Account registration data — When you create a PaperTrail Academic account to use StyleMatch or Verify, we collect your name and email address. This information is stored in our secure database (Supabase, hosted on AWS infrastructure). No account is required to use Inspect (which includes Process View).
Google Sign-In data — If you choose to sign in with Google, we receive your name and email address via Google's OAuth 2.0 flow. We do not receive your Google password, and we do not request access to Google Drive, Gmail, or any other Google service beyond basic profile information.
Subscription and billing data — If you purchase a StyleMatch subscription or PaperTrail Tokens, payment is handled entirely by Lemon Squeezy (our payment processor and merchant of record). PaperTrail Academic does not receive or store your credit card number or payment details. When a purchase is completed, our payment processor notifies PaperTrail Academic's backend via a secure webhook. PaperTrail Academic then updates your account's subscription status and PaperTrail Token balance in order to unlock the appropriate features. No payment or financial details are included in this notification.
Verify report metadata — When you run a Verify Submitted, Verify Compare, or Verify Citations report, we store the report output (scores, dimension ratings, timestamps, and any label you assigned). The full essay text used to generate the report is not retained after generation. Process View reports are generated entirely client-side and are not stored on our servers.
Local browser storage — The Chrome extension stores session data locally on your device using Chrome's built-in storage APIs (chrome.storage.local). This includes your login session, cached account state, and revision data for the current document. Document content and revision data never leave your device except as described in the sections below. Login session and account state are transmitted to PaperTrail Academic's backend only as necessary to authenticate you and check your subscription status. This data is cleared when you sign out or when the browser session ends.
Revision history data — PaperTrail reads document revision history from Google Docs using Google's built-in revision API — the same data that powers native revision history in Google Docs. This data (document content at various points in time, edit timestamps, and anonymised author identifiers) is accessed and processed entirely within your browser. It is not transmitted to PaperTrail Academic's servers. Process View, Inspect, and StyleMatch all operate on this data locally; no part of it is transmitted.
Verify essay text — When you run a Verify Submitted, Verify Compare, or Verify Citations report, the essay text is transmitted over an encrypted connection (HTTPS) to PaperTrail Academic's secure backend for processing. See the Verify section below for full details. Process View does not transmit any text or data.
What we do not collect — PaperTrail does not collect usage analytics, browsing history, keystroke data, or any information beyond what is described above. No telemetry is sent from the extension.
Account data (name, email) — Used solely to authenticate you, associate your subscription status and PaperTrail Token balance with your account, and send transactional emails (purchase confirmations, account-related notices). We do not use your email address for marketing without your explicit consent, and we do not sell or rent it to any third party.
Subscription and billing status — Used to determine which features are available to your account (StyleMatch access, PaperTrail Token balance) and to process subscription renewals via Lemon Squeezy.
Verify report metadata — Stored to allow you to retrieve past reports within the extension. Not used for any purpose other than displaying results to you. Applies only to Verify Submitted, Verify Compare, and Verify Citations reports; Process View generates no server-side metadata.
Verify essay text (in transit) — Transmitted to PaperTrail Academic's backend and forwarded to the Anthropic API for AI-assisted analysis. Not retained by PaperTrail Academic after the report is generated. Not used for any purpose other than generating the report you requested. Applies only to Verify Submitted, Verify Compare, and Verify Citations reports.
PaperTrail Academic does not sell, rent, or trade user data. Data is shared with third parties only in the following limited circumstances:
Supabase — Our database and backend infrastructure provider (supabase.com). Account data (name, email, subscription status, PaperTrail Token balance) and Verify report metadata are stored on Supabase servers, which run on AWS infrastructure. Supabase processes this data solely to provide database and authentication services to PaperTrail Academic. See supabase.com/privacy.
Anthropic — When you run a Verify Submitted, Verify Compare, or Verify Citations report, essay text is forwarded to the Anthropic API for AI-assisted analysis; for Oral Defense, the essay text is used to generate questions and the answer transcripts are used to generate the ownership report. For Verify Citations, the analysis additionally uses Anthropic's server-side web search tool to locate cited sources and reachable source text; search queries are derived from citation details in the essay — author names, titles, quoted passages, and attributed figures — not the essay as a whole, and are not linked to any student identity. Anthropic processes submitted text under its commercial API terms, which prohibit using API inputs to train AI models. Anthropic retains API inputs for a limited period before automatic deletion. See anthropic.com/privacy for their current retention policy. Process View does not interact with Anthropic.
Lemon Squeezy — Our payment processor and merchant of record (lemonsqueezy.com). All payment transactions are handled directly by Lemon Squeezy. PaperTrail Academic receives only subscription status and PaperTrail Token balance updates via webhook. Lemon Squeezy is the legal seller of record for all purchases. See lemonsqueezy.com/privacy.
Deepgram — For Oral Defense only, student audio recordings are transcribed by Deepgram's speech-to-text API, and questions are read aloud to the student using Deepgram's text-to-speech. Deepgram processes this audio under its commercial API terms and does not use it to train models. See deepgram.com/privacy.
