Privacy Policy – Global Journal Club

    Effective Date: September 30, 2026

    Last Updated: October 21, 2026

Global Journal Club ("we," "us," or "our") operates the Global Journal Club browser extension (the "Extension") for Google Chrome and compatible browsers and the Global Journal Club website at globaljournalclub.org (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have regarding your data.

By installing or using the Extension, you agree to the collection and use of information in accordance with this policy. If you do not agree, please uninstall the Extension.

This Privacy Policy also applies to authors of academic papers whom we contact on behalf of our users. If you are such an author, the "Contacting Authors & Author Replies" section explains what information we hold about you, why, and how to ask us not to contact you.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Email address — used for authentication, notifications, and account recovery.
Username and display name — chosen by you, displayed publicly alongside your comments.
Avatar image and position — optional profile picture you upload and its crop position.
Professional role — optional self-described role (e.g., researcher, student).

1.2 User-Generated Content

When you use the Extension, you may create:

Comments — text posted on academic papers, which may include rich text formatting, images, and group tags. Comments posted publicly are visible to all users. You may instead choose to post a comment privately to one or more of your groups; private group comments are visible only to that group's members. Tagging a public comment to a group additionally notifies that group's members.
Notes — personal notes you write on specific papers. Notes are not visible to other users. They are stored securely and are not displayed anywhere in the Service outside your own account. GJC staff do not read the content of your notes; we use only aggregate, non-content information (such as note length and how often notes are created) to understand whether the feature is useful. As operators we have technical database access, but we do not access note content except where strictly necessary for security, legal compliance, or to resolve a technical issue you report.
Votes — upvotes on comments made by other users.
Paper follows — when you follow a paper (identified by its DOI) to receive notifications about new comments.
Synapse AI requests — when you ask Synapse AI about a paper, we store what you asked for, any question you write, the group it is for, and when you asked. See Section 1.8.

1.3 Paper Metadata

When you comment on or follow a paper, the Extension extracts:

DOI (Digital Object Identifier) from the page's metadata.
Paper title from the page's metadata or manually entered by you.
Paper URL — the web address where you accessed the paper.

For commenting and following, we collect only the DOI, title, and URL from the page you are viewing, and we do not fetch additional metadata from external databases for those actions. Separately, if you choose to send a question to a paper's authors, we look up author contact details from external public sources — see the "Contacting Authors & Author Replies" section.

Finding a paper's other versions and updates. When you open a paper with the Extension, or a paper page on our website, your browser looks up that paper's DOI in Crossref, a public catalogue of scholarly publications, to find out whether it has a published version or a preprint, and whether it has been retracted, corrected or given an expression of concern. It also looks up the DOI in PubMed, the U.S. National Library of Medicine's public database of biomedical literature, to find letters published about the paper and the authors' replies. We may also look up a paper's title, journal and year in Crossref. Only the DOI is sent — no account details, comments or other personal information. As with any web request, Crossref and PubMed can see the IP address the request comes from. Results are stored only in your browser, for one day, to avoid repeat lookups. Separately, our servers regularly check Crossref and PubMed for papers that have been discussed, shared or watched on Global Journal Club, so people can be told when a preprint they follow is published, or when a paper they follow is retracted, corrected, given an expression of concern or answered by a published letter; those checks send only DOIs.

1.4 Group Membership

If you create or join groups, we store:

Group name, focus, and keywords. A group’s focus may be used to tailor the Synapse AI comments on papers shared to that group.
Your membership role (member, moderator, or owner) and join date.
Invite links you generate and their usage.
Papers shared to your groups, and who shared them.

Opens of shared papers. When you open a paper that was shared in one of your groups (from our website, a notification, a digest email, or by opening its discussion in the Extension), we record that you opened it. About 12 days after sharing, the member who shared it may be told how many group members opened it. This is a number only: we never say who opened it, and we only send it when at least two members did. You can turn these "Share results" notifications off in the Extension's notification settings.

1.5 Usage Analytics

We collect limited analytics events to understand how the Extension is used and to improve our service. These include:

Account creation events.
Extension badge interactions (e.g., whether the badge was pinned or clicked).
Sidebar open events.
Notification interactions (viewed, clicked).
Navigation pings (which paper sites are visited, to track Extension reach — no page content is collected).
Email setting changes — when you turn off or reduce an email, we record the previous and new setting, where you changed it, whether the Extension was detected in that browser, and whether you were on a phone or a computer.
Note usage metrics — we derive aggregate statistics about notes (such as how many you create and their length) from activity and counts only; we do not use the content of your notes.

