Privacy Policy

Your research, your data, your browser.

This policy explains what data CoResearcher (operating the website at coresearcher.ai) collects, why, how we use it, and the choices you have. We tried to write it in plain English, grounded in what the app literally does rather than legal boilerplate.

Last updated: April 16, 2026

1. Summary in one paragraph

CoResearcher is a web-based research assistant that lets you run guided AI workflows against your own Anthropic Claude API key. The key, your form drafts, and your starred sources live in your browser’s local storage — we do not transmit them to our servers for storage. When you sign in, we store your email and a session cookie so we can associate you with the documents you create. When you run a research skill, your input text and your API key are sent through our server to Anthropic’s API and (for literature reviews) to Semantic Scholar for paper lookup. We do not sell your data. We do not run analytics or advertising trackers.

2. Who this policy covers

This policy covers the CoResearcher website at coresearcher.ai, including the public landing page, the /research demo, the authenticated project workspace at /projects, and the APIs that power them. It applies to everyone who visits, uses the demo, signs in, or submits a research skill request.

3. Data we collect

We deliberately collect as little as possible. There are four buckets:

3.1 Data you give us when you sign in

  • Email address. Used to send you a magic-link sign-in and to identify your account. Stored in our Cloudflare D1 database.
  • Magic-link tokens. Short-lived, single-use tokens we generate when you request a sign-in email. Stored hashed and deleted after use or expiry.
  • Session identifiers. When you successfully sign in, we set an HttpOnly cookie named cr_session containing an opaque random identifier. The identifier maps to a session row in our database. Typical lifetime: 30 days.

3.2 Data you create while using the app

  • Projects and documents. Project titles and the TipTap-formatted content of any documents you write in the workspace editor. Auto-saved to our database every ~1.5 seconds while you type. Associated with your user account.
  • Skill inputs. The text you type into a research skill’s form (e.g. your research topic, manuscript excerpt, claim to evaluate). These are sent to Anthropic with your request and to Semantic Scholar when performing a literature review. We do not persist your skill inputs on our servers — they transit our Worker, are forwarded to the upstream APIs, and are dropped.
  • Skill outputs. The Markdown generated by Claude in response to your request. Streamed back to your browser and not stored server-side unless you explicitly insert it into a workspace document (at which point it becomes part of your document content, which is saved).

3.3 Data stored only in your browser

The following items are saved in your browser’s localStorage and never transmitted to us:

  • coresearcher_api_key — your Claude API key. Read client-side and included in each research request you make.
  • coresearcher_skill_drafts_{projectId} — per-project form drafts so mid-composition text survives reloads. Soft-capped at 100 KB.
  • coresearcher_active_skill_{projectId} — the last research skill you selected per project.
  • coresearcher_starred_sources_{projectId} — sources you have starred within a project to feed into future runs.

You can inspect or delete any of these from your browser’s developer tools (Application → Local Storage on Chromium-based browsers) at any time. Clearing your browser data clears them too.

3.4 Data collected automatically by infrastructure

  • Network logs from Cloudflare. CoResearcher is hosted on Cloudflare Workers. Cloudflare, acting as our infrastructure provider, processes standard request metadata — IP address, user-agent string, request path, response status, and timestamp — for security, abuse detection, and operational reliability. We do not aggregate this data into user profiles.
  • Session cookies only. We do not use analytics cookies, third-party trackers, advertising pixels, fingerprinting scripts, or session recording tools. The only cookies we set are the two described in section 5.

4. How we use your data

We use the data described above solely to:

  • Authenticate you and keep you signed in.
  • Associate your projects and documents with your account so you can retrieve them later.
  • Forward your skill requests to Anthropic’s Claude API using the key you supplied, and stream the response back to your browser.
  • For the literature-review skill only, forward your topic string to Semantic Scholar’s public paper-search API and merge the results into the prompt sent to Claude.
  • Keep the service running: detect abuse, prevent fraud, debug incidents, respond to legal obligations.

We do not use your data to train any AI models. We do not sell or rent your data to anyone. We do not serve advertising. We do not profile you for marketing.

5. Cookies

CoResearcher sets exactly one cookie:

  • cr_session (HttpOnly, Secure, SameSite=Lax) — set after successful magic-link sign-in. Contains an opaque session identifier. Used to authenticate requests to the workspace and its APIs. Default lifetime: 30 days.

