Your work is yours.
How we handle it.

Who is responsible

Distari provides this service from Sri Lanka and handles the account and workspace data described in this notice. For privacy questions or requests from any country, write to privacy@distari.com.

For a purchase, Paddle acts as the merchant of record and handles the payment details it collects under Paddle's privacy notice. We receive transaction status and limited customer and billing details needed to provide access and support.

What we collect

• Account information: email address, password verifier or connected sign-in identity, display name, optional affiliation and ORCID iD, avatar, settings and support messages.
• Signup source: the hostname of the site that referred you, campaign fields beginning with utm_, your optional answer about how you heard of Distari and any friend/supervisor detail you choose to give. Please leave out names and contact details. We use verified email domains to count university cohorts and whether a domain already had a buyer.
• Research and collaboration: papers and PDFs you add, bibliographic records, notes, annotations, questions, generated answers, writing files, project details, invitations, membership, edits and activity visible to authorized collaborators.
• Terms agreement: the Terms version you agreed to, its server-recorded time and whether agreement was made during signup or later. Your account export includes this history; deleting your account removes it and the payment-link ownership records.
• Usage and security: session and device information, IP address, request and error logs, feature and credit activity, AI usage and cost records, and information needed to detect abuse and protect accounts.
• Billing: products, subscriptions, transaction identifiers, payment status, credit ledger and refund records from Paddle. Distari does not receive or store your full card number.
• Product news choice: whether you receive Product news email from us, and when and how each choice was made: at signup, in Settings, from an unsubscribe link, or by our staff at your request.
• Outside contacts: if you are not a Distari user but gave us your email address to hear from us, for example on a waitlist, at an event, through a form on our site or by writing to us, we keep that address, your name if you gave it, where you gave it, a note of when you agreed, and which of our emails we sent you.
• Optional connections: the identity, files or metadata needed for an integration you choose to connect, according to the permissions shown when you connect it.

The native app keeps a bounded local error log with error categories, times and app source locations. It excludes paper content, exception messages and access tokens and stays on your device unless you choose to attach it to feedback. You can review or remove the attachment before sending. Optional error logs and screenshots are sent to our support inbox and are not stored with your research or feedback ticket.

On phones and tablets, the Distari app sends the work you add or change, your online searches and any feedback you choose to send. If you allow notifications, it registers a random installation identifier, the push token issued by Firebase Cloud Messaging, the device platform and the app version; we store the token encrypted. The apps do not send optional usage analytics. We do not enable advertising or automatic crash reporting in the apps, or collect your location or contacts.

Why we use it

We measure signup sources and university cohorts to decide whether a credit referral program would help researchers. Raw signup attribution stays on your account, is included in your account export and is erased with your account. We do not send it to Google Analytics or sign-in providers.

We use this information to create and secure your account, store and synchronize your work, let authorized members collaborate, provide features you request, send service notices, calculate credits, handle support and refunds, diagnose faults and prevent abuse. Where privacy law requires a legal basis, these uses rely on providing the service you requested, our legitimate interest in operating and securing it, legal obligations for records, or your choice to enable an optional feature.

We send occasional Product news email about Distari: new features, changes and events. Accounts that existed before 6 November 2026 receive it because they already use Distari, and every message and Settings let you stop it; new accounts receive it only if they tick the box at signup; outside contacts receive it because they asked to hear from us. We rely on our legitimate interest in telling existing users about the service they use, and on consent for new accounts and outside contacts. We never buy, rent or collect lists of addresses, and we do not track whether you open our emails or click their links.

When you ask Distari to process a paper or use an AI feature, relevant text, prompts and context are sent to Google Cloud's Vertex AI to produce the result. Google says it does not use Vertex AI customer data to train its models without the customer's permission or instruction. Provider safety and abuse processing may still apply. Check a feature's quote before starting credit-funded work.

Who receives it

Project members can access shared project material according to their role. We use Google Cloud for hosting, file storage and Vertex AI, Neon for the database, Resend for service and Product news email, and Cloudflare to route email sent to our public addresses and provide Turnstile human verification during sign-up. Paddle handles checkout, tax, payment and refund processing. Google's Firebase Cloud Messaging delivers notifications to the phone and tablet apps; it receives the device's push token and installation identifier and each notification's title and short description. A sign-in or import provider receives information when you choose to use that connection. To look up a paper's details and reference list, its public identifiers, such as a DOI or arXiv number, and sometimes its title are sent to the scholarly indexes OpenAlex, Crossref and Semantic Scholar; the paper's file and text are not. If you configure a project webhook, its event data is sent to the destination you select. These providers and destinations receive the data needed for their specific purpose; we do not give Paddle buyer information to advertisers.

