Privacy

Paper Formatter is built around specific privacy commitments. None of them claim end-to-end privacy — that's not something any third-party tool can deliver. They describe what this service