Account registration data — When you create a PaperTrail Academic account to use StyleMatch or Verify, we collect your name and email address. This information is stored in our secure database (Supabase, hosted on AWS infrastructure). No account is required to use Inspect.
Google Sign-In data — If you choose to sign in with Google, we receive your name and email address via Google's OAuth 2.0 flow. We do not receive your Google password, and we do not request access to Google Drive, Gmail, or any other Google service beyond basic profile information.
Subscription and billing data — If you purchase a StyleMatch subscription or Verify credits, payment is handled entirely by Lemon Squeezy (our payment processor and merchant of record). PaperTrail Academic does not receive or store your credit card number or payment details. When a purchase is completed, our payment processor notifies PaperTrail Academic's backend via a secure webhook. PaperTrail Academic then updates your account's subscription status and Verify report credit balance in order to unlock the appropriate features. No payment or financial details are included in this notification.
Verify report metadata — When you run a Verify report, we store the report output (scores, dimension ratings, timestamps, and any label you assigned). The full essay text used to generate the report is not retained after generation.
Local browser storage — The Chrome extension stores session data locally on your device using Chrome's built-in storage APIs (chrome.storage.local). This includes your login session, cached account state, and revision data for the current document. Document content and revision data never leave your device except as described in the sections below. Login session and account state are transmitted to PaperTrail Academic's backend only as necessary to authenticate you and check your subscription status. This data is cleared when you sign out or when the browser session ends.
Revision history data — PaperTrail reads document revision history from Google Docs using Google's built-in revision API — the same data that powers native revision history in Google Docs. This data (document content at various points in time, edit timestamps, and anonymised author identifiers) is accessed and processed entirely within your browser. It is not transmitted to PaperTrail Academic's servers.
Verify essay text — When you run a Verify report, the essay text is transmitted over an encrypted connection (HTTPS) to PaperTrail Academic's secure backend for processing. See the Verify section below for full details.
What we do not collect — PaperTrail does not collect usage analytics, browsing history, keystroke data, or any information beyond what is described above. No telemetry is sent from the extension.
Account data (name, email) — Used solely to authenticate you, associate your subscription status and Verify report credit balance with your account, and send transactional emails (purchase confirmations, account-related notices). We do not use your email address for marketing without your explicit consent, and we do not sell or rent it to any third party.
Subscription and billing status — Used to determine which features are available to your account (StyleMatch access, Verify report credit balance) and to process subscription renewals via Lemon Squeezy.
Verify report metadata — Stored to allow you to retrieve past reports within the extension. Not used for any purpose other than displaying results to you.
Verify essay text (in transit) — Transmitted to PaperTrail Academic's backend and forwarded to the Anthropic API for AI-assisted analysis. Not retained by PaperTrail Academic after the report is generated. Not used for any purpose other than generating the report you requested.
PaperTrail Academic does not sell, rent, or trade user data. Data is shared with third parties only in the following limited circumstances:
Supabase — Our database and backend infrastructure provider (supabase.com). Account data (name, email, subscription status, Verify report credit balance) and Verify report metadata are stored on Supabase servers, which run on AWS infrastructure. Supabase processes this data solely to provide database and authentication services to PaperTrail Academic. See supabase.com/privacy.
Anthropic — When you run a Verify report, essay text is forwarded to the Anthropic API for AI-assisted analysis. Anthropic processes submitted text under its commercial API terms, which prohibit using API inputs to train AI models. Anthropic retains API inputs for a limited period before automatic deletion. See anthropic.com/privacy for their current retention policy.
Lemon Squeezy — Our payment processor and merchant of record (lemonsqueezy.com). All payment transactions are handled directly by Lemon Squeezy. PaperTrail Academic receives only subscription status and Verify report credit balance updates via webhook. Lemon Squeezy is the legal seller of record for all purchases. See lemonsqueezy.com/privacy.
Resend — Our transactional email provider (resend.com), used to send account-related emails (e.g., purchase confirmations). Email addresses are shared with Resend solely for this purpose.
No other third parties receive your data. PaperTrail Academic does not share data with advertising networks, data brokers, analytics providers, or any other parties.
We may disclose data if required to do so by law or in response to a valid legal process. We will notify affected users where legally permitted to do so.
✏️ Inspect — No account required. No data transmitted. Revision history is read from Google Docs and processed entirely within your browser. Nothing is stored on PaperTrail Academic's servers.
🔍 StyleMatch™ — Requires an account. All stylometric analysis is performed locally on your device using JavaScript. The text you paste into the StyleMatch panel is never transmitted to PaperTrail Academic or any third party — this is a design choice, not just a policy. Once you close the sidebar or navigate away, the text is cleared from memory.
StyleMatch text never leaves your browser. There is no server-side component to StyleMatch analysis.
🔬 Verify — Requires an account and Verify credits. Verify is the only Chrome extension tool that transmits essay text. When you run a Verify report, the submitted text is sent over HTTPS to PaperTrail Academic's secure backend, forwarded to the Anthropic API for analysis, and returned as a structured report saved to your account. The full essay text is not retained by PaperTrail Academic after the report is generated. Only report metadata (scores, ratings, timestamps, and any label you assigned) is stored. If your institution requires it, you should anonymize any student-identifying information before submitting text through Verify.
Account data — Retained for as long as your account is active. When you delete your account, your name, email address, subscription status, and Verify report credit balance are permanently deleted from PaperTrail Academic's database. Account deletion is available from within the extension settings.
Verify report metadata — Retained until you delete the report or delete your account.