Cloudflare Turnstile receives your IP address, browser and device signals, and the site hostname when you use the sign-up check. Our server sends the short-lived challenge token to Cloudflare to verify it before creating an account. We do not send your email, password or research content to Turnstile. Cloudflare also uses these signals to improve bot detection, as described in its Turnstile Privacy Addendum. Turnstile sets no tracking cookies of its own for us; pre-clearance cookies are disabled.

Distari is provided from Sri Lanka to people in different countries. Its providers may process information in the United States and other countries. Privacy protections can differ between countries. We use provider agreements and access controls to protect information when it moves across borders, as required by applicable law. We may also disclose information when legally required or to protect users and the service.

Storage and retention

We keep account and project material while your account or project remains active. A deleted project is recoverable for 30 days before its files and records are purged. If you delete your account, we cancel its active subscription first, remove projects you own and anonymize account references that must remain for billing or audit records. Shared project material controlled by another owner may remain in that project.

Transaction and security records may be kept for the periods needed to meet legal obligations, resolve disputes and protect the service. After live data is erased, inaccessible database and file recovery copies may remain for seven days, plus up to one hour for scheduled cleanup. These copies cannot be used to reactivate an erased account or extend an expired export link. We do not promise immediate deletion from a provider's independently controlled payment or safety records; contact Paddle directly about its checkout data.

To detect related sign-ups and limit repeated welcome-credit grants, at your first verified sign-in we record a keyed hash of your network (IPv4 /24 or IPv6 /48), with its autonomous system number (ASN) when a current offline routing dataset can identify it. We do not send your address to the dataset publisher, and add no raw IP address outside the existing session record. The network observation and ASN context are used only for welcome-credit eligibility and review, expire after 30 days and are removed by the hourly privacy sweep. ASN does not decide your eligibility or grant an exemption. Shared networks may include unrelated people; you can use Free without welcome credits and contact support for a reviewed exception.

To prevent repeat welcome-credit grants, we keep a keyed hash of your normalized verified email address and the date welcome-credit eligibility was recorded for as long as Distari offers welcome credits, including after account deletion. Normalization removes plus tags and, for Gmail and Googlemail, ignores dots and treats both domains as Gmail. This separate record contains no email address or account identifier. It is pseudonymous, and its only purpose is deciding welcome-credit eligibility. Accounts on known disposable email domains receive no welcome credits; support can review a refusal. Account-linked refusal and manual-override details are removed when the account is erased.

We keep first-landing attribution in a host-only cookie for 30 minutes; provider signup also uses ten-minute HttpOnly cookies for the sign-in flow and its encrypted human-verification proof. These carry your signup source and create no advertising profile. Anonymous monthly source and domain counts are retained; domain groups below five verified signups are pooled in reports. Temporary links between your account and these counts are kept only for the current and preceding two months and deleted at once on account erasure.

We keep your Product news choices and their history while your account exists, and remove them when it is deleted. An outside contact's details are kept until they unsubscribe or ask us to delete them; after they unsubscribe, we keep their address only so that we never email them again. If an address that unsubscribed is deleted, we keep only a keyed hash of it for the same purpose, which contains no address.

We use a necessary sign-in cookie and local browser storage for preferences, offline work and pending changes. The public site uses Meta advertising cookies only if you separately allow optional audience tracking. If you use a shared device, sign out and clear locally saved browser data when you are done.

The Distari apps keep an encrypted offline copy of your work on the device, with its key in the device's secure key store, and remove it when you sign out. On phones and tablets that copy is excluded from device backups. If you turn on biometric unlock, your device's operating system checks your face or fingerprint and tells the app only whether the check passed; your biometric data never leaves the device or reaches Distari.

Optional audience tracking

If you separately allow Meta audience tracking in this browser, the Meta Pixel sends visits to the public Home, Product, Pricing, FAQ and Apps pages to Meta. Meta receives a pixel and cookie identifier, browser and device information, network information such as your IP address, and the page address without query values or fragments. Meta may use that information to match a visit to its users and build audiences for Distari ads on Facebook and Instagram. We do not send your email, account information, research content, private page URLs or payment details to the pixel. The pixel does not run in the guide, web app or native apps.