Resend — Our transactional email provider (resend.com), used to send account-related emails (e.g., purchase confirmations). Email addresses are shared with Resend solely for this purpose.
No other third parties receive your data. PaperTrail Academic does not share data with advertising networks, data brokers, analytics providers, or any other parties.
We may disclose data if required to do so by law or in response to a valid legal process. We will notify affected users where legally permitted to do so.
✏️ Inspect — No account required. No data transmitted. Revision history is read from Google Docs and processed entirely within your browser. Nothing is stored on PaperTrail Academic's servers. Inspect includes the 📊 Process View report — a printable, observational summary of how a document was assembled (sessions, paste activity, struggle moments, and research-cited writing-process metrics). Process View runs entirely client-side: no document text is transmitted, no AI is involved, and no data is sent to any server. The form fields on the printed report (Student, Assignment, Course, Teacher) are filled in by the teacher in the browser before printing and are never transmitted to PaperTrail Academic.
Inspect and Process View transmit nothing. All revision data, paste analysis, struggle-moment detection, writing-process metrics, and report rendering happen inside your browser. There is no server-side component to any Inspect feature.
🔍 StyleMatch™ — Requires an account. All stylometric analysis is performed locally on your device using JavaScript. The text you paste into the StyleMatch panel is never transmitted to PaperTrail Academic or any third party — this is a design choice, not just a policy. Once you close the sidebar or navigate away, the text is cleared from memory.
StyleMatch text never leaves your browser. There is no server-side component to StyleMatch analysis.
🔬 Verify — Requires an account and PaperTrail Tokens. Verify offers four report types: Verify Submitted (analyses a single document for internal consistency), Verify Compare (compares the submitted work against a controlled writing sample), Verify Citations (checks each citation in the essay against reachable source text located via live web search — see the Anthropic entry above for how searches work), and Verify Data & Methods (extracts the statistics a document reports via the Anthropic API and recomputes them deterministically on PaperTrail's backend — no web search is used). Verify is the only Chrome extension feature that transmits essay text. When you run a Verify report, the submitted text is sent over HTTPS to PaperTrail Academic's secure backend, forwarded to the Anthropic API for analysis, and returned as a structured report saved to your account. The full essay text is not retained by PaperTrail Academic after the report is generated. Only report metadata (scores, ratings, timestamps, and any label you assigned) is stored. If your institution requires it, you should anonymize any student-identifying information before submitting text through Verify.
🎙️ Oral Defense — Requires a teacher account and PaperTrail Tokens. Oral Defense is the one PaperTrail tool where a student interacts with the service directly: the teacher sends the student a private, unguessable link, and the student records short spoken answers in the browser — no student account, login, or app is required. To operate a defense, PaperTrail stores: the essay text and curated questions, the student's name and email address (entered by the teacher), the student's audio recordings, their transcripts, and basic session-integrity facts — when each question was revealed and answered, how far into a recording speech begins, and whether the recording page reported tab switches or use of copy while a question was open (the student is told this on the recording page). These facts are presented to the teacher as plain statements, never as scores or verdicts. Recordings are transcribed by Deepgram, Inc., questions are read aloud using Deepgram text-to-speech, and the ownership report is generated via the Anthropic API — none of this data is used for model training under those providers' commercial terms. Audio recordings are permanently deleted when the teacher exports the report, or automatically after 30 days (the teacher receives a warning email first). The report and transcripts are retained for 90 days, then purged. Only the teacher who created the defense can access its sessions, audio, or reports.
Account data — Retained for as long as your account is active. When you delete your account, your name, email address, subscription status, and PaperTrail Token balance are permanently deleted from PaperTrail Academic's database. Account deletion is available from within the extension settings.
Verify report metadata — Retained until you delete the report or delete your account.
Verify essay text — Not retained by PaperTrail Academic after report generation. Anthropic's retention period is governed by their own privacy policy.
Process View reports — Not retained on PaperTrail Academic's servers at all. Reports are rendered in your browser and may be printed or saved as a PDF locally; nothing is sent to or stored on any server.
Local browser storage — Cleared when you sign out of the extension or uninstall it.
All data transmitted between the extension and PaperTrail Academic's backend is encrypted in transit using HTTPS/TLS. Account data stored on Supabase is encrypted at rest. Authentication tokens are stored using Chrome's extension storage, which is isolated from websites and other extensions.
PaperTrail Academic is operated by a single developer. Access to the backend database is restricted to that developer. No employees or contractors have routine access to user data.
Despite these measures, no system can guarantee absolute security. If you become aware of a security concern, please contact hello@papertrailacademic.com.
You have the right to access, correct, or delete the personal data PaperTrail Academic holds about you. Specifically:
Delete your account — You can delete your account at any time from within the extension settings (Settings → Delete Account). This permanently removes your name, email, subscription status, PaperTrail Token balance, and all stored report metadata. Deletion is immediate and cannot be reversed.
