Last updated: August 2026 (updated 21 Aug — W1.42 UI Simplification: the Research Cafe workspace was rebuilt into three columns (a left panel with Chats/Reports/Sources tabs, a centre reading pane, and a Serving Tray on the right) — a visual and navigational change with no new third-party service and no change to what personal data is collected, EXCEPT two new pieces of AI-generated Q&A content described here. First, when the Thinking switch is on for a question and the model returns its own reasoning, that reasoning text is now stored alongside the answer (a new nullable cafe_qa_history.reasoning column) — the model's own output about your question, sent to the same already-described OpenRouter/Venice providers, never used for AI training. Second, after each Cafe-sources or Web-mode answer, up to six suggested follow-up questions are generated by one additional AI call (a new "Suggest follow-ups" switch, on by default) — your question, the answer, and up to three earlier turns of the same chat are sent to a fast, low-cost model Coffeescribe selects (never the model you picked for chat) and the suggestions are stored (cafe_qa_history.followups, followups_hidden) so they persist across reloads; this reuses the same OpenRouter/Venice providers already described, no new third party, and is billed to your token balance (BYOK-aware). Turning the switch off stops future calls; it does not delete suggestions already generated. Also renamed: the per-chat "Use in answers" toggle is now labelled "Add to your cafe memory" in the product — same mechanism, described under Chat Sessions below. See §3 Research Mode below. Prior entry: updated 20 Aug — W1.35 P4 Chat Attachments: the Cafe chat composer's paperclip lets you attach a document, image, audio clip, or short video (or pull in an existing café source) — replacing the toolbar's old "Upload a document" entry. Every upload is stored as an ordinary cafe_sources row, same as before; what is NEW is a private cafe-attachments Storage bucket holding the ORIGINAL file bytes (owner-scoped, never exposed to any other user, including shared-link viewers), and — for images, audio, and video only — those file bytes are sent to a pinned AI model (currently Google Gemini, via OpenRouter) at upload time to produce a text transcript or description, which is what actually gets stored and searched; the original media file itself is never sent anywhere beyond that one conversion call. This corrects the general "uploaded files are never sent to external services" statement below for media specifically — it was, and remains, true for documents (PDF/DOCX/TXT/MD/EPUB/HTML), whose text is extracted entirely on our own servers. In General mode, an attachment is additionally bound to the chat that created it (a new nullable cafe_sources.chat_session_id column) so its full text can be re-sent to OpenRouter/Venice on every later question in that conversation — Grounded-mode uploads are never bound to a chat. Deleting a chat now asks whether to also delete the files uploaded through it (default: keep them as ordinary sources); a source merely picked from existing café sources into a chat is never deleted by that choice. No new category of personal data about you as a person — this is your own uploaded content, processed and stored the way research sources already are, just with a new storage bucket for originals and a new (opt-in-by-uploading) AI processing step for media specifically. See §3 Research Mode below and §4 Data Retention. Prior entry: updated 18 Aug — W1.41 Social Sources Consent: scraping of social platforms (Instagram, Facebook, TikTok, YouTube, X/Twitter, LinkedIn, Reddit, Google Scholar, and smaller platforms such as Telegram, Snapchat and Truth Social) is now OFF by default for your whole account. The first time you start research that could reach one of them you are shown the Social Sources Terms and asked to accept; declining still runs your research, without those platforms, and the run record names which ones were skipped. You can change the answer any time in Settings → Data & Privacy → Social platform sources — turning it off keeps the acceptance record and stops the scraping. This closes a gap between the previous wording of this policy and the code: the fast research engine added in the previous release could run these Actors without the per-Café consent this section described. The switch is enforced on the server on every path — both research engines, Research a Person, and the per-platform search endpoints — with no administrator exception. We store your acceptance timestamp and the terms version on your account row; no new third party and no new category of data. See §3 Apify below. Prior entry: updated 16 Aug — W1.35 P3 Conversation Context Memory: your Cafe chat's conversation memory — already described under Chat Sessions below — is now rebuilt on our server from those same stored turns each time you ask a question, instead of being held only in your browser tab; it reaches further back (up to 20 exchanges, up from 10) before this shipped, reloading the page reset it to zero. This is a mechanism change to how already-stored conversation data is read and replayed to the same already-described AI providers (OpenRouter/Venice) — it does not add a new category of stored data or a new third party. Two related changes: a chat with "Use in answers" on no longer retrieves its own transcript into its own answers (it could previously cite itself as if it were a separate source); and if a General answer stalls mid-response, we now automatically discard the partial attempt and ask the provider again once, rather than showing you a failure — you are billed once, for the answer you receive, never for the discarded attempt. A related admin-only control was also added — pairing a slow answer with a second, simultaneous call to a different AI model and using whichever finishes first — but it ships switched off and is not active for any user in this release; if it is ever turned on this entry will be updated to name the second model. See §3 Research Mode below. Prior entry: updated 15 Aug — W1.35 P2 Café Chat Sessions: your Cafe's Q&A conversations were already stored server-side (the cafe_qa_history table, described under Research Mode below) — this release organises them, it does not start collecting them. Each conversation is now also a row in a new cafe_chat_sessions table (a title — from your first question or one you edit — plus an active/archived