethan@leandiscoverygroup.com; we may need to verify your identity first, and we will respond within the time the law requires (for example, 30 days, or 45 days for US state privacy requests). We will not treat you differently for exercising your rights. If you are in the EU/EEA or UK, you can also complain to your local data protection authority. We do not sell your personal information or share it for cross-context behavioral advertising. Lean Discovery Group LLC is based in the United States, so your data is processed in the US by us and by the service providers listed in section 4.

7. Security

Data is encrypted in transit (HTTPS). Access to production systems is limited to the operator. No system is perfectly secure, but we work to protect your data.

8. Children

Citeproof is not intended for children under 13, and we do not knowingly collect their personal data.

9. Changes

We will post changes here and update the date above. If a change is material, we will give notice on the website before it takes effect.