频率限制：为防止接口被滥用，以上请求会按来源 IP 限制调用频率，为此服务端会保存你的 IP 地址与短周期内的调用次数。该记录仅用于限流，不与你的许可、试用记录或身份信息关联。
以上请求均不附带任何本地研究数据。
支付由登记商户处理，我们不接触你的银行卡信息。中国大陆以外的销售由 Sold through Link, LLC（Stripe 的登记商户方案）完成，见《服务条款》第 3 节。银行卡信息在该登记商户自有的结账页面填写，绝不经过 Scholardo 的服务器；你在结账时提供的账单与税务信息，由该登记商户依其自身隐私政策、以数据控制者的身份处理。为了完成订单及后续支持，我们会从它那里获得：你购买时使用的邮箱地址、所购方案、金额与币种、订单与订阅标识，以及续费、退款或拒付的状态。上述购买记录将在许可存续期间、以及税务与会计法规要求的期限内保留。
中国大陆：在中国大陆以人民币完成的购买（包括早鸟优惠），由 Scholardo 直接通过 Stripe 收款。此时 Stripe 作为我们的支付处理方处理你的付款信息，银行卡信息同样只在 Stripe 的结账页面填写、不经过 Scholardo 的服务器；我们获得的购买记录与上文所列相同。为了显示本地价格并把你送往对应的结账页，网站会读取 Cloudflare 依你的 IP 地址判断出的国家/地区；这一判断在 Cloudflare 的网络边缘完成，我们不保存它，也不保存你的 IP 地址。
Scholardo is the workbench for agentic research workflow, on macOS and Windows, built local-first. This policy explains how we handle your data. The principle is simple: your library stays on your own machine — we do not collect it, upload it, or analyze it.
1. Your data is stored locally
Everything you create in Scholardo — your library, PDFs / EPUBs / web pages, annotations and highlights, notes, session transcripts, citation data, and the vector index — is kept only on your computer's local disk. Your research lives inside each of your own project folders (including a hidden .scholardo folder in each project), and the app's settings live in the per-user application-data location your operating system provides, stored in a local database and ordinary files.
This data is never uploaded to our servers and never synced to any cloud. We cannot see or access your research. Backup, migration, and deletion are entirely under your control.
2. Zero telemetry
The Scholardo app contains no telemetry, usage analytics, behavioral tracking, or crash reporting. Local use requires no account and no sign-in. We do not track which files you open, which features you use, or how long you stay.
3. API keys are yours, encrypted locally
Scholardo's AI features (selection rewriting, feed digests, embedding search, and so on) are powered by AI provider API keys that you supply yourself — OpenAI, Anthropic, Google Gemini, DeepSeek, or any OpenAI-compatible endpoint. Core features (search, annotations, citations, browser capture) run locally and need no key at all.
Encrypted locally: any API key you enter is stored in the system credential store — the Keychain on macOS, Credential Manager on Windows — protected by the operating system's encryption — never written in plaintext to ordinary config files.
Never sent to us: your API keys are never transmitted to any Scholardo server.
Requests go straight to the provider: when you use an AI feature, the request goes directly from your computer to the model provider you configured. Scholardo is not a proxy and does not intercept, route, or log the contents of those requests. The data exchanged is governed by that provider's own privacy policy and terms.
4. Network calls we make
These are the first-party network calls Scholardo makes to our servers. Each one is listed in full, including what it sends:
License activation: sends your activation code, the email address you bought with, an anonymous device fingerprint (a hash — never your hardware serial), and a generic device label ("Mac" on every platform, never your computer's name). The email is required because the server checks it against the purchase before issuing a licence.
License refresh: sends the activation code and the same device fingerprint, periodically, so a licence keeps working without you re-entering anything.
Free trial: sends the email you enter (to send the verification code, and so each address gets one trial) and the anonymous device fingerprint (so each computer gets one trial). The server also records a one-way hash of your IP address, your approximate country and when you last checked in, only to spot repeat registrations. Your email is kept on the licence server and is not used for marketing unless you separately agree.
Deactivating a device: when you release this computer's seat from Settings → License, sends the activation code and the device fingerprint.
Contact form: only when you choose to fill in and submit the "Contact us" form on our website does its content reach our endpoint, solely so we can reply (see Section 6).
Rate limiting: to keep these endpoints from being abused, the requests above are rate-limited by source IP, for which the server stores your IP address and a short-window request count. That record is used only for rate limiting and is not linked to your licence, your trial record or any identity.
No local research data is attached to any of these.