status); starting a new chat archives the old one instead of deleting it, and your pre-existing history was automatically grouped into one archived chat per Cafe when this shipped. A new per-chat opt-in ("Use in answers", off by default) can store a chat's transcript as an ordinary Cafe source, using the same on-server storage and embedding already described, so a Grounded answer can cite it — turning it off removes that copy. No new third-party service, no new AI processor, and this data is still never used to train any AI model (see the AI Content Policy) — the W13 training-corpus proposal referenced in earlier planning was explicitly NOT part of this release. See §3 Research Mode below. Prior entry: updated 14 Aug — W1.39 Venice-Native Web Search for General Chat: Venice-served research models (e.g. "DeepSeek V4 Flash 0731 Fast") can now perform their own live web search when you use them in Ask Your Cafe's General mode with the Web search toggle on — your question is sent directly to Venice's own search-and-answer pipeline and Venice returns cited results, the same kind of third-party web query OpenRouter's search plugin already performs for other models, just routed to a different processor for that call. This replaces the W1.37-era restriction described immediately below (Venice models could not search); other steps that inherently need a web search — Auto-Write, Find the Truth evidence-gathering, Verify, Detect Conflicts — are unaffected and continue to route to OpenRouter as already described. No new category of personal data and no new third-party service: Venice was already a described processor as of W1.37 for non-search requests; this only changes when and why a query reaches it, and only for General-mode chat. See §3 Venice.ai below. Prior entry: updated 14 Aug — W1.37 Venice.ai Second Model Provider: Coffeescribe now runs some Research Mode AI operations (Ask Your Cafe, Auto-Write, Find the Truth, Verify, Detect Conflicts, and admin model ratings) directly against Venice.ai instead of OpenRouter, when you select a Venice-served model (e.g. "DeepSeek V4 Flash 0731 Fast") from the research model picker. This is a new named AI processor for those specific requests, not a new category of personal data — the prompt/context sent is the same kind of content already described for OpenRouter, just routed to a different processor for that one call. Venice models are research-only (not offered for book/Quick Read/import generation) and do not perform web search inside Coffeescribe in this release; any step that inherently needs a web search still runs on an OpenRouter model, and Coffeescribe records when that substitution happens. BYOK (Bring Your Own Key) now covers a seventh provider, Venice — entirely optional, encrypted the same way as the other six, and cascade-deleted the same way. See §3 Venice.ai below. Prior entry: updated 22 Jul — W1.18 Step 2 Research Engine Unification: Auto-Write's four modes are now From Sources, Café (writes only from your Ask-Your-Café in-scope sources), Tray + Sources, and From Tray — the earlier free-text "Topic" mode was removed from Auto-Write; researching a fresh topic now goes through Auto-Research first, and you then select from what it gathered. Every mode now supports granular per-source selection (include/exclude individual sources) and "run-picking" (folding a whole prior Auto-Research run, Find the Truth run, or earlier Auto-Write report into a new report as input) — this only changes which of your own already-stored sources are included in a report request to OpenRouter, not what is collected. On a Deep Auto-Research run you may now see 2-5 optional multiple-choice questions (the "Research Intent Interview") to sharpen what the agent looks for; always skippable, and if answered your questions/answers are stored on that research run (your own account data, not shared with any new third party) and used only to shape that run's OpenRouter prompts. Gathered sources are now also tagged with a topical-relevance score, stored alongside the source in the existing cafe_sources record — no new third-party service, no new category of personal data. See §3 Research Mode below. Prior entry: updated 18 Jul — W1.17 Unified Reports: Auto-Research's synthesised extraction cards (Comprehensive Summary, Key Findings, Most Recent, etc.) are now stored as cafe_artefacts rows (type=auto_research_report) rather than cafe_tray_items — the same table every other research report already used. No new third-party service and no new category of personal data; this is a storage-location change to content that was already being generated and stored. One real data-flow change: report content across ALL report types (Auto-Write, Detect Conflicts, Verify, Find the Truth, person reports, and now Auto-Research) is embedded into the existing cafe_source_chunks search index — using the same on-server, open-source embedding model already described below, no new external call — so it can be found by Ask Your Cafe; previously only Auto-Research's extraction cards were embedded (because they were tray items). A one-time backfill converted 67 pre-existing Auto-Research extraction cards to the new storage the same way; the old rows were kept, not deleted. Also adds a "Save to Notebooks" action that saves a whole report as a note (reusing the existing cafe-note storage already described under Q&A Chat / Notebooks) — no new data category. Prior entry: updated 18 Jul — W55/W55.1 "Research a Person": a new Research Cafe feature compiles a cited dossier about a NAMED individual (not you) from public sources. Stage 1 (free) sends the name/details you type to Wikidata and Wikipedia to find and confirm who you mean — no run is created and nothing is billed at this stage. Stage 2 (paid, opt-in per run) gathers clean public-record sources (web, news, Wikipedia) always, and — only once the confirmed identity is server-verified as a public figure — social-platform content (X/Twitter, Instagram, TikTok, YouTube, Facebook, LinkedIn) via Apify, under the SAME per-Cafe, per-platform consent already described below; adds Facebook and the free Wikidata API to the existing Apify/Research Mode lists. No contact information or addresses are ever collected — enforced at two separate points in the pipeline (stripped at ingest, forbidden in the generated report) — and a non-public/unconfirmed subject's run never unlocks social sources. New tables: cafe_person_runs (run lifecycle: status, phase, footprint, depth, an identity_anchor JSONB, a heartbeat_at liveness column) and a new nullable cafe_sources.metadata JSONB column (person-research provenance/lane/engagement — NULL for every other feature); cafe_artefacts.type gained person_report. See §3 Apify and §3 Research Mode below. Same day: References bibliographies on every research report type (Auto-Write, Verify, Conflict, Find the Truth, and now person reports) render as a collapsible disclosure — no new data collection, display-only. Prior entry: updated 15 Jul — W1.12a Newspaper & Periodical Archives: a new always-free Auto-Research tool searches digitised historic newspapers and periodicals via Internet Archive and Europeana (Chronicling America/loc.gov is integrated but currently blocked server-side and inactive). Your Auto-Research query is sent to these providers; the fetched articles are stored in your Cafe as new cafe_sources rows, tiered by a new rights_status field — public-domain/openly-licensed articles are stored in full, in-copyright items are stored as a snippet or as a title/link-only reference, never excluded. No personal data is sent to these providers, only your search query. See §3 Newspaper & Periodical Archives below. Prior entry: updated 13 Jul — W54 Research Reports → Book-Grade PDF Export: research reports (Auto-Write, Verify, Conflict, and Find the Truth) can now be downloaded as a single book-grade PDF, alongside the existing Copy and Download (.md) buttons. The PDF — including the Find the Truth verdict graphic and claim/truth matrix — is rendered entirely by our own server-side code from data already in your Cafe; report content is never sent to an AI model or any third-party service for this feature. No new third-party service, no new category of personal data, no schema change. Anyone a report is shared with can also download its PDF; revoking sharing revokes that access. Prior entry: updated 12 Jul — W34.2b/W34.2c BYOK Key-Failure Fallback: clarified the BYOK section — if your own provider key stops working mid-request (invalid, revoked, out of credit, or rate-limited), Coffeescribe now automatically completes that request on our platform key so your work isn't lost, and bills the cost to your Coffeescribe token balance instead of your provider account, with an after-the-fact notification. No new third-party service, no new category of personal data, no schema change — this fallback already existed for scribe generation (W34.2) and is now confirmed to cover AudioScribe narration, Research Mode (Apify + all OpenRouter seams including Find the Truth and Auto-Write), and Scribe Conversion OCR too. See §3 Bring Your Own Key below. Prior entry: updated 10 Jul — W52B Writing Prompts Editor: you can now view and edit the AI writing instructions CoffeeScribe uses — either as a saved default for a genre/content-type/age/level/style/tone combination (Settings → Writing Prompts) or as a one-off rewrite for a single book (a book's "Edit writing prompt" button). Your saved edits are stored in a new owner-only user_prompt_overrides table (versioned, RLS-protected, cascade-deleted with your account) and a new custom_writing_prompt column on your book; no new category of data beyond content you author, and no new third-party service — edited prompts are still sent to OpenRouter as part of the same prompt already covered below. See §1 and §4. Also updated 10 Jul — W39 Strip Pro/Creator Tiers: previously Pro/Creator-only research tools (Apify social/scholar Actors, Identifier Paste, Find the Truth) are now available to every signed-in user, gated only by token balance and the same per-Cafe consent as before — no new external providers, no new data categories. See §3 Apify and §3 Research Mode below. The Free-tier vs paid-tier AI-training-data distinction described in §2 and §3 OpenRouter is unchanged by W39. Prior entry: updated 07 Jul — W34.4 Polar Payments: Paddle is replaced by Polar as our Merchant of Record for one-time token-pack purchases; your name, email, and payment information for a purchase go to Polar and its downstream card processor Stripe — Coffeescribe never stores card data; see §3 Polar below. Prior entry: updated 6 Jul — W51 Book-Grade PDF Export: the optional "Customise with AI" / "Enhance with AI" design pass sends a clamped book excerpt (chapter titles, description, ~400 chars/section) plus any typed design instructions to OpenRouter to receive a PDF design specification (accent, chapter labels/intros, pull-quotes, cover copy); owner-only, token-billed, saved on the book as pdf_design_spec — no new category of personal data. Quick Download and the plain Preview & Customise page make no model calls. See §3 OpenRouter below. Prior entry: updated 3 Jul — W1.11 Find the Truth: a new Pro/Creator claim-verdict feature and an ungated Claim Evidence Matrix view. No new external providers — reuses the existing OpenRouter, OpenAlex/arXiv/PubMed, Apify news, and Wikipedia paths already described below. Adds three new tables (cafe_claims, cafe_claim_evidence, cafe_truth_runs) storing claim text, evidence quotes/urls, and verdict scores — no new categories of personal data, private to your Cafe, cascade-deleted with the Cafe or account. Earlier: updated 12 Jun — W40 "Show, Don't Tell": adds two further anonymous OpenRouter calls on the homepage — word definition lookup and passage Q&A ("Ask AI") in the read beat, both gated behind having brewed, both stateless (no DB writes); typed question text and highlighted word/phrase are forwarded to OpenRouter; see §3 OpenRouter below. Earlier: updated 11 Jun — W37 Landing Refresh: anonymous Brew Preview widget on homepage makes platform-key OpenRouter calls for visitors with no account; preview_scribes table stores AI-generated content + topic tied to an unverified email when a visitor joins the waitlist after brewing — email is not verified at write time and the row is only claimed at first verified signup; see §1 and §3 below)
Coffeescribe is operated by 7sumcreations LLC, a Wyoming limited liability company with registered address at 1309 Coffeen Ave, Suite 1200, Sheridan, Wyoming 82801, USA ("Company", "we", "our", "us"), which is the data controller for personal information collected through the Service. "Coffeescribe" is a trade name (DBA) of 7sumcreations LLC. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered book creation platform. Please read this policy carefully to understand our practices regarding your personal data.