That’s the full cookie inventory. There are no analytics, advertising, or cross-site tracking cookies.

6. Third parties your data touches

Running a research skill sends data to a small, well-defined set of third parties. We pick them for privacy posture as well as capability.

6.1 Anthropic (Claude API)

When you click “Run” on any research skill, your Claude API key and the prompt (system instructions plus your form inputs plus, for literature reviews, the Semantic Scholar results) are sent to https://api.anthropic.com through our Cloudflare Worker. Anthropic is the data controller for that request under its own Privacy Policy and API Usage Policy. Your account with Anthropic is billed directly by Anthropic for usage — CoResearcher does not collect any payment from you for model usage, and does not see your Anthropic billing information.

6.2 Semantic Scholar

For the literature-review skill, we send your topic string to api.semanticscholar.org to fetch candidate papers. Semantic Scholar is operated by the Allen Institute for AI; its public API does not require authentication. We pass only the topic string — never your API key or any other user-identifiable data. Read Semantic Scholar’s privacy notice for their own handling practices.

6.3 Resend (transactional email)

When you request a magic-link sign-in, we use Resend to deliver the email. Resend sees your email address and the one-time login link. It does not see the contents of any research you run. See Resend’s privacy policy.

6.4 Cloudflare (hosting)

CoResearcher runs on Cloudflare Workers with data stored in Cloudflare D1. Cloudflare is our infrastructure subprocessor and processes request metadata (IPs, headers, timing) as part of serving traffic. See Cloudflare’s privacy policy.

We do not share data with any third party other than the four above. If that ever changes, this policy will be updated and the Last updated date bumped before any new recipient receives data.

7. Data retention

  • Magic-link tokens — deleted on use or after their short expiry window (currently 15 minutes).
  • Sessions — expire 30 days after creation or on explicit sign-out.
  • User records, projects, and documents — retained while your account is active. You can request deletion (see section 8); we remove your user row, projects, and documents within 30 days, unless we are legally required to retain logs.
  • Cloudflare request logs — retained according to Cloudflare’s default policy for operational logs.
  • Skill inputs and outputs in transit — not persisted on our servers. They exist only for the duration of the streaming response.

8. Your rights

Depending on where you live (GDPR for the EEA/UK, CCPA/CPRA for California, PIPL for mainland China, the PDPO for Hong Kong, and similar regimes), you may have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Object to or restrict certain processing, and withdraw consent where we relied on it.
  • Port your data to another service.
  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email hello@coresearcher.ai. We aim to respond within 30 days. We may need to verify your identity first (usually by confirming you control the email address on file).

9. Security

We take a defense-in-depth approach:

  • All traffic served over TLS (HTTPS).
  • Session cookies are HttpOnly, Secure, and SameSite=Lax to mitigate XSS exfiltration and CSRF.
  • Provider API keys are encrypted at rest with AES-GCM 256 in our database. We store a hint (last 4 chars + last-updated) and only decrypt server-side at run time; the plaintext is never logged.
  • Magic-link tokens are hashed before storage and expire quickly.
  • Authentication middleware gates workspace and API routes so unauthenticated requests cannot reach your data.
  • Dependencies are reviewed and updated; the platform (Cloudflare Workers + D1) patches infrastructure beneath us.

No system is perfectly secure. If we ever discover a breach that could materially affect you, we will notify you without undue delay and provide remediation guidance.

10. International data transfers

CoResearcher is hosted on Cloudflare’s global network. Your data may be processed in any region where Cloudflare operates (at time of writing, primarily in colocation facilities closest to your network — see the “Smart Placement” setting that our Workers use to optimize latency to Anthropic’s US endpoints). Requests to Anthropic and Semantic Scholar are typically served from United States regions. By using the service, you acknowledge that your data may be transferred internationally.

11. Children

CoResearcher is intended for academic researchers and adult users. It is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

12. Changes to this policy

When we make a material change to how we handle data, we will update the Last updated date at the top of this page and, for signed-in users, notify you by email before the change takes effect. Minor clarifications and typo fixes are made in place without notification. The latest version is always available at coresearcher.ai/privacy.

13. Contact

Questions, data requests, or security reports? Email hello@coresearcher.ai. We read every message.