Purchases are handled by a merchant of record; we never see your card details. Outside mainland China the sale is completed by Sold through Link, LLC (Stripe's merchant of record programme), as set out in Section 3 of the Terms. Card details are entered on that merchant's own checkout pages and never reach Scholardo's servers; the billing and tax details you provide at checkout are handled by that merchant as a data controller under its own privacy policy. To fulfil an order and support it afterwards, we receive from it the email address you bought with, the plan, the amount and currency, the order and subscription identifiers, and the status of any renewal, refund or chargeback. We keep this purchase record for as long as the licence exists and for as long as tax and accounting law requires.
Mainland China: a CNY purchase made in mainland China (early-access offers included) is collected by Scholardo directly through Stripe. Stripe then processes your payment details as our payment processor; card details are still entered only on Stripe's checkout page and never reach Scholardo's servers, and the purchase record we receive is the same as listed above. To show the local price and send you to the matching checkout, the site reads the country or region Cloudflare derives from your IP address; that lookup happens at Cloudflare's network edge, and we store neither it nor your IP address.
Student discount verification. To apply for the student discount you email us your school or institutional email address, together with a photo of your student ID or a link to a school web page that shows your name (either one is enough — if you would rather not send an ID photo, the page link will do). We use this only to confirm that you are a student; it is used for nothing else and shared with no one. Once you are verified, we reply with a payment link carrying a discount code, and the purchase then follows the flow described above. Within 30 days of verification we delete the ID photo and the page link, attachments included, keeping only a record that the address was verified as a student on a given date and the code we issued, so the discount cannot be claimed twice. Applications that are not approved are deleted within the same 30 days. You can ask us to delete yours sooner at any time.
The Windows version is distributed through the Microsoft Store. Microsoft handles the download, installation and updates under its own privacy statement. The Store only distributes the app and takes no part in the purchase — trials and licences go through the flow above. Beyond the aggregate download reports Microsoft gives publishers, we receive no personal information about you from the Store.
We have a written arrangement with each merchant of record covering our respective data-protection roles in the payment flow. For how it handles your personal data, see the Link or Stripe privacy policy — or email us and we will help you reach the right party.
5. Third-party services you opt into
Some features connect to third parties only when you trigger them. Whether to use them is your choice, and the data exchanged is governed by each provider's own policy:
AI / embedding providers: using your own key, with requests going directly (see Section 3). Self-hosted options such as local Ollama stay entirely on your machine.
Web capture: when you open or save a page in the built-in browser or capture tools, a request is made to that URL.
RSS feeds: when you configure a feed, its source is fetched.
Citation styles: CSL styles may be downloaded on demand from a public style repository.
Hypothesis sync: if you enable it, Scholardo communicates with the Hypothesis service.
6. This website
For the marketing website (scholardo.com) itself:
Only essential local storage: it remembers your theme (light / dark) and language preference in your browser's localStorage.
No cookies, no cross-site tracking: this site uses Cloudflare Web Analytics to count page views. It sets no cookie, reads no local storage, and does not fingerprint your browser, and it cannot recognise you across sites; each visit sends a single page record (the page address, the referring page, an approximate location, and a device/browser type), which Cloudflare aggregates and reports without retaining your IP address. All we see are totals, which cannot be traced back to an individual. Nothing else is loaded — no advertising, no behavioural analytics. If a tool that does require consent is ever added, it will load only after you explicitly consent.
Version check: the page makes one anonymous request to the public GitHub Releases API to show the latest version and download link.
Contact form: anything you submit is sent to our endpoint (api.scholardo.com/contact) solely to forward it to us by email so we can reply; it is not otherwise stored.
Web fonts: typefaces are served from this site. They are no longer requested from Google Fonts, or from any third party. Icons and every other asset are served from here too — loading a page talks to this site and nothing else.
Anti-spam on the contact form only: opening the enquiry form loads Cloudflare Turnstile (challenges.cloudflare.com) to check you are not a bot. It runs only when you open that form, never on page load, and Cloudflare states it does not use it to track people across sites.
Checkout: the pricing buttons go through this site's /go/checkout, which reads the country code Cloudflare derives from your IP and sends you to the checkout page hosted by the merchant of record for that country. That country code is used for the redirect and is neither logged nor stored. Nothing about payment happens on this site, and no payment script is loaded here.
7. Retention & deletion
Because your research data never leaves your device, deletion is entirely in your hands: removing a project folder, or uninstalling the app and deleting its application-data folder, removes that data. We hold no copy of your research to retain or delete. Our license records contain only the minimum needed to validate your entitlement.
8. Children
Scholardo is a professional tool for researchers. It is not directed to children under 13 (or the equivalent age in your jurisdiction), and we do not knowingly collect their personal information.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page; continued use means you accept the updated terms.