We never sell your personal data. We never share personal data with third parties for their own marketing purposes.
user_prompt_overrides table with row-level security (only your account can read or modify your own rows) — every save keeps the prior version so you can view history and revert. A per-book edit is stored directly on that book as a custom_writing_prompt column. Both are entirely optional; leaving them unedited means CoffeeScribe's default writing instructions are used. This is content you author, handled the same way as your book content — see Third-Party Services for what happens when a prompt (edited or default) is sent to generate a book.preview_scribes table. The email address is unverified at the time of storage — we cannot confirm the visitor owns it until they complete a verified signup. This data is stored with service-role access only (no authenticated user can read another person's preview rows via the API). When a person later creates a verified account with the same email, the stored brew is converted into a real draft scribe in their library and the row is marked claimed. Unclaimed rows are not linked to any account and are not exported as part of a user data export (there is no account to export from). If you submitted an email to the waitlist brew form but do not intend to create an account, email billing@coffeescribe.ai to request deletion of the row.We use your information for the following purposes:
We do not train AI models on your content.Your prompts, your books, your research notes, and your uploaded documents are never used to train our own models or any third-party model on our behalf. If we ever decide to offer an opt-in option to use de-identified content for training future versions of our own models, we will give active users advance notice and an explicit opt-in — nothing changes without your consent.
Separately, when you send a prompt to an AI model via Coffeescribe, the prompt is forwarded to our AI provider (OpenRouter) for processing. OpenRouter and the underlying model provider may, depending on the model and tier you select, use prompts for their own training — see the OpenRouter section below for details. This is independent of Coffeescribe and governed by their privacy policy.
Venice.ai (W1.37):Certain Research Mode features (Ask Your Cafe, Auto-Write, Find the Truth, Verify, Detect Conflicts, and admin model ratings) can also run on a Venice-served model instead of OpenRouter, if you pick one from the research model picker. Those requests go directly to Venice, not through OpenRouter — see the Venice card below for what is sent and Venice's own privacy policy for their data-handling practices.
We use the following third-party services to operate Coffeescribe:
Database hosting, authentication, and file storage. Your account data, books, and preferences are stored securely on Supabase infrastructure.
Supabase Privacy Policy →AI model routing and inference. Your prompts and book content are processed through OpenRouter to generate AI content. Free tier prompts may be used for model training by underlying providers. Paid tier prompts are not shared for training. When you enable Web Search for a scribe, OpenRouter's web search plugin queries third-party search providers and returns source URLs and titles, which Coffeescribe stores as citations. Clicking a citation opens the third-party URL in a new tab — we do not proxy or auto-fetch these URLs on your behalf.
PDF Design Pass — “Customise with AI” (W51):If you press “Customise with AI” or “Enhance with AI” when exporting a scribe as a PDF, we send a clamped excerpt of your book — chapter titles, your book description, and roughly the first 400 characters of each section (never the full text) — plus any optional design instructions you type, to OpenRouter. The model returns a design specification (an accent colour, short chapter labels, optional chapter intros and pull-quotes, and cover copy) that our own code uses to lay out the PDF — the model never generates or touches the PDF file itself, and pull-quotes are validated server-side to be verbatim excerpts of your own text. This is owner-only and token-billed, and the resulting design is saved on the book (pdf_design_spec) so re-exports don't re-send your text. Quick Download and the plain Preview & Customise page never send your book to a model— only this explicit “Customise with AI” action does.
Anonymous Brew Preview calls (W37 + W40):The homepage Brew Preview widget makes OpenRouter API calls on behalf of anonymous visitors who have no Coffeescribe account. These calls use Coffeescribe's own platform API key — no visitor account or personal data is included in the request. The following text inputs from visitors are forwarded to OpenRouter:
All three call types use Coffeescribe's platform key. No visitor-identifying information is sent. Define and Ask AI are gated behind having brewed a section and are subject to small per-session caps. These anonymous calls are subject to OpenRouter's privacy policy for platform/API-key calls.
OpenRouter Privacy Policy →A second, direct AI provider (W1.37) — used only when you select a Venice-served model (e.g. “DeepSeek V4 Flash 0731 Fast”) from the research model picker in Ask Your Cafe, Auto-Write, Find the Truth, Verify, or Detect Conflicts, or when an admin runs the model-rating job against a Venice model. Unlike every other model in Coffeescribe, these requests go directly to Venice's API rather than through OpenRouter. Your prompt and the relevant research context for that call are sent to Venice for processing — the same category of content already described above for OpenRouter, just to a different processor, and only for the specific request you made on a Venice model.
Web search (W1.39):If you select a Venice model in Ask Your Cafe's Generalmode and the Web search toggle is on, your question is sent to Venice, which runs its own live web search and returns cited results directly — a genuine third-party search query, the same kind of data flow OpenRouter's search plugin already performs for other models, just handled natively by Venice instead. Turning the toggle off keeps the call to Venice free of any search request. Other steps that inherently need a web search (for example, gathering evidence for Find the Truth, Verify, or Detect Conflicts) still route that specific call to an OpenRouter model instead and record that it did so — Venice's native search is currently wired into General-mode chat only.
