Privacy Policy

Effective 29 September 2026

This policy explains what information the Scholio app ("Scholio", "the app") handles, why, and what control you have over it. Scholio is built and run by Al Arafat Tanin, an individual developer ("I", "me"). Package name: com.rng70.researchhub.

In short: Scholio has no ads, no analytics and no tracking SDKs, and it never sells your data. Most of what you do stays on your phone. If you sign in, your library is stored on the app's backend so it can sync across your devices, and only your account can read it.

1. Using Scholio without an account

You can use Scholio without signing in. Your topics, inbox, notes, highlights, collections, reading progress and settings are then stored only on your device. None of it is sent to me.

2. Information you give when you sign in

You can sign in with Google or with an email address and password. Accounts are managed by Supabase, the backend provider Scholio uses (see section 6).

Google Sign-In: Scholio asks Google only for your basic profile: your name, email address and profile picture URL. Scholio does not request access to your Gmail, Drive, contacts, calendar or any other Google data.
Email sign-in: your email address and a password. The password is handled by Supabase's authentication service and stored only as a hash. I never see it.

Your sign-in session is kept in your phone's secure keystore.

3. Information stored when you sync

When you are signed in, Scholio syncs the following to its backend so your library is the same on every device:

Data	Why
Research interests: topics, keywords, venues, muted topics, ranking weights	To rank your feed the same way on each device
Inbox state: which papers you saved, favourited, read or skipped	To keep your triage in sync
Collections, notes and highlights	To keep your annotations in sync
Profile you choose to fill in: handle, display name, bio, and whether the profile is public	Only if you set up a profile
Papers you send from the Scholio browser extension (a DOI or arXiv ID and the page it came from)	So the app can add them to your inbox

This data is protected by row-level access rules: only your signed-in account can read or change it. Two things become visible to others only when you turn them on:

A shared collection can be opened by anyone who has its link. The link is random and cannot be guessed.
A public profile shows your handle, display name, bio and shared collections. It never shows your email address.

4. Summaries and AI features

Scholio can summarise and explain a paper's title and abstract. You choose how in Settings:

Built-in: a simple offline summary made on your device. Nothing is sent anywhere.
On-device model: Scholio downloads an open AI model (Google's Gemma) from Hugging Face once, then runs it entirely on your phone. Paper text never leaves the device.
Your own AI provider: if you enter your own API key for Anthropic, Google Gemini, OpenAI or OpenRouter, the paper's title and abstract (and any question you type in chat) are sent directly from your phone to that provider under your own account with them. Their privacy policy applies to that request. Your API key is stored in your phone's secure keystore and is never sent to me.

Shared summary library. When you are signed in, summaries of public papers made by a capable AI model are shared to a common library so other users of the same paper can reuse them without generating their own. A shared summary contains only the paper identifier, the summary text and the model name. Other users never see who contributed it. You can turn this off in Settings under "Contribute to shared library".

5. Paper sources

To find and show papers, the app sends requests to public scholarly services: arXiv, Semantic Scholar, Crossref, OpenAlex, Unpaywall, ORCID and Grants.gov. These requests contain search terms, topics and paper identifiers (such as DOIs). They do not include your name, email address or account. Like any website, these services can see your device's IP address when it connects to them.

6. Service providers

Provider	Role
Supabase	Hosts accounts, the synced library and the shared summary library
Google	Google Sign-In, if you choose it
Hugging Face	Hosts the on-device model file, downloaded only if you choose the on-device model
AI provider you choose	Only if you add your own API key (section 4)
GitHub	Hosts this website and app downloads

7. What Scholio does not do

No advertising, ad identifiers, analytics or crash-reporting SDKs.
No selling, renting or trading of personal data.
No use of your data to train AI models.
No access to your contacts, location, camera, microphone or files beyond ones you choose to import or export.

8. Permissions on Android

Notifications: for the daily digest and alerts you set up. They are scheduled on your device.
Run at startup: so scheduled notifications survive a phone restart.
Internet: to fetch papers and sync.

9. Google user data

Scholio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google name, email address and profile picture are used only to create and show your Scholio account. They are not shared with third parties, not used for advertising, and not used to train AI models.

10. How long data is kept

Synced data is kept for as long as your account exists. Data on your device stays until you delete it, clear the app's storage or uninstall the app. Signing out removes your session from the device.

11. Deleting your data

On your device: clear the app's storage in Android settings or uninstall Scholio.
Your account and synced data: open an issue at github.com/rng70/skim-app/issues titled "Account deletion request". Do not post your email address in the issue. I will reply there with a private way to confirm the account is yours, then delete the account and all synced data linked to it within 30 days. Summaries you contributed to the shared library carry no link to you and stay in the library.

12. Security

Traffic between the app and its backend is encrypted with HTTPS. Your synced data is isolated per account by the database's access rules. Your session and any API keys are kept in the phone's secure keystore. No system is perfectly secure, but I work to protect your data and will tell affected users about a breach that puts their data at risk.

13. Children

Scholio is not directed at children under 13, and I do not knowingly collect personal information from them. If you believe a child has created an account, open an issue and I will delete it.

14. Changes to this policy

If this policy changes, the new version will be posted on this page with a new effective date. Significant changes will also be noted in the app's release notes.

15. Contact

Questions about privacy: github.com/rng70/skim-app/issues.