Access or correct your data — To request a copy of the data PaperTrail Academic holds about you, or to correct inaccurate information, email hello@papertrailacademic.com.
Cancel your subscription — You can cancel your StyleMatch subscription at any time via the billing portal linked within the extension. Cancellation stops future billing; access continues until the end of the current billing period.
Users in the EU, UK, or California may have additional rights under GDPR, UK GDPR, or CCPA respectively. PaperTrail Academic will honor all valid requests regardless of your location.
PaperTrail requests only the permissions necessary for its described functionality:
activeTab and tabs — Required to inject the revision analysis tool into the active Google Docs page, open the playback window in a new tab, and detect when the user is on a Google Docs or Google Classroom page.
webNavigation — Required to detect when a teacher navigates to a Google Docs page so the extension can activate automatically.
identity — Required to authenticate teachers via Google Sign-In for StyleMatch and Verify features.
storage and unlimitedStorage — Required to hold revision data for large documents (which can contain tens of thousands of revision entries) and to cache login session data locally. Revision data is stored locally and cleared when the extension reloads or the browser session ends.
Host permissions for docs.google.com and classroom.google.com — Required to operate on Google Docs and Google Classroom pages.
Host permission for ktzrdhiqhidexunucuqp.supabase.co — Required to communicate with PaperTrail Academic's secure backend (Supabase) for account authentication, subscription status checks, and Verify report generation. This connection is only used when you are signed in and actively using StyleMatch or Verify features.
PaperTrail Academic's use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Specifically: data accessed via Google APIs is used only to provide the features described in this policy and in the extension's Chrome Web Store listing. It is not used for advertising, it is not transferred to third parties except as described above (and only as necessary to provide the service), and it is not used to train AI models. No human at PaperTrail Academic reads user data obtained via Google APIs except as required to investigate a security or abuse concern, or as required by law.
PaperTrail Write (write.papertrailacademic.com) is a separate web application for controlled classroom writing sessions. It is not a Chrome extension. The following describes how it handles data.
Teacher accounts — Teachers create accounts using email and password or Google Sign-In. Google Sign-In uses the standard OAuth 2.0 flow and requests only basic profile information (name and email address). PaperTrail Write does not request access to Google Drive at sign-in.
Google Drive — source document upload — When a teacher chooses to attach a source document from Google Drive, PaperTrail Write requests read-only access (drive.readonly) to allow the teacher to select a file using the Google Picker. Only the selected file is accessed. Its contents are downloaded to the teacher's browser and uploaded to PaperTrail Write's secure storage (Supabase, hosted on AWS). PaperTrail Write does not browse, index, or retain access to any other files in the teacher's Drive.
Student writing data — Students join sessions using a code provided by their teacher. No student account is created. Student-entered text, word counts, and writing process signals (such as paste events and time away) are stored transiently in PaperTrail Write's secure backend for the duration of the session.
PaperTrail Write is designed as a transit system, not a data vault. After a session ends, the teacher downloads a session report. Student submission data is then purged from PaperTrail's servers. The teacher is the data custodian — they hold the report, not PaperTrail.
Untimed sessions are purged after 30 days. Timed sessions are purged after 7 days. Ended sessions are purged within 24 hours of the session ending. These purges are automatic and cannot be reversed.
PaperTrail Write does not sell, share, or transmit student data to any third party. It does not use student writing for any purpose other than displaying it to the assigned teacher. It does not use student data to train any AI model.
PaperTrail respects the access permissions that Google enforces on all documents. It can only read revision history that the logged-in teacher already has permission to view. It does not access any student data beyond what is visible in the document's standard revision history.
Because Inspect (including Process View) and StyleMatch process all data locally without transmission, they do not raise data governance concerns beyond those of Google Docs itself. For Verify, see above. For PaperTrail Write, see above.
Schools and IT coordinators with compliance questions should review our For Schools page, which covers FERPA, PIPEDA, and GDPR considerations in plain language.
PaperTrail does not knowingly collect any information from minors beyond what is necessary to operate a teacher-assigned writing session. In PaperTrail Write, students enter only their name and their written work — no email address, no account, and no personal identifiers are required. Session data is purged automatically after the session ends. In Oral Defense, a student records spoken answers at a private link their teacher sends — no account or email is required from the student, and the recordings are deleted when the teacher exports the report or after 30 days. Beyond Oral Defense and Write sessions, the Chrome extension is designed exclusively for use by educators and does not interact with students at all.
If PaperTrail's data practices change — for example, if new features involve data transmission — this policy will be updated and the date at the top of the page will reflect the change. Material changes will also be communicated to registered users by email before taking effect.
Questions about this privacy policy or how PaperTrail handles data can be directed to hello@papertrailacademic.com.
For school and institutional inquiries — including DPA requests and compliance questions — see For Schools or email hello@papertrailacademic.com with "Privacy Question" in the subject line.