Venice models are only offered in Research Mode — they are not available for book/Quick Read/import generation. You may optionally add your own Venice API key (see Bring Your Own Key below); without one, Coffeescribe uses its own platform key for Venice calls the same way it does for every other provider. Review Venice's own privacy policy for how they handle data sent to their API.
Venice.ai (see their site for the current Privacy Policy link) →Payment processing for one-time token-pack purchases. Polar is our Merchant of Record: when you buy a token pack, Polar receives your name, email address, and payment information to process the transaction, and handles billing, sales tax/VAT/GST, receipts, and order-related inquiries and returns. Polar uses Stripe as its downstream card processor. Coffeescribe never receives or stores your payment card details. After your first purchase you can open the Polar customer portal from Settings to view invoices and manage your payment method.
Polar Privacy Policy →Optical character recognition for scanned PDFs uploaded via Scribe Conversion. When you upload a PDF that contains no embedded text (a scan or image-only PDF), we send the page images to Mistral's OCR API to extract the text. Mistral receives only the file bytes of your upload — no account information, no email, and nothing else. The OCR cost is billed to your token allowance and is shown in the cost preview before you commit. We do not send Mistral any content from your already-created scribes, your research, your notes, or any other part of your account.
Mistral Privacy Policy →Web scraping and data extraction for Research Mode. When you extract YouTube transcripts, scrape web pages, run an optional Apify Actor search (Google Scholar, Twitter/X, Reddit, LinkedIn, Instagram, TikTok, YouTube Search, or News search) in a Cafe, or enable those tools in Auto-Research, your search query or URL is sent to Apify for content extraction. No personal data is shared — only the query or URL you provide.
Social platform sources (Instagram, Facebook, TikTok, YouTube, X/Twitter, LinkedIn, Reddit, Google Scholar, and smaller platforms such as Telegram, Snapchat and Truth Social): These are off by default for your whole account. The first time you start research that could use them, you are shown the Social Sources Terms and asked to accept them. If you decline, your research still runs — those platforms are simply left out, and the run record names which ones were skipped. You can turn them on or off at any time in Settings → Data & Privacy → Social platform sources.
This account-level switch is enforced on the server, on every path that could reach one of these platforms — the Auto-Research agent, the fast research engine, Research a Person, and the per-platform search endpoints. It is not a UI-only preference, and it has no administrator exception. We record your acceptance timestamp and the terms version you accepted on your account row; turning the switch off keeps that record and stops the scraping. Individual Cafés keep their own per-Actor consent settings (stored in cafe_actor_consents) as a second, narrower layer beneath the account switch; those records are deleted when you delete the Café or your account.
When social sources are enabled, your search query is forwarded to Apify, which runs the Actor on its own infrastructure against publicly visible content only, without logging into any account. Your query is not attributed to your personal account on those platforms.
Facebook (Research a Person only): Used exclusively by the Research a Person feature (see the dedicated card below) to search public Facebook Pages for a confirmed public figure. It is never offered as a general Auto-Research tool. It sits under the same account-level social switch as every other social platform, plus its own per-Café consent record.
News search and Wikipedia: The News search tool uses a platform-pinned Apify actor and is available to every signed-in user via Auto-Research (no per-actor consent row). Wikipedia uses the free MediaWiki REST API directly (no Apify, no consent).
Wikidata (W55, free, no Apify, no consent):Research a Person's identity confirmation queries the free Wikidata REST API directly with the name/details you type — same no-key, no-consent treatment as Wikipedia. See the dedicated card below.
Third-party platform terms:The social and scholar tools access content that is subject to each platform's own terms of service. By enabling a consent-gated tool you acknowledge this. Relevant terms: Reddit, Google (Scholar), X/Twitter, Instagram, LinkedIn, TikTok, Facebook. An AUP / indemnification clause covering automated access is a planned legal follow-up and is not yet included in these terms.
Apify Privacy Policy →Academic paper search and identifier enrichment for Research Mode. When you search academic databases or paste an identifier (DOI, ISBN, PMID, arXiv ID, ISSN, or URL) in a Cafe, the identifier or query is sent to the relevant resolver.
No personal data (name, email, account ID) is shared with any of these services — only the search query or identifier you provide.
A free Auto-Research tool that searches digitised historic newspapers and periodicals. When you enable it (no consent needed, no per-use charge), your Auto-Research query is sent to the following providers:
No personal data (name, email, account ID) is shared with any of these providers — only the search query you (or the Auto-Research agent, on your behalf) submit. Fetched articles are stored in your Cafe as cafe_sources rows tagged with a rights_statusvalue that controls how much text we store: public-domain or openly-licensed (CC0/PDM/CC-BY family) articles are stored in full; in-copyright items the provider previews are stored as a snippet + link; in-copyright items with no preview are stored as a title/publication/date + link only. A result is never excluded — only the amount of text stored scales down with what we're legally permitted to keep. These rows are private to your Cafe and deleted with the Cafe or your account, same as any other research source.