Analytics events are associated with your user ID. We do not use any third-party analytics services (e.g., Google Analytics, Mixpanel). All analytics data is stored on our own infrastructure.

1.6 Diagnostic & Error Data

To diagnose and fix technical issues, we may collect:

Client error logs (error type, message, page URL, browser user agent).
Email delivery failure logs (error codes from our email providers, no email content).
Email link click outcomes (whether a notification link redirected successfully).

1.7 Feedback & Uninstall Survey

In-extension feedback — messages and optional screenshots you submit via the feedback form.
Problem reports — messages submitted from our email pages.
Uninstall survey — if you uninstall the Extension, you may optionally complete an anonymous survey. This survey does not collect your email, user ID, or any personally identifiable information.

1.8 Synapse AI

Synapse AI is a feature that comments on papers and answers questions about them when members ask it to. To do this:

Paper content — we use publicly available full text of a paper when possible. If none is available and you choose to continue, the Extension reads the paper's text and figures (or the PDF the page links to) from the page you are viewing and sends them to us. Instead, you can choose a PDF of the paper from your device, in the Extension or on our website, and it is uploaded to us. Either happens only after you confirm.
Processing — paper content, your question, and your group's name and focus are processed with our service providers to produce Synapse AI comments and answers, which our team reviews before they are posted.
Limits — Synapse AI may not be able to produce an analysis, for example when a paper's full text is not available. When it cannot help with a request, we may let you know through a notification.

2. How We Use Your Information

We use the information we collect for the following purposes:

Purpose	Data Used
Provide and operate the Extension	Account info, content, paper metadata
Authenticate you and secure your account	Email, session tokens
Display your comments and profile to others	Username, display name, avatar, comments
Send notifications (in-browser and email)	Email, notification preferences, comment/group activity
Manage group memberships and moderation	Group data, membership roles
Tell members how many people in their group opened a paper they shared	Opens of shared papers on our website, through notifications and digest emails, or in the Extension sidebar (counted, never named)
Improve the Extension and fix bugs	Analytics events, error logs
Respond to your feedback and support requests	Feedback messages, screenshots, email
Understand why users uninstall	Anonymous uninstall survey responses
Produce Synapse AI comments and answers you ask for	Synapse AI requests, paper content you choose to share from a page, group name and focus

We do not use your data for advertising, profiling, or selling to third parties.

3. Browser Permissions

The Extension requests the following browser permissions:

Permission	Why We Need It
activeTab	To detect paper metadata (DOI, title) on the page you are currently viewing, so you can comment on or follow that paper.
storage	To store your authentication session, notification preferences, and cached data locally in your browser.
alarms	To periodically check for new notifications and update the Extension badge count.
identity	To let you sign in with your Google account ("Continue with Google"). It is used only while you sign in. Google shares your email address and basic profile (name and photo) with our sign-in provider so we can create or open your account; we never get your Google password or access to anything else in your Google account.
contextMenus	To add a "Show JC tab on papers" option when you right-click the Extension's toolbar icon, so you can turn the on-page JC tab back on.
Host permissions	To inject the Extension sidebar on academic paper websites and to communicate with our backend services hosted on Supabase.

    For commenting and following, the Extension reads only paper identification metadata (DOI, title) from the page. If you choose to send a question to a paper's authors, the Extension may additionally read author contact details (such as an email address) shown on that page in order to deliver your question. The Extension does not read, collect, or transmit the text content of papers, except when you ask Synapse AI to read a paper from the page you are viewing (see Section 1.8). It never reads your browsing history, form inputs, or passwords.

4. Local Browser Storage

The Extension uses chrome.storage.local (not cookies) to store data locally on your device:

Authentication session — access and refresh tokens for your logged-in session.
Notification preferences — your chosen settings for browser and email notifications.
Badge state — whether the Extension badge is pinned, last interaction time, and cached unread counts.
Sidebar state — last active tab and view preferences.
On-page preferences — whether the JC tab is shown on papers, and when on-page pop-ups were last shown or dismissed so they stay occasional.
Paper version and update lookups — for papers you've opened recently, the preprint or published version Crossref lists, and the retractions, corrections, expressions of concern and published letters Crossref and PubMed list, kept for one day so the lookup isn't repeated.

