Privacy Policy

What The Clerk is

The Clerk sits in a task pane beside your document in Microsoft Word. It reads the passage you select and suggests the smallest edit that fixes a problem, in plain language. Nothing in your document changes until you choose to apply an edit.

Text you send for a check

Text is sent only when you start a check, and only the text that check needs: usually the passage you selected (or pasted, in a browser), with any study context, manuscript profile or reviewer comment you have set. The Clerk never scans your document on its own. Section sweeps and whole-document scans run only when you start them.

The text goes to this site's server, which passes it to the AI provider of the model you chose (or the default model, if you did not choose one). Detector check sends the selected text to Pangram. Find reference resolves a pasted reference on OpenAlex, a free public source. Ground this claim sends short search queries, written from the claim you selected, to OpenAlex and Semantic Scholar, both free public sources.

Deep Research works at the journal level: your manuscript is never sent to it. Find gaps in this journal sends a short study summary from your manuscript profile, never the manuscript itself.

What this site stores, and what it does not

This site's server does not store your text.

When a request fails, it logs why. The Clerk's own code never writes your text, or a model's reply to it, to those logs, and provider error messages are cleaned of anything that looks like a key before they are logged or shown.

Manuscript profiles, the reviewer comment bank and your check history are kept in your browser's storage on your device, not on this site's server, unless you use Data backup, which leaves your keys and access code out. History is on by default; turn it off under Settings → Privacy.

Beyond the usage aggregates and pilot applications described below, this site's server keeps:

• Find gaps in this journal. While a gap search runs, and for a time after it ends so the pane can collect the result, the job keeps the study summary sent from your manuscript profile (the study title, objective, theoretical framework and key variables, and the profile's reading of your manuscript, up to 4,000 characters; never the manuscript itself), the papers gathered for it, and the gap report. These are then removed. The job's record (the journal, its status, times and estimated cost, and the pane's install identifier) is kept for longer.
• Deep Research for a journal's requirements. The job keeps the journal's name, publisher, website and article type, the journal requirements already in your profile, and the research report, and removes them in the same way.
• Saved journal research. The requirements a Deep Research run finds for a journal are saved under the journal's name and reused for anyone who asks about the same journal while they are fresh. They hold nothing from your manuscript. The site's code sets no end date for them.
• A Deep Research log. For each run: the time, the pane's install identifier, a hash of the code when a code started it, the journal, the provider and the estimated cost. No text.
• Code end dates. Under each code's hash, the date it stops being accepted. The site's code sets no end date for these records.
• Daily-limit counters. For each day, counts of requests (and, for detector scans, words) under a one-way hash of the code or of the pane's install identifier, and for the whole site. Each day's counters expire two days after their last change.

The pane's install identifier is a random identifier the pane makes for itself. It is not your name or your email.

How long Deep Research and Find gaps jobs, what they keep, and the Deep Research log are kept: To be confirmed by the publisher.

What each provider keeps

What each AI provider, or Pangram, keeps is governed by that provider's own data policy. This site does not control provider retention.

Providers in use for The Clerk:

• OpenAI: AI models
• Anthropic: AI models
• Google Gemini: AI models
• DeepSeek: AI models
• Moonshot: AI models
• Pangram: detection (Detector check)
• OpenAlex: reference and literature searches (Find reference, Ground this claim, journal recommendations and benchmarks, and Find gaps in this journal), a free public source
• Semantic Scholar: literature search for Ground this claim (short search queries written from the claim you selected), a free public source

A link to each provider's data policy, and the provider list at publication: To be confirmed by the publisher.

Your own API keys

Your own API keys, under Settings → Your own API keys, are kept in this browser's storage on your device. They are not written to your document, and Data backup files leave them out.

Your key travels only with your own requests to this site's /api/clerk/* routes, in one request header. For that request only, a provider call uses your key instead of the site's. When the request ends, the key is cleared from the server's memory. Keys are never written to disk, cached beyond the request, or logged.

This site's own keys live in the server's environment and are never sent to your browser. Deep Research always uses this site's own key, never yours. Your key is only as private as your device and your HTTPS connection to this site.

Access codes and daily limits

Access codes and daily limits exist to protect the site's own keys. When the site uses access codes, a request on its keys needs a valid code; each pilot member has their own. Requests on your own keys never need one.

A code lasts 30 days from the first time this site accepts it. To know when, the site keeps that end date under the code's hash, never the code itself.

Daily limits apply per person and across the whole site, to AI requests, detector scans and the site's other paid services. With a code, your use is counted under the code's hash, never the code itself. The counters hold numbers only, never text or keys. If the counters cannot be checked, requests on the site's keys are refused rather than run without limits.

A code is a shared secret, not a sign-in. The Clerk has no user accounts. Your access code, under Settings → Access code, is kept in this browser only, and Data backup files leave it out.

Usage aggregates

On the hosted site the server also adds up its use by day, for the person who runs it: how many requests of each kind of check, the model chosen or that ran, the provider, an estimated cost, the detector's band, whether a request succeeded, was refused or failed, and whether the site's keys or your own paid. Requests on your own keys are added up too, as numbers only. Under a code they are kept under a one-way reference, never the code. No text, prompt, reply, finding or key is part of them.

The dashboard shows 90 days, and the store deletes each day a day later. With your code you can see your own figures, and only yours, on the usage page (/clerk/usage). Opening that page with a code counts as using it: if the code has not been used before, its 30 days start then, as they would in The Clerk.

Pilot applications

If you ask for a pilot place with the form on the pilot page, what you enter there (name, email, institution, field and what you would use The Clerk for) is kept for the person who runs this site to read and answer by email, and for nothing else. Your internet address is not stored; a one-way hash of it is counted for an hour to limit repeated requests.

Detector scores

A detector score is a signal for your own review, never proof of how a text was written. Detector check shows how a passage reads to Pangram, so you can decide what to revise in your own voice. It is not a verdict on who wrote the text, and it should not be used as one.

Contact and changes

For privacy questions, contact info@empiricquest.com.

How to ask for access to, correction of, or deletion of your data: To be confirmed by the publisher.

Changes to this policy will be posted on this page, with the last updated date changed.