Privacy Policy

ScholarQuestor is a personal command center for workstreams, tasks, notes, and cross-linked sources, operated by Dontscroll Agency (“ScholarQuestor,” “we,” or “us”) at scholarquestor.com. This policy explains what information we collect when you use ScholarQuestor, how we use it, and the choices you have.

Account information. When you sign up, we collect your email address and a securely hashed password. Every person creates their own account with an email address and password; we do not offer sign-in through Google or any other third-party identity provider.

Content you create. Workstreams, tasks, notes, events, categories, and any other content you add to a project — stored so ScholarQuestor can display it back to you and anyone else you invite into that project.

Google Calendar (optional). If you connect a Google Calendar from Project Settings, we request access to read and change events (calendar.events) and to list your calendars (calendar.readonly) on the Google account you authorize. We store an OAuth refresh token and mirror event details (title, time, location, description, status) into ScholarQuestor so they can appear alongside your tasks. When you create, edit or delete an event in ScholarQuestor, we make the same change on the one calendar you chose to connect, and nothing else on it or on your other calendars is changed. You can disconnect at any time from Project Settings, or revoke access from your Google account.

Zotero library (optional). If you connect a Zotero account from Project Settings, we store the API key you provide and use it to mirror your library's item metadata (titles, authors, item type, URL, collection) intoScholarQuestor, so sources can be referenced from your notes.

Reminder contact details (optional). If you enable reminders, we store the digest email address you provide, used only to send the reminders you configure.

Notification token (optional, iPhone app). If you turn on notifications in the iPhone app, we store the token Apple gives that phone so we can send you task and event reminders. It is removed when you turn notifications off, when you sign out, or when you delete your account.

Offline copy. So you can read your work without a connection, the app keeps a copy of your projects, tasks, notes, outputs, events and library in its own private storage on the phone. It is excluded from device backups, refreshed while you use the app, and deleted when you sign out.

Siri and Shortcuts. If you ask Siri to add a task or a note, Apple handles your voice under its own privacy terms. ScholarQuestor receives only the text you gave it, shows it to you, and saves it when you press Save.

Share sheet. When you share a page, link, DOI or PDF to ScholarQuestor, the app sends the link or DOI (for a PDF, the DOI or title found in it — not the file) to us to look up its details and add it to the Zotero library of the project you choose. It signs in with a separate session for this phone, kept in the device's Keychain; signing out of the app or turning the Share sheet off in Account ends it.

Writing Tools. If you use Apple's Writing Tools on text in a note, Apple processes it on your device or on its Private Cloud Compute servers. It does not pass through ScholarQuestor, and it is separate from the optional AI features described above.

• To provide, maintain, and display the features of ScholarQuestor you use.
• To sync Google Calendar events and Zotero library items on the schedule you configure.
• To send task and event reminders you have opted into, by email.
• To generate optional AI note summaries and cross-note digests that you request.
• To maintain the security and reliability of the service.

We do not sell your information, and we do not use it for advertising.

ScholarQuestor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data retrieved through the Google Calendar API is used solely to display your own events inside your own ScholarQuestorprojects, is never shared with third parties, and is never used for advertising.

You can connect an AI assistant — such as Claude, ChatGPT or Gemini — to your ScholarQuestoraccount. Nothing is connected by default, and connecting requires you to sign in and approve a consent screen that states what access you are granting.

What a connected assistant can reach. It acts as you, with your permissions: every project you are a member of, including workstreams, tasks, notes, events, documents and library items, with permission to create, edit and delete. It cannot reach projects you do not belong to or any other person's account. Your stored integration credentials — your Google Calendar connection and your AI provider key — are never exposed to it, and a project's Zotero credential is available only to that project's owner.

Where your data goes. We do not send your content to an AI provider. The assistant requests it from ScholarQuestor when you ask it to, and whatever it retrieves is then handled by that provider under their own privacy policy and terms, not ours. Review those before connecting, and disconnect if you no longer want that access.

What we log. For each request an assistant makes we record your user ID, the operation name and a timestamp. We do not log the content of those requests — not your note text, task titles or search terms.

Revoking access. Account settings → AI configuration lists every connected assistant with a Disconnect button. Disconnecting revokes its access immediately and invalidates the tokens it holds.

ScholarQuestor is built on infrastructure and services that process data on our behalf, under their own privacy and security terms:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Google Calendar API — calendar sync, only for projects that connect a calendar.
• Zotero API — library sync, only for projects that connect a Zotero account.
• Resend — delivery of email digests, only if enabled.
• OpenAI — generates note summaries and digests, only when you agree to AI data sharing in the app and request one.
• Apple Push Notification service — delivers notifications to the iPhone app, only if you turn them on.

We retain your account and project data for as long as your account is active. Disconnecting Google Calendar or Zotero from Project Settings immediately deletes the stored credential; previously synced events and sources remain in your project unless you delete them yourself. You can delete your account at any time from Account settings in the app: this permanently removes the account and every project you solely own, with everything in it. Projects shared with other people stay with their remaining owners. If you cannot sign in, contact us using the details below and we will delete it for you.

Access to your projects is enforced by database-level row-level security, and third-party credentials (Google refresh tokens, Zotero API keys) are stored in tables that only server-side, service-role code can read — never exposed to the browser or to other project members.

ScholarQuestor is not directed at children under 13, and we do not knowingly collect their information.

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.

Questions about this policy or your data can be sent to support@scholarquestor.com.