Privacy Policy – Global Journal Club

    Effective Date: July 15, 2026

    Last Updated: July 15, 2026

Global Journal Club ("we," "us," or "our") operates the Global Journal Club browser extension (the "Extension") for Google Chrome and compatible browsers and the Global Journal Club website at globaljournalclub.org (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have regarding your data.

By installing or using the Extension, you agree to the collection and use of information in accordance with this policy. If you do not agree, please uninstall the Extension.

This Privacy Policy also applies to authors of academic papers whom we contact on behalf of our users. If you are such an author, the "Contacting Authors & Author Replies" section explains what information we hold about you, why, and how to ask us not to contact you.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Email address — used for authentication, notifications, and account recovery.
Username and display name — chosen by you, displayed publicly alongside your comments.
Avatar image and position — optional profile picture you upload and its crop position.
Professional role — optional self-described role (e.g., researcher, student).

1.2 User-Generated Content

When you use the Extension, you may create:

Comments — text posted on academic papers, which may include rich text formatting, images, and group tags. All comments are publicly visible. Tagging a comment to a group notifies that group's members but does not restrict who can see the comment.
Notes — personal notes you write on specific papers. Notes are not visible to other users. They are stored securely and are not displayed anywhere in the Service outside your own account. GJC staff do not read the content of your notes; we use only aggregate, non-content information (such as note length and how often notes are created) to understand whether the feature is useful. As operators we have technical database access, but we do not access note content except where strictly necessary for security, legal compliance, or to resolve a technical issue you report.
Votes — upvotes on comments made by other users.
Paper follows — when you follow a paper (identified by its DOI) to receive notifications about new comments.

1.3 Paper Metadata

When you comment on or follow a paper, the Extension extracts:

DOI (Digital Object Identifier) from the page's metadata.
Paper title from the page's metadata or manually entered by you.
Paper URL — the web address where you accessed the paper.

For commenting and following, we collect only the DOI, title, and URL from the page you are viewing, and we do not fetch additional metadata from external databases for those actions. Separately, if you choose to send a question to a paper's authors, we look up author contact details from external public sources — see the "Contacting Authors & Author Replies" section.

1.4 Group Membership

If you create or join groups, we store:

Group name, description, and keywords.
Your membership role (member, moderator, or owner) and join date.
Invite links you generate and their usage.

1.5 Usage Analytics

We collect limited analytics events to understand how the Extension is used and to improve our service. These include:

Account creation events.
Extension badge interactions (e.g., whether the badge was pinned or clicked).
Sidebar open events.
Notification interactions (viewed, clicked).
Navigation pings (which paper sites are visited, to track Extension reach — no page content is collected).
Note usage metrics — we derive aggregate statistics about notes (such as how many you create and their length) from activity and counts only; we do not use the content of your notes.

Analytics events are associated with your user ID. We do not use any third-party analytics services (e.g., Google Analytics, Mixpanel). All analytics data is stored on our own infrastructure.

1.6 Diagnostic & Error Data

To diagnose and fix technical issues, we may collect:

Client error logs (error type, message, page URL, browser user agent).
Email delivery failure logs (error codes from our email providers, no email content).
Email link click outcomes (whether a notification link redirected successfully).

1.7 Feedback & Uninstall Survey

In-extension feedback — messages and optional screenshots you submit via the feedback form.
Problem reports — messages submitted from our email pages.
Uninstall survey — if you uninstall the Extension, you may optionally complete an anonymous survey. This survey does not collect your email, user ID, or any personally identifiable information.

2. How We Use Your Information

We use the information we collect for the following purposes:

Purpose	Data Used
Provide and operate the Extension	Account info, content, paper metadata
Authenticate you and secure your account	Email, session tokens
Display your comments and profile to others	Username, display name, avatar, comments
Send notifications (in-browser and email)	Email, notification preferences, comment/group activity
Manage group memberships and moderation	Group data, membership roles
Improve the Extension and fix bugs	Analytics events, error logs
Respond to your feedback and support requests	Feedback messages, screenshots, email
Understand why users uninstall	Anonymous uninstall survey responses

We do not use your data for advertising, profiling, or selling to third parties.

3. Browser Permissions

The Extension requests the following browser permissions:

Permission	Why We Need It
activeTab	To detect paper metadata (DOI, title) on the page you are currently viewing, so you can comment on or follow that paper.
storage	To store your authentication session, notification preferences, and cached data locally in your browser.
alarms	To periodically check for new notifications and update the Extension badge count.
Host permissions	To inject the Extension sidebar on academic paper websites and to communicate with our backend services hosted on Supabase.

