Privacy by Design

ScholarFlow Privacy Policy

Effective / Last updated: September 2026 · Version 2.4.1

100% Local Processing No Servers No Tracking No Analytics No Data Sales

Core commitment. ScholarFlow is built to the Privacy by Design standard. Every citation, screenshot, recording, and blur layer is processed 100% locally on your device. The extension has no data-hosting servers, no analytics, no advertisement code, and it never sells, shares, or transmits your personal data to any third party.

1. Data the Extension Processes

ScholarFlow only acts when you actively operate it on a webpage:

Bibliographic metadata. Article titles, author names, publication dates, journals, DOIs and URLs you cite. This data is used only to format citations (IEEE, APA 7, Harvard, MLA 9, BibTeX) and is stored in your browser’s local storage (chrome.storage.local).
Screenshots & screen recordings. Full-page / region / element captures and your screen-recording streams are encoded in your device’s RAM and saved only when you choose to download them (PNG / WebM). Nothing is uploaded over the network.
Redaction. Blur / blackout / pixelate effects are applied directly to the page’s DOM on your own machine so you can capture or share safely without exposing personal information.
Cookies (Cookie Manager, manual only). The Cookie Manager lets you read, export (JSON / raw string), import, or clear the cookies of the current site — always triggered by you. Cookies are processed inside your browser and are never transmitted to any ScholarFlow server. Exported cookie files are saved directly to your own computer and stay under your control.

2. Browser Permissions – Full Transparency

ScholarFlow requests the minimum permissions required, in line with the Principle of Least Privilege enforced by Google and Mozilla:

activeTab – read article metadata and capture the active tab, only when you click the extension.
scripting – show the region-selection frame and redaction toolbar on your command.
storage – keep your saved citation library and preferences entirely on-device.
clipboardWrite – copy a formatted citation or captured image to your clipboard.
sidePanel (Chrome/Edge) – display the sidebar research UI.
contextMenus – the right-click “Cite this page” shortcut you invoke.
cookies – used exclusively by the Cookie Manager to read / write the current site’s cookies on your explicit request. Never automatic, never logged, never shared.
browsingData – the “Clear site data to bypass a paywall” button removes the current site’s cached data in your browser, again only when clicked.

Cookie security warning: session cookies are sensitive. Only export or share cookie files with people or devices you fully trust. ScholarFlow is not responsible for consequences if a cookie file leaks due to your own actions.

3. Network Requests for Academic Verification

When you verify a source, the extension sends public, anonymous GET queries to internationally open scholarly databases to confirm article identity and credibility:

Crossref API & doi.org – resolve official DOI identifiers.
OpenAlex API (api.openalex.org) – look up papers in an open index of 250M+ global works.
arXiv API (export.arxiv.org) – retrieve authors and publication year for mathematics / CS preprints.
YouTube oEmbed – resolve titles and official channels when citing educational videos.

These requests are user- or citation-triggered, contain no cookies, no user IDs, and no browsing history.

4. Your Control & Right to Erasure (GDPR & CCPA)

Right to erasure. Delete any single entry or your entire citation library at any time with the “Delete all” button.
Data export. Export your whole saved library to standard .bib / .ris / .txt files that live independently on your machine.
Cookies stay yours. The extension never saves or syncs cookies automatically; every export/import/clear action is manual. You can always clear cookies from your browser’s built-in tools.

5. Open Source & License

ScholarFlow is open source and released under the MIT License. Anyone can review the complete source code to confirm there is no tracking code or malicious behaviour. Full source: github.com/Thuantran520/ScholarFlow.