The Extension also makes limited use of temporary browser storage (localStorage) for short-lived purposes — bridging an action you initiated on one of our web pages into the Extension, and auto-saving a comment draft so you don't lose it. This data stays on your device and is cleared automatically once the action completes or the draft is submitted or discarded.

This data stays on your device and is removed when you uninstall the Extension. We do not set or read browser cookies.

5. Third-Party Services

We use the following third-party service providers to operate the Extension:

Service	Purpose	Data Shared
Supabase	Database hosting, user authentication, file storage, and serverless functions	All account data, content, and files are stored on Supabase infrastructure
Resend	Transactional email delivery (notifications, digests, paper follow alerts), and author outreach	Recipient email address and email content
Brevo	Authentication email delivery (sign-up confirmation, password reset, OTP codes)	Recipient email address and authentication email content
Cloudflare	Inbound email routing (capturing author replies sent by email)	Inbound email address and message content
Web search providers	Helping locate author contact details, and published responses to papers	Author name and affiliation; paper title
AI service providers	Producing Synapse AI comments and answers	Paper content, your Synapse AI questions, and your group's name and focus
Public scholarly databases	Finding a freely available copy of a paper	The paper's DOI only
Crossref	Finding a paper's published version or preprint, its title, journal and year, and any retraction, correction or expression of concern	The paper's DOI only (and, as with any web request, the requesting IP address)
PubMed (U.S. National Library of Medicine)	Finding letters published about a paper, the authors' replies, and retraction, correction and expression-of-concern notices	The paper's DOI only (and, as with any web request, the requesting IP address)

Each provider processes data in accordance with their own privacy policies:

We do not use any third-party advertising, tracking, or marketing services. We do not embed third-party advertising, tracking, analytics, or marketing scripts.

We do not sell, rent, or trade your personal information to anyone.

We may share your data only in the following circumstances:

With service providers — as described in Section 5, solely to operate the Extension.
With other users — your username, display name, avatar, and public comments are visible to other Extension users. Notes are not shown to other users; see Section 1.2 for how note content is handled.
Legal requirements — if required by law, regulation, legal process, or governmental request, we may disclose your information to comply with such obligations.
Safety — to protect against fraud, abuse, or security threats to our users or service.

7. Email Communications

We may send you email for the following purposes:

7.1 Authentication Emails

Sign-up confirmation, OTP codes, and password reset emails. These are essential for account security and cannot be opted out of.

7.2 Notification Emails

Alerts about replies to your comments, new comments on papers you follow, group activity, and upvote summaries. You can fully control these through the notification settings on our website or in the Extension sidebar.

7.3 Digest Emails

Periodic summary emails covering activity on your followed papers and groups. You can enable or disable digests in your notification settings.

7.4 Moderator Request Emails

If you are a group moderator or owner, you may receive emails when users request to join your group.

    Opting out: You can manage all email preferences from the notification settings on our website or in the Extension, or click the "Unsubscribe" link at the bottom of any email. Authentication emails cannot be disabled as they are necessary for account security.

8. Contacting Authors & Author Replies

What this feature does

Global Journal Club lets a reader forward a question about a paper to that paper's authors. When a reader chooses to do this, we attempt to find a contact email address for the corresponding author, send them the reader's question by email, and give them a way to reply — either by replying to that email or through a reply page on our website. Any reply the author provides is published as a response to the reader's question.

Where the author's email comes from

We do not receive author contact addresses from the reader. We locate a corresponding author's email from publicly available sources, such as public databases (including the U.S. National Library of Medicine's PubMed/PMC service) and publicly accessible web pages. We do not obtain these addresses from publishers' subscription systems.

Lawful basis

Where data-protection law applies (including the EU and UK GDPR), we rely on our legitimate interests — facilitating scholarly communication between readers and the authors of published research. You have the right to object to this processing at any time (see "Your choices" below). If you object, we will stop contacting you, including about any future questions, and delete your contact details.

What we store, and what's public

We store the author contact email address associated with a question — both the address we use to send it and any address an author replies from — as part of a private internal record. We use this address to deliver the reader's question, to route any replies in that conversation, to forward future questions from other readers about the same author's work, and for internal record-keeping. This address is never shown publicly. The author's reply itself — the response text and the display name they provide — is published publicly as a response on the paper's discussion, visible to other users.

Display names are self-entered and not verified

On the reply page, the author types the name they wish to appear alongside their response; we do not independently verify it. If an author replies by email instead, the name shown is taken automatically from the details their email program supplies. We label these responses as author replies but do not represent them as identity-verified.