Your uploaded documents, notebook imports, and curated Serving Tray notes are stored only on our servers — the original files and notes themselves are never sent to external services. Text extraction (PDF, DOCX, TXT, MD, EPUB, HTML) and embedding vector generation both run entirely on our servers using an open-source model. The one exception is images, audio, and video attached via the chat composer (W1.35 P4)— see the Chat Attachments entry below for what is sent, to whom, and why. Beyond that, when you actively use a feature that needs an external AI service, the following limited extracts are sent out:
cafe_sources rows (full text / snippet / reference-only, per rights_status) and feed Auto-Write citations and Find the Truth evidence like any other source.cafe_qa_history table described above — this update adds organisation, not a new kind of collection. Each conversation is now also a row in a new cafe_chat_sessions table (a title — from your first question, or one you edit yourself — plus an active/archived status), and your existing history was automatically grouped into one such row per Cafe when this shipped. Starting a new chat archives the old one rather than deleting it; deleting a chat removes its title row and its questions/answers together. Optionally switching “Add to cafe memory” (called “Use in answers” before August 2026) on for a chat stores its transcript as an ordinary Cafe source (the same storage and embedding path already described for research sources) so it can ground a Grounded answer — off by default, and removed the moment you switch it back off. No new third-party service, and this data still is not used to train any AI model — see Third-Party Services and the AI Content Policy.cafe_qa_history rows described above) each time you ask a question in it, instead of being held only in your browser tab — so it survives a page reload or reopening a saved chat later, and reaches further back (up to 20 exchanges, up from 10) than before. This changes how already-stored conversation data is read and sent to OpenRouter or Venice for that answer; it is not a new category of stored data or a new third party. A chat with “Add to cafe memory” (called “Use in answers” before August 2026) on no longer retrieves its own transcript into its own answers. If a General answer stalls mid-response, the partial attempt is discarded and the question is sent to the AI provider a second time automatically — you are billed once, for the answer you receive. An admin-only setting exists to additionally race a slow answer against a second AI model, but it ships switched off and sends no extra requests to any provider in this release.cafe_qa_history.reasoning column, nullable — empty unless Thinking is on and the model actually returns one). It is the AI model's own generated output about your question, not new information from you, sent to the same already-described AI providers (OpenRouter/Venice) for the same request, and it is never used to train any AI model. Separately, after each answer, Coffeescribe generates up to six suggested follow-up questions with one additional AI call (a new, off-by-default-if-you-turn-it-off “Suggest follow-ups” switch, on by default) — the question and answer just given, plus up to three earlier turns of the same chat, are sent to a fast, low-cost model Coffeescribe selects (not the model you picked for chat), and the suggestions are stored (cafe_qa_history.followups) so they persist across reloads; a hidden state (followups_hidden) is also stored if you dismiss them for one answer. This call reuses the same OpenRouter/Venice providers already described — no new third party — and is billed to your token balance (BYOK-aware, same as any other AI call). Turning the switch off stops this call entirely for future answers; it does not delete suggestions already generated. See §3 Research Mode below.cafe_sources row, embedded and searchable exactly like any other source. Documents (PDF, DOCX, TXT, MD, EPUB, HTML) have their text extracted entirely on our servers, same as any other document upload — no external call. Images, audio, and video are different: the file bytes are sent to a pinned AI model (currently Google Gemini, via OpenRouter) at upload time to produce a text transcript or description, which becomes the source's stored content; this is a billed, BYOK-aware AI call, and the cost is shown before a large upload commits. The original file bytes for every upload (document or media) are also stored privately in a new cafe-attachments Storage bucket, owner-scoped by row-level security — nobody else, including a shared-link viewer, can read or download the original file. In General mode, the source is additionally linked to the chat that created it (cafe_sources.chat_session_id) so its full text can be resent to OpenRouter/Venice on every later question in that conversation; a Grounded-mode upload is never linked to a chat. Deleting a chat that has attachments asks whether to also delete the files uploaded through it (keeping them is the default); a source you merely picked from existing café sources into a chat, rather than uploaded, is never deleted by that choice. No new category of personal data about you — this is your own content, processed the way research sources already are.cafe_artefacts row (private to your Cafe). Hard-capped between $1 and $5 per run depending on your final source count.cafe_artefacts rows — the same table every other research report uses — rather than the earlier cafe_tray_items storage. No new external service call is involved; this only changes where the already-generated report text lives in our database, and unlocks the same actions (Share, Add to Tray, PDF, Save to Notebooks) every other report type has.cafe_source_chunks search index your sources already use, so it can be found by Ask Your Cafe. Embedding runs entirely on our servers with the same open-source model described above; no report content is sent to an external embedding service. Previously only Auto-Research's extraction cards were embedded (as tray items) — this closes that gap for every other report type. A one-time backfill applied the same conversion to your existing Auto-Research reports.cafe_artefacts row. Hard-capped at $0.50 per run; soft 5-minute rate-limit between runs.is_shared flag and a share_token UUID on the cafe_artefacts row. Other authenticated Coffeescribe users who open the share link can read the report body, citations, and bibliography. The share token is deleted (and sharing is immediately revoked) when you toggle sharing off. Both fields are deleted when you delete the report, the parent Cafe, or your account. Recipients must be signed in — no anonymous access is granted. The content of the report (AI-generated prose) is not sent to external services as part of sharing; sharing is internal to the Coffeescribe platform onlycafe_actor_consents row (Cafe ID, Actor ID, timestamp) as an audit record. These records are deleted when you delete the Cafe or your account.cafe_sources row of type manual_entry containing the fields you typed (authors, title, journal, year, etc.). These rows are private to your Cafe and deleted with the Cafe or account.cafe_claims, cafe_claim_evidence, and cafe_truth_runs rows, private to your Cafe. The Claim Evidence Matrix (/research/[cafeId]/claims) is a read view of this same data and is available to every signed-in user — viewing it makes no external calls. The optional “Refine independence” pass sends ambiguous source pairs to OpenRouter to judge original-vs-relay provenance; it requires your explicit consent per run and the result is persisted so a claim is never re-analysed twice.This feature is different from everything else on this page: it compiles publicly available information about ANOTHER named person, not about you. It exists for legitimate research on public figures, and carries hard-coded guardrails that apply regardless of who is running it.