The Meta tag stays unloaded until you allow this separate choice. You can decline or withdraw it using Audience tracking preferences below. Withdrawal removes the Meta cookies we set and reloads the current page to stop the tag; it does not erase information already received by Meta. This choice applies only to this browser. Google Analytics consent does not enable Meta tracking. Meta handles information it receives under its privacy policy.

Optional analytics

If you allow analytics in this browser, we use Google Analytics to measure page visits and signup actions on the public site, guide and web app. Google receives analytics cookie identifiers, browser and device information, and network information such as your IP address. This helps us understand how people find and use Distari. We do not send your email, research content, private resource identifiers or sign-in link tokens in our analytics events; page addresses use generic route names and omit queries and fragments.

The Google tag stays unloaded until you allow it. You can decline or withdraw your choice using Analytics preferences below, or Settings → Privacy → Usage analytics in the web app. Withdrawal removes our Google Analytics cookies and reloads the current page to stop the tag. This choice applies only to this browser and is separate from your account and other devices. We do not enable advertising personalization. Our analytics cookies have a configured 90-day lifetime; clearing browser storage also clears your saved choice. Google processes analytics information under Google's privacy policy. The Distari apps for phones, tablets and computers never load Google Analytics.

Your choices and rights

You can edit your profile and notification settings, download a copy of your account and research data from Settings → Privacy, export your credit history, leave projects where permitted, and delete your account in the app. To request access, correction, export or deletion of other personal information, or to object to or restrict processing where the law gives you that right, email privacy@distari.com. We verify your identity before fulfilling a request. Our response target is one calendar month from receipt, and identity checks do not automatically reset it. If a justified extension is necessary, we record it and tell you the reason and expected response date within the original period. You can also complain to the privacy authority that applies to you.

You can turn Product news off in Settings → Notifications or with the unsubscribe link in any Product news email. That stops Product news only: notifications you chose and account, payment and security email still arrive. If you are an outside contact, the unsubscribe link in our email stops every email from us, and you can write to privacy@distari.com to ask what we hold about you or to have it deleted, without needing an account.

Push notifications and optional integrations require your choice or device permission. You can turn notifications off or disconnect an integration. Doing so does not remove research material you already imported or service messages needed for account security.

Delete your Distari account

You can request deletion of your Distari account and its data from any browser, including if you no longer have the Android or iOS app installed. Deletion is permanent. Uninstalling an app does not delete your account.

• Open your Profile in the web app and sign in to the account you want to delete.
• In the Danger zone, choose Delete account. If you own a project or Lab credit pool with other members, transfer ownership or remove that shared ownership first. The deletion flow lists blockers and removes nothing while they remain.
• Review the deletion details, type your account email address, choose Delete my account, then confirm it’s you with your current password or a code from your authenticator app. If you sign in only with Google, GitHub or another provider, sign in again first and delete within ten minutes.

On a phone, open Account from the Folders panel and choose Delete account. On a tablet, choose More → Account → Delete account. Both open the same browser flow. Before confirming, you can save a copy from Settings → Privacy → Download my data.

What is removed: your owned projects and their papers, PDFs, notes and drafts; your Ask threads and private notes, annotations and templates in other people's projects; your profile details and avatar; sign-in credentials, sessions, tokens, device registrations and connected-app credentials; preferences, your Product news choices and the record of our emails to you, notifications, queued account work and live export archives. An active subscription is cancelled before erasure, and your old sign-ins and tokens stop working.

What may remain: shared contributions in projects owned by other people remain under a deleted identity. Credit, payment, refund, audit and privacy-request records needed for legal obligations, disputes or security may remain; surviving account references are pseudonymous, and refund text is cleared. The separate keyed welcome-credit eligibility hash and claim date remain for as long as welcome credits are offered to prevent repeat grants; they contain no email address or account identifier. If you had turned off Product news, a keyed hash of your address remains so that we never email it again. A privacy request retains its address. Paddle controls its own payment records.

Live erased files are inaccessible. Database and file recovery copies may remain for seven days, plus up to one hour for scheduled cleanup. Recovery copies cannot reactivate an erased account. See Storage and retention for retained records and provider limits.

If you cannot sign in or need help requesting deletion, email privacy@distari.com. We verify your identity before fulfilling an emailed request and aim to respond within one calendar month of receipt, as described under Your choices and rights.

Contact and changes

Email privacy@distari.com with a privacy question or request. We may revise this notice when the service or its providers change. We will update the effective date and give notice of material changes when required.