Last updated: October 2024
Scholarly stores the research queries you submit, the model outputs they produce, and the configuration of your LLM providers — including API keys — in a server-side database. Search state in progress is also kept in your browser's session storage so results survive navigation.
When you run a review, your query is forwarded to the LLM providers you have configured (e.g. DeepSeek, OpenRouter, Groq) over their own APIs. Each provider receives your research question and responds under its own privacy policy — we recommend reviewing the data policies of any provider whose keys you configure.
Your API keys are only ever sent to the provider they belong to, as authentication for your requests. They are never included in API responses to other users, and are masked (first/last four characters only) wherever the interface displays them.
Registered users sign in with an email address and password. Passwords are stored only as salted hashes — never in plaintext — and password reset links are sent by email (or surfaced to an administrator when email delivery isn't configured). Anonymous guests can run a small number of searches without an account.
When no provider keys are configured, the app returns clearly labeled sample output. No query is sent to any third party in demo mode.
Administrators can delete provider keys at any time from the Settings page. To remove stored run history or rotate credentials, contact your deployment administrator.
Privacy questions can be sent via the contact page.