    For commenting and following, the Extension reads only paper identification metadata (DOI, title) from the page. If you choose to send a question to a paper's authors, the Extension may additionally read author contact details (such as an email address) shown on that page in order to deliver your question. The Extension does not read, collect, or transmit the text content of papers, your browsing history, form inputs, or passwords.

4. Local Browser Storage

The Extension uses chrome.storage.local (not cookies) to store data locally on your device:

Authentication session — access and refresh tokens for your logged-in session.
Notification preferences — your chosen settings for browser and email notifications.
Badge state — whether the Extension badge is pinned, last interaction time, and cached unread counts.
Sidebar state — last active tab and view preferences.

The Extension also makes limited use of temporary browser storage (localStorage) for short-lived purposes — bridging an action you initiated on one of our web pages into the Extension, and auto-saving a comment draft so you don't lose it. This data stays on your device and is cleared automatically once the action completes or the draft is submitted or discarded.

This data stays on your device and is removed when you uninstall the Extension. We do not set or read browser cookies.

5. Third-Party Services

We use the following third-party service providers to operate the Extension:

Service	Purpose	Data Shared
Supabase	Database hosting, user authentication, file storage, and serverless functions	All account data, content, and files are stored on Supabase infrastructure
Resend	Transactional email delivery (notifications, digests, paper follow alerts), and author outreach	Recipient email address and email content
Brevo	Authentication email delivery (sign-up confirmation, password reset, OTP codes)	Recipient email address and authentication email content
Cloudflare	Inbound email routing (capturing author replies sent by email)	Inbound email address and message content
Web search providers	Helping locate author contact details	Author name and affiliation

Each provider processes data in accordance with their own privacy policies:

We do not use any third-party advertising, tracking, or marketing services. We do not embed third-party advertising, tracking, analytics, or marketing scripts.

We do not sell, rent, or trade your personal information to anyone.

We may share your data only in the following circumstances:

With service providers — as described in Section 5, solely to operate the Extension.
With other users — your username, display name, avatar, and public comments are visible to other Extension users. Notes are not shown to other users; see Section 1.2 for how note content is handled.
Legal requirements — if required by law, regulation, legal process, or governmental request, we may disclose your information to comply with such obligations.
Safety — to protect against fraud, abuse, or security threats to our users or service.

7. Email Communications

We may send you email for the following purposes:

7.1 Authentication Emails

Sign-up confirmation, OTP codes, and password reset emails. These are essential for account security and cannot be opted out of.

7.2 Notification Emails

Alerts about replies to your comments, new comments on papers you follow, group activity, and upvote summaries. You can fully control these through the notification settings in the Extension sidebar.

7.3 Digest Emails

Periodic summary emails covering activity on your followed papers and groups. You can enable or disable digests in your notification settings.

7.4 Moderator Request Emails

If you are a group moderator or owner, you may receive emails when users request to join your group.

    Opting out: You can manage all email preferences from the notification settings in the Extension, or click the "Unsubscribe" link at the bottom of any email. Authentication emails cannot be disabled as they are necessary for account security.

8. Contacting Authors & Author Replies

What this feature does

Global Journal Club lets a reader forward a question about a paper to that paper's authors. When a reader chooses to do this, we attempt to find a contact email address for the corresponding author, send them the reader's question by email, and give them a way to reply — either by replying to that email or through a reply page on our website. Any reply the author provides is published as a response to the reader's question.

Where the author's email comes from

We do not receive author contact addresses from the reader. We locate a corresponding author's email from publicly available sources, such as public databases (including the U.S. National Library of Medicine's PubMed/PMC service) and publicly accessible web pages. We do not obtain these addresses from publishers' subscription systems.

Lawful basis

Where data-protection law applies (including the EU and UK GDPR), we rely on our legitimate interests — facilitating scholarly communication between readers and the authors of published research. You have the right to object to this processing at any time (see "Your choices" below). If you object, we will stop contacting you, including about any future questions, and delete your contact details.

What we store, and what's public

We store the author contact email address associated with a question — both the address we use to send it and any address an author replies from — as part of a private internal record. We use this address to deliver the reader's question, to route any replies in that conversation, to forward future questions from other readers about the same author's work, and for internal record-keeping. This address is never shown publicly. The author's reply itself — the response text and the display name they provide — is published publicly as a response on the paper's discussion, visible to other users.

Display names are self-entered and not verified

On the reply page, the author types the name they wish to appear alongside their response; we do not independently verify it. If an author replies by email instead, the name shown is taken automatically from the details their email program supplies. We label these responses as author replies but do not represent them as identity-verified.

