Welcome to ResearchCollab.ai (“we,” “our,” “us”). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, https://researchcollab.ai/ (the “Website”). By using our Website, you agree to the terms outlined in this policy. If you do not agree, please do not use our services.

1. Information We Collect

We may collect and process the following types of information:

(a) Personal Information

• Name
• Email address
• Affiliation or organization
• Any information you provide when contacting us

(b) Non-Personal Information

• Browser type and version
• IP address
• Usage data, including pages visited and time spent on our site
• Cookies and tracking technologies

2. How We Use Your Information

We use the collected information for the following purposes:

• To provide, operate, and improve our services
• To communicate with you, including responding to inquiries
• To analyze Website usage and enhance user experience
• To comply with legal obligations

3. How We Share Your Information

We do not sell or rent your personal data. However, we may share information in the following cases:

• Service Providers: We may share data with trusted third-party service providers who assist in operating our Website.
• Legal Compliance: We may disclose information if required by law or to protect our legal rights.
• Business Transfers: In the event of a merger or acquisition, your information may be transferred as part of the business assets.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience. You can control cookies through your browser settings. Disabling cookies may impact Website functionality.

5. Data Security

We implement reasonable security measures to protect your information. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access, update, or delete your personal data
• Opt-out of marketing communications
• Restrict or object to data processing

To exercise your rights, please contact us at privacy@researchcollab.ai.

7. Third-Party Links

Our Website may contain links to third-party sites. We are not responsible for their privacy practices. Please review their privacy policies before providing any personal data.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

ResearchCollab.ai
support@researchcollab.ai
128 City Road London EC1V 2NX UNITED KINGDOM

Browser Extension Privacy

To facilitate the saving, annotation, organization, and AI-driven analysis of academic papers and scholarly web content for comprehensive personal and collaborative research.

1. Storage Justification

We use   the storage permission to securely save user authentication tokens, preferences, and extension settings locally in the browser. This allows users to remain signed in, retain their selected projects, and have a consistent experience across sessions. All sensitive data is stored only for the purpose of providing core extension functionality.

2. Tabs Justification

The tabs permission is required to access information about the currently active browser tab, such as its URL and title. This is essential for our bookmarking and note-taking features, which allow users to save and organize research resources from any web page. We also use it to listen for tab updates during authentication flows and to send messages between the background script and content scripts.

3. Identity Justification

The identity permission is used to facilitate secure user authentication, specifically for Google OAuth login. This enables users to sign in with their Google account and sync their bookmarks, notes, and research data with our backend. We only use this permission to initiate and complete the login process; no other identity data is accessed.

4. webRequest Justification

The webRequest permission is used to monitor and handle authentication-related web requests, such as OAuth redirects and token exchanges. This is necessary to securely complete the login process and ensure that authentication tokens are properly received and stored. We do not use this permission to monitor or collect any other browsing activity.

5. Host Permission Justification

We request host permissions (such as https://*/* and our app domains) so the extension can:

• Inject content scripts on our web app and authentication domains to support login and data sync.
• Allow users to bookmark or annotate any web page they visit, but only when they actively use the extension.
• Handle OAuth authentication flows with Google and our backend.

We do not access or modify content on any site except when the user interacts with the extension for its intended research and bookmarking features.

ActiveTab Justification

The activeTab permission is required to temporarily access the currently active browser tab when the user interacts with our extension. This permission allows us to:

1. Read the current page’s URL and title – Essential for our bookmarking feature, so users can save the exact page they’re viewing with proper metadata.
2. Extract page content for note-taking – When users create notes, we need to access the current page’s content to enable features like highlighting and content extraction.
3. Enable context-aware features – The extension needs to know which page the user is on to provide relevant functionality and ensure features work correctly.

Important: This permission only grants temporary access to the tab when the user explicitly interacts with the extension (clicks the extension icon or uses extension features). We do not continuously monitor or access tabs without user interaction. The permission is automatically revoked when the user navigates away from the page or closes the tab.

This is a standard permission for extensions that need to interact with web page content and is used responsibly only for the core bookmarking and note-taking features of our research collaboration tool.

For remote code

Our extension does not use any remote code execution. All code is bundled locally within the extension package. Specifically:

1. No eval() or new Function() calls – We do not dynamically execute any code strings.
2. No dynamic script loading – We do not load scripts from external sources using createElement(‘script’) or similar methods.
3. No dynamic imports from external URLs – All imports are from local files within the extension package.
4. Static imports only – The only import in our background script (import “…/public/auth-worker.js”) is a local file that’s part of our extension bundle.
5. No code injection – We do not inject or execute any code received from external sources.

What we do use:

• Standard API calls to our backend services for data exchange
• OAuth authentication flows (which are standard web requests, not code execution)
• Local storage and extension APIs for functionality

All functionality is implemented using static, locally bundled code that is reviewed and included in the extension package. No code is downloaded or executed from external sources at runtime.