Stage 1 — identity confirmation (free, no run created): the name, any identifying details, and any seed links you type are sent to the free Wikidata REST API and the MediaWiki (Wikipedia) REST API to find and confirm the real person you mean. Nothing is billed and no cafe_person_runs row exists yet at this stage.
Stage 2 — the paid sweep (opt-in per run): clean public-record sources (web search, news search, Wikipedia) are gathered for every run. Social-platform content (X/Twitter, Instagram, TikTok, YouTube, Facebook, LinkedIn — via Apify, same per-Cafe, per-platform consent as every other Apify Actor) is gathered only when CoffeeScribe re-confirms server-side that the identity is a real public figure— a client-supplied claim of “this is a public figure” is never trusted on its own. If the person isn't confirmed as a public figure, the run stays clean-core-only.
No contact information or addresses, ever, enforced twice. Any email/phone/address-shaped data present in a gathered source is stripped before it is stored (the same stripContactFieldsseam used since W55 v1), and the report writer's instructions separately forbid including a contact section — two independent points of enforcement, not one, and both are covered by automated tests. A custom research “focus” you add (e.g. “his death”) that asks for an address, a daily schedule, or someone's whereabouts is declined before it runs.
What is stored: the run itself in a cafe_person_runs row (status, phase, footprint determination, depth, and an identity_anchorJSONB holding the confirmed candidate's public identifiers — Wikidata QID, occupations, dates, confirmed handles); gathered content as normal cafe_sources rows, tagged to the run, with an additional nullable metadata JSONB column (provenance label, research lane, and engagement numbers for social posts — this column is NULL for every other feature); the compiled dossier as a cafe_artefactsrow (type = 'person_report'). All of it is private to your Cafe and account, owner-scoped by row-level security, and cascade-deleted with the Cafe or your account, exactly like every other research artefact.
A deceased subject's still-active accountsare labelled estate-run/memorial in the stored metadata and in the report, and are never presented as the person's own words. An unverified identity (a details-only run where research surfaces a similarly-named person) is never asserted as a match in the stored report — it is framed as unverified unless your own supplied details substantively match.
Costs (tokens + Apify cents) are billed to your account the same way as every other Research Mode action — see Bring Your Own Key below for the BYOK/fallback behaviour, which applies identically here.
Transactional email delivery. Coffeescribe uses Resend to send the following types of email:
We do not use Resend for third-party marketing or advertising. Resend retains delivery logs (sender, recipient, subject, timestamp, delivery status) for approximately 30 days for deliverability and abuse-prevention purposes; message bodies are not retained beyond what is needed to deliver the message.
Resend Privacy Policy →If you add your own API key for a provider in Settings → API Keys, your requests for that provider will be made directly to that provider using your key. This means:
Coffeescribe encrypts your key at rest (AES-256-GCM) and never shares it with any other party. The key is transmitted to the provider only at the time of the API call it is meant to authorise. Your key is never returned to your browser in plaintext after saving — only the last four characters are displayed. If you remove a key from Settings, the encrypted record is permanently deleted and future requests fall back to the platform key.
When you use a BYOK provider, your data-handling relationship for those calls is governed by that provider's privacy policy, not Coffeescribe's. Review the relevant policies before adding a key.
If your key stops working mid-request(invalid, revoked, out of provider credit, or rate-limited), Coffeescribe automatically completes that request using our own platform key instead, so your work isn't lost. In that case the request is sent to the provider under Coffeescribe's platform account rather than yours, and the corresponding cost is deducted from your Coffeescribe token balance instead of your provider account. Foreground actions notify you in-app when this happens; in every case the switch is reflected in your token balance and usage history.
Web hosting and serverless functions. Our application is hosted on Vercel's infrastructure, which may collect access logs and analytics.
Vercel Privacy Policy →We retain your data for as long as necessary to provide our services:
| Data Type | Retention Period |
|---|---|
| Account Data | Until you delete your account |
| Book Content (private) | Until you delete the book or account |
| Book Content (public) | Retained in library on account deletion, re-attributed to "Deleted User" |
| Deleted Book Snapshots | Up to 90 days, then automatically and permanently purged |
| AI Generation Logs | Indefinite (billing audit trail) |
| Token Transactions | Indefinite (billing audit trail) |
| Audiobook Playback Position | Until you delete the scribe or account |
| Imported Source Files (Scribe Conversion) | Deleted after successful conversion (or after 7 days for abandoned uploads) |
| Chat Attachment Original Files (cafe-attachments Storage bucket, W1.35 P4) | Until you delete the source (directly, via a run delete, or via a chat's “delete uploads too” choice), the Cafe, or your account |
| Publish-Consent Timestamps (Imports) | Retained for as long as the imported scribe is published, plus 90 days after take-down (audit trail) |
| Apify Actor Consent Records | Until you delete the Cafe or your account (cascade delete) |
| PubMed Abstracts + MeSH Terms (cafe_sources columns) | Until you delete the source, the Cafe, or your account |
| Auto-Write Reports + Conflict Reports + Auto-Research Reports (cafe_artefacts; Auto-Research reports moved here from cafe_tray_items in W1.17) | Until you delete the artefact, the Cafe, or your account |
| Report Share Token (cafe_artefacts.share_token) | Until you toggle sharing off, delete the report, delete the Cafe, or delete your account — whichever comes first |
| Manual Citation Entries (cafe_sources type=manual_entry) | Until you delete the source, the Cafe, or your account |
| Brew Preview rows (preview_scribes — unclaimed) | Retained until claimed at verified signup, or until deleted on request (email billing@coffeescribe.ai). Not linked to any account until claimed; not included in account data exports. |
| Brew Preview rows (preview_scribes — claimed) | Row is marked claimed (claimed_customer_id, claimed_at set). The converted draft scribe follows standard Book Content retention. The preview_scribes row itself is retained as an audit trail and deleted when the account is deleted. |
| Find the Truth Claims & Evidence (cafe_claims / cafe_claim_evidence / cafe_truth_runs) | Until you delete the claim's Cafe or your account (cascade delete) |
| Person Research Runs & Dossiers (cafe_person_runs, gathered cafe_sources, cafe_artefacts type=person_report) | Until you delete the run, the Cafe, or your account (cascade delete) — same as every other research run/report |
| Email Delivery Logs (Resend) | ~30 days (sender, recipient, subject, timestamp, delivery status — message bodies not retained beyond delivery) |
| Provider API Keys (BYOK — encrypted) | Until you remove the key from Settings → API Keys or delete your account (cascade delete) |
| Custom Writing Prompts — Settings defaults (user_prompt_overrides) | Until you Reset to default or delete your account (cascade delete). Superseded versions are kept for your own version history and revert. |
| Custom Writing Prompts — per-book (bookDetails.custom_writing_prompt) | Until you Reset to default, delete the book, or delete your account — follows standard Book Content retention |
| Hosting Logs | Per Vercel/Supabase policies |
Account Data
Until you delete your account
Book Content (private)
Until you delete the book or account
Book Content (public)
Retained in library on account deletion, re-attributed to "Deleted User"
Deleted Book Snapshots
Up to 90 days, then automatically and permanently purged
AI Generation Logs
Indefinite (billing audit trail)
Token Transactions
Indefinite (billing audit trail)
Audiobook Playback Position
Until you delete the scribe or account
Imported Source Files (Scribe Conversion)
Deleted after successful conversion (or after 7 days for abandoned uploads)
Chat Attachment Original Files (cafe-attachments bucket, W1.35 P4)
Until you delete the source, the Cafe, or your account (including via a chat's “delete uploads too” choice)
Publish-Consent Timestamps (Imports)
Retained for as long as the imported scribe is published, plus 90 days after take-down (audit trail)
Apify Actor Consent Records
Until you delete the Cafe or your account (cascade delete)
PubMed Abstracts + MeSH Terms
Until you delete the source, the Cafe, or your account
Auto-Write + Conflict Reports (cafe_artefacts)
Until you delete the artefact, the Cafe, or your account
Report Share Token (cafe_artefacts.share_token)
Until you toggle sharing off, delete the report, delete the Cafe, or delete your account — whichever comes first
Manual Citation Entries
Until you delete the source, the Cafe, or your account
Brew Preview rows (preview_scribes — unclaimed)
Retained until claimed at verified signup, or until deleted on request (email billing@coffeescribe.ai). Not linked to any account until claimed.
Brew Preview rows (preview_scribes — claimed)
Row marked claimed; converted draft scribe follows standard Book Content retention. The preview_scribes row is deleted when the account is deleted.
Email Delivery Logs (Resend)
~30 days (sender, recipient, subject, timestamp, delivery status — message bodies not retained beyond delivery)
Provider API Keys (BYOK — encrypted)
Until you remove the key from Settings → API Keys or delete your account
Custom Writing Prompts — Settings defaults
Until you Reset to default or delete your account (cascade delete). Prior versions kept for your history/revert.
Custom Writing Prompts — per-book
Until you Reset to default, delete the book, or delete your account
Hosting Logs
Per Vercel/Supabase policies
After account deletion, we may retain anonymised, aggregated usage statistics for analytics purposes.
Depending on your location, you may have the following rights regarding your personal data:
We implement appropriate security measures to protect your data:
While we take security seriously, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.
Coffeescribe is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children under these ages. If you believe we have collected information from a child, please contact us immediately at billing@coffeescribe.ai so we can delete the data.
Your data may be processed in countries outside your residence, including the United States and other countries where our service providers operate. These countries may have different data protection laws. By using our service, you consent to the transfer of your data to these countries. We ensure appropriate safeguards are in place with our service providers.
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we may notify you via email or a prominent notice on our platform. Continued use of the service after changes constitutes acceptance of the updated policy.
For privacy-related inquiries, data requests, or to exercise your rights:
For data protection inquiries in the EU, you may also contact your local data protection authority.
This Privacy Policy should be read alongside our Terms of Service and AI Content Policy.