Retention

We keep an author's contact email address for as long as it is needed for the purposes above — in particular, for as long as the discussion may still receive replies that we would deliver to the author, and so that we can forward future questions about their work. Because a published paper can attract discussion over a long period, we may retain this address for an extended time. We delete it promptly at the author's request, or once it is no longer needed for these purposes. Published replies remain visible as part of the public discussion unless removed on request.

Service providers

For this feature we use Supabase (United States — database and compute; data stored in the U.S. West / Northern California region), Resend (United States — email delivery), Cloudflare (United States — inbound email routing), and web search providers (used to help locate author contact details). See the Third-Party Services section for links to these providers' policies.

International transfers

Our providers are in the United States and our data is stored there. Where we process the personal data of individuals outside the U.S., that data is transferred to the U.S.; where required, we rely on Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum) or equivalent safeguards.

Your choices

If you are an author and you do not wish to be contacted through Global Journal Club, wish to access or correct the information we hold about you, or want a published reply or your stored contact details removed, email us at [email protected] and we will act on your request.

9. Images & Uploaded Files

9.1 Comment Images

You may attach images to comments. Uploaded images are:

Compressed on your device before upload to reduce file size (maximum 10 MB per image).
Stored in our cloud storage infrastructure.
Accessible via a unique URL. Images attached to public comments may be accessible to anyone with the URL.

9.2 Avatar Images

Profile pictures you upload are stored in cloud storage and displayed alongside your comments and profile.

9.3 Feedback Screenshots

If you attach a screenshot to a feedback report, it is stored in a private storage bucket accessible only to our team for support purposes.

10. Data Retention & Deletion

10.1 Account Data

Your account information is retained for as long as your account exists. If you wish to delete your account, please contact us (see Section 16). Upon account deletion, your profile, comments, votes, notes, paper follows, and group memberships are permanently removed.

10.2 Comments

When you delete a comment through the Extension, the comment is soft-deleted (hidden from all users but retained in our database). Permanent deletion occurs when your account is deleted.

10.3 Analytics & Diagnostic Data

We retain analytics and diagnostic data for as long as necessary to maintain, secure, and improve the Service, after which it is deleted or aggregated into non-identifiable form.

10.4 Uninstall Feedback

Anonymous uninstall survey responses are retained indefinitely as they are not linked to any user account.

10.5 Local Data

Data stored locally in your browser (see Section 4) is automatically removed when you uninstall the Extension. You may also clear it manually via your browser settings.

10.6 Author Contact Data

Retention of author contact email addresses obtained for the author-contact feature is described in the "Contacting Authors & Author Replies" section.

11. Data Security

We take the security of your data seriously and implement appropriate measures, including:

Encryption in transit — all data transmitted between your browser and our servers uses HTTPS/TLS encryption.
Row-Level Security — database access policies ensure users can only access data they are authorised to see (e.g., your own group memberships). These policies govern user access; authorised operators retain technical database access as described in Section 1.2.
Authentication — secure token-based authentication with automatic session refresh.
Input validation — server-side validation and sanitisation to protect against injection attacks.
Access controls — administrative functions require elevated privileges and are not accessible to regular users.
CORS restrictions — API endpoints only accept requests from authorised origins.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

12. Children's Privacy

The Extension is designed for use by researchers, academics, and professionals and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us using the details below.

13. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — update or correct inaccurate information. You can edit your profile (display name, avatar, role) directly within the Extension.
Deletion — request deletion of your account and associated data. Contact us and we will process your request.
Data portability — request a machine-readable copy of your data.
Withdraw consent — where processing is based on consent, you may withdraw it at any time (e.g., unsubscribing from emails).
Objection — object to processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us using the details in Section 16. We will respond to your request within 30 days.

Additional Rights for EU/EEA Residents (GDPR)

If you reside in the European Union or European Economic Area, you have the right to lodge a complaint with your local data protection authority if you believe your data has been processed unlawfully.

Additional Rights for California Residents (CCPA)

If you are a California resident, you have the right to:

Know what personal information is collected and how it is used.
Request deletion of your personal information.
Opt out of the sale of personal information — we do not sell your personal information.
Non-discrimination for exercising your privacy rights.

14. International Data Transfers

Our service providers may process your data in countries outside your country of residence, including the United States. By using the Extension, you consent to the transfer of your information to these countries. We ensure that any such transfers are protected by appropriate safeguards as required by applicable law.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. If we make material changes, we will notify you through the Extension or by email. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected]
Website: www.globaljournalclub.org