Retention

We keep an author's contact email address for as long as it is needed for the purposes above — in particular, for as long as the discussion may still receive replies that we would deliver to the author, and so that we can forward future questions about their work. Because a published paper can attract discussion over a long period, we may retain this address for an extended time. We delete it promptly at the author's request, or once it is no longer needed for these purposes. Published replies remain visible as part of the public discussion unless removed on request.

Service providers

For this feature we use Supabase (United States — database and compute; data stored in the U.S. West / Northern California region), Resend (United States — email delivery), Cloudflare (United States — inbound email routing), and web search providers (used to help locate author contact details). See the Third-Party Services section for links to these providers' policies.

International transfers

Our providers are in the United States and our data is stored there. Where we process the personal data of individuals outside the U.S., that data is transferred to the U.S.; where required, we rely on Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum) or equivalent safeguards.

Your choices

If you are an author and you do not wish to be contacted through Global Journal Club, wish to access or correct the information we hold about you, or want a published reply or your stored contact details removed, email us at globaljcteam@gmail.com and we will act on your request.

9. Images & Uploaded Files

9.1 Comment Images

You may attach images to comments. Uploaded images are:

Compressed on your device before upload to reduce file size (maximum 10 MB per image).
Stored in our cloud storage infrastructure.
Accessible via a unique URL. Images attached to public comments may be accessible to anyone with the URL.

9.2 Avatar Images

Profile pictures you upload are stored in cloud storage and displayed alongside your comments and profile.

9.3 Feedback Screenshots

If you attach a screenshot to a feedback report, it is stored in a private storage bucket accessible only to our team for support purposes.

10. Data Retention & Deletion

10.1 Account Data

Your account information is retained for as long as your account exists. If you wish to delete your account, please contact us (see Section 16). Upon account deletion, your profile, comments, votes, notes, paper follows, and group memberships are permanently removed.

10.2 Comments

When you delete a comment, on our website or in the Extension, the comment is soft-deleted (hidden from all users but retained in our database). Permanent deletion occurs when your account is deleted.

10.3 Analytics & Diagnostic Data

We retain analytics and diagnostic data for as long as necessary to maintain, secure, and improve the Service, after which it is deleted or aggregated into non-identifiable form.

10.4 Uninstall Feedback

Anonymous uninstall survey responses are retained indefinitely as they are not linked to any user account.

10.5 Local Data

Data stored locally in your browser (see Section 4) is automatically removed when you uninstall the Extension. You may also clear it manually via your browser settings.

10.6 Author Contact Data

Retention of author contact email addresses obtained for the author-contact feature is described in the "Contacting Authors & Author Replies" section.

11. Data Security

We take the security of your data seriously and implement appropriate measures, including:

Encryption in transit — all data transmitted between your browser and our servers uses HTTPS/TLS encryption.
Row-Level Security — database access policies ensure users can only access data they are authorised to see (e.g., your own group memberships). These policies govern user access; authorised operators retain technical database access as described in Section 1.2.
Authentication — secure token-based authentication with automatic session refresh.
Input validation — server-side validation and sanitisation to protect against injection attacks.
Access controls — administrative functions require elevated privileges and are not accessible to regular users.
CORS restrictions — API endpoints only accept requests from authorised origins.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

12. Children's Privacy

The Extension is designed for use by researchers, academics, and professionals and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us using the details below.

13. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — update or correct inaccurate information. You can edit your profile (display name, avatar, about) directly on our website or within the Extension.
Deletion — request deletion of your account and associated data. Contact us and we will process your request.
Data portability — request a machine-readable copy of your data.
Withdraw consent — where processing is based on consent, you may withdraw it at any time (e.g., unsubscribing from emails).
Objection — object to processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us using the details in Section 16. We will respond to your request within 30 days.

Additional Rights for EU/EEA Residents (GDPR)

If you reside in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection authority if you believe your data has been processed unlawfully.

Additional Rights for California Residents (CCPA)

If you are a California resident, you have the right to:

Know what personal information is collected and how it is used.
Request deletion of your personal information.
Opt out of the sale of personal information — we do not sell your personal information.
Non-discrimination for exercising your privacy rights.

14. International Data Transfers

Our service providers may process your data in countries outside your country of residence, including the United States. By using the Extension, you consent to the transfer of your information to these countries. We ensure that any such transfers are protected by appropriate safeguards as required by applicable law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. If we make material changes, we will notify you through the Extension or by email. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: globaljcteam@gmail.com
Website: www.globaljournalclub.org