Verify essay text — Not retained by PaperTrail Academic after report generation. Anthropic's retention period is governed by their own privacy policy.
Local browser storage — Cleared when you sign out of the extension or uninstall it.
All data transmitted between the extension and PaperTrail Academic's backend is encrypted in transit using HTTPS/TLS. Account data stored on Supabase is encrypted at rest. Authentication tokens are stored using Chrome's extension storage, which is isolated from websites and other extensions.
PaperTrail Academic is operated by a single developer. Access to the backend database is restricted to that developer. No employees or contractors have routine access to user data.
Despite these measures, no system can guarantee absolute security. If you become aware of a security concern, please contact hello@papertrailacademic.com.
You have the right to access, correct, or delete the personal data PaperTrail Academic holds about you. Specifically:
Delete your account — You can delete your account at any time from within the extension settings (Settings → Delete Account). This permanently removes your name, email, subscription status, Verify report credit balance, and all stored report metadata. Deletion is immediate and cannot be reversed.
Access or correct your data — To request a copy of the data PaperTrail Academic holds about you, or to correct inaccurate information, email hello@papertrailacademic.com.
Cancel your subscription — You can cancel your StyleMatch subscription at any time via the billing portal linked within the extension. Cancellation stops future billing; access continues until the end of the current billing period.
Users in the EU, UK, or California may have additional rights under GDPR, UK GDPR, or CCPA respectively. PaperTrail Academic will honor all valid requests regardless of your location.
PaperTrail requests only the permissions necessary for its described functionality:
activeTab and tabs — Required to inject the revision analysis tool into the active Google Docs page, open the playback window in a new tab, and detect when the user is on a Google Docs or Google Classroom page.
webNavigation — Required to detect when a teacher navigates to a Google Docs page so the extension can activate automatically.
identity — Required to authenticate teachers via Google Sign-In for StyleMatch and Verify features.
storage and unlimitedStorage — Required to hold revision data for large documents (which can contain tens of thousands of revision entries) and to cache login session data locally. Revision data is stored locally and cleared when the extension reloads or the browser session ends.
Host permissions for docs.google.com and classroom.google.com — Required to operate on Google Docs and Google Classroom pages.
Host permission for ktzrdhiqhidexunucuqp.supabase.co — Required to communicate with PaperTrail Academic's secure backend (Supabase) for account authentication, subscription status checks, and Verify report generation. This connection is only used when you are signed in and actively using StyleMatch or Verify features.
PaperTrail Academic's use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Specifically: data accessed via Google APIs is used only to provide the features described in this policy and in the extension's Chrome Web Store listing. It is not used for advertising, it is not transferred to third parties except as described above (and only as necessary to provide the service), and it is not used to train AI models. No human at PaperTrail Academic reads user data obtained via Google APIs except as required to investigate a security or abuse concern, or as required by law.
PaperTrail Write (write.papertrailacademic.com) is a separate web application for controlled classroom writing sessions. It is not a Chrome extension. The following describes how it handles data.
Teacher accounts — Teachers create accounts using email and password or Google Sign-In. Google Sign-In uses the standard OAuth 2.0 flow and requests only basic profile information (name and email address). PaperTrail Write does not request access to Google Drive at sign-in.
Google Drive — source document upload — When a teacher chooses to attach a source document from Google Drive, PaperTrail Write requests read-only access (drive.readonly) to allow the teacher to select a file using the Google Picker. Only the selected file is accessed. Its contents are downloaded to the teacher's browser and uploaded to PaperTrail Write's secure storage (Supabase, hosted on AWS). PaperTrail Write does not browse, index, or retain access to any other files in the teacher's Drive.
Student writing data — Students join sessions using a code provided by their teacher. No student account is created. Student-entered text, word counts, and writing process signals (such as paste events and time away) are stored transiently in PaperTrail Write's secure backend for the duration of the session.
PaperTrail Write is designed as a transit system, not a data vault. After a session ends, the teacher downloads a session report. Student submission data is then purged from PaperTrail's servers. The teacher is the data custodian — they hold the report, not PaperTrail.
Untimed sessions are purged after 30 days. Timed sessions are purged after 7 days. Ended sessions are purged within 24 hours of the session ending. These purges are automatic and cannot be reversed.
PaperTrail Write does not sell, share, or transmit student data to any third party. It does not use student writing for any purpose other than displaying it to the assigned teacher. It does not use student data to train any AI model.
PaperTrail respects the access permissions that Google enforces on all documents. It can only read revision history that the logged-in teacher already has permission to view. It does not access any student data beyond what is visible in the document's standard revision history.
Because Inspect and StyleMatch process all data locally without transmission, they do not raise data governance concerns beyond those of Google Docs itself. For Verify, see above. For PaperTrail Write, see above.
Schools and IT coordinators with compliance questions should review our For Schools page, which covers FERPA, PIPEDA, and GDPR considerations in plain language.
PaperTrail does not knowingly collect any information from minors beyond what is necessary to operate a teacher-assigned writing session. In PaperTrail Write, students enter only their name and their written work — no email address, no account, and no personal identifiers are required. Session data is purged automatically after the session ends. The Chrome extension is designed exclusively for use by educators and does not interact with students at all.
If PaperTrail's data practices change — for example, if new features involve data transmission — this policy will be updated and the date at the top of the page will reflect the change. Material changes will also be communicated to registered users by email before taking effect.
Questions about this privacy policy or how PaperTrail handles data can be directed to hello@papertrailacademic.com.
For school and institutional inquiries — including DPA requests and compliance questions — see For Schools or email hello@papertrailacademic.com with "Privacy Question" in the subject line.