Terms of use & privacy

By creating an account, signing in, uploading material, or using Aletheia, you agree to these Terms. If you use it for an employer, university, or other organisation, you confirm that you are authorised to bind that organisation to these Terms.

Use the service only where you are legally able to enter this agreement. Keep account credentials and authentication methods secure. You are responsible for activity performed through your account unless unauthorised access results from the operator's failure to provide the safeguards it has promised in writing.

Aletheia stores and processes a research library, extracts document content, retrieves relevant passages, and can generate answers, comparisons, verification results, and research reports. Citations are checked against retrieved evidence, but that check is not a guarantee that an answer is complete, accurate, original, suitable for a particular purpose, or accepted by a publisher, reviewer, or regulator.

The service is an assistive research tool, not medical, legal, financial, safety, clinical, peer-review, or professional advice. You must independently review source material and any generated output before relying on it, publishing it, or making a decision that could affect people, property, or rights.

You retain ownership of the documents, prompts, project names, and other material you submit (“Your Content”). You grant the operator the limited permission needed to host, copy, parse, index, retrieve, display, transform, and transmit Your Content solely to operate, secure, troubleshoot, and improve the service as described in this page and the operator's published deployment terms.

You are responsible for ensuring you have all permissions, consents, licences, and legal bases necessary to upload and process Your Content. Do not upload material that is confidential, restricted, export-controlled, subject to a data-use agreement, or personal data requiring heightened safeguards unless the deployment is expressly approved for that material in writing.

• Do not use the service to violate law, intellectual-property rights, confidentiality duties, or institutional research rules.
• Do not attempt to bypass authentication, rate limits, access controls, or security protections; scan, probe, or disrupt the service; or access another person’s project or content.
• Do not submit malware, deceptive files, unlawful content, or content intended to harm, exploit, or identify people without a lawful basis.
• Do not represent generated output as independently verified human research, or remove source attribution where it is required.

The operator may change, suspend, or discontinue features to maintain security, meet legal obligations, or improve the service. It may suspend access where it reasonably believes use breaches these Terms, creates a security risk, or could harm the service or others. Where feasible, it will provide notice and an opportunity to export or remove content.

To the fullest extent permitted by applicable law, the service is provided “as is” and “as available.” No warranty is made that it will be uninterrupted, error-free, secure against every threat, or fit for a specific research outcome. Nothing here excludes liability that cannot lawfully be excluded. Any additional limits, governing law, dispute process, and commercial terms must be supplied by the deployment operator before production use.

The exact data processed depends on the features and configuration enabled by the operator.

• Account information: a Clerk account identifier and, where supplied by the identity token, email address and username. Clerk manages sign-in methods such as Google, email, and username.
• Workspace information: projects, project descriptions, source filenames, file hashes, processing status, and timestamps.
• Research content: uploaded files; extracted text, sections, pages, figures, tables, equations, document metadata, and derived embeddings used for retrieval.
• Interaction content: search terms, questions, generated answers, citation metadata, and — when conversations are used — stored conversation messages and answer metadata.
• Technical information: request identifiers and rate-limit counters. When no authenticated identity is available, rate limiting may use the request IP address. The selected project ID is also stored in the browser’s local storage.

The service uses this information to authenticate users, create and operate projects, ingest and search sources, produce requested research features, prevent abuse, diagnose failures, and maintain the service. The operator must identify its lawful basis for each processing purpose where privacy law requires one.

Embedding and reranking run locally in the Aletheia backend. A hosted AI provider is called only for generated answers, research-agent planning and step answers, and explicitly requested figure interpretation. When one of those features is used, the relevant prompt and retrieved evidence — which can contain Your Content — are sent to the enabled provider: OpenAI or Google Gemini. The implementation is configured to use one enabled provider at a time; it does not silently fail over to the other.

A research-agent query may also be sent to Europe PMC and Crossref to retrieve public research metadata or abstracts. Do not place sensitive information in a query you do not want disclosed to those public services.

Depending on configuration, data is stored in PostgreSQL and a vector index (Chroma or pgvector); uploaded originals are stored on local server storage or Cloudflare R2; and rate-limit counters may be stored in Redis. Authentication is provided by Clerk. These are processors or infrastructure providers chosen by the operator, not a promise that every deployment uses every service listed here.

The code includes file-size validation, authentication support, project-scoped data structures, rate limiting, and deletion paths for project content. Security is a shared operational responsibility: the operator must configure access controls, encryption, backups, logging, secret management, vendor agreements, and incident response appropriate to its deployment. No system can guarantee absolute security.

The codebase does not define a fixed retention period. Workspace content remains until it is deleted through the service or under a deployment operator's retention rules. Deleting a source removes its database record and triggers removal of the original stored file and its vector entries; deleting a project cascades to its papers, derived records, jobs, and conversations. Storage and vector removal are best-effort after the database deletion, so an operator must run reconciliation and backup-expiry processes to meet a deletion commitment.

Deleting content in Aletheia does not by itself delete copies that a hosted AI provider, public discovery service, backup system, or another lawful recipient retains under its own policy. Ask the deployment operator for its retention schedule, backup handling, account-deletion process, and any available export process before uploading sensitive material.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to complain to a supervisory authority. Submit a request through the support or privacy channel published by the deployment operator. The repository does not provide a universal privacy contact, data-protection officer, or automated account deletion endpoint.

Using hosted infrastructure or AI providers can involve processing outside your country. The operator is responsible for assessing and documenting the transfer mechanism required for its deployment. We may update this page when the service or its data flows change; the effective date above identifies the current version. Material changes should be notified by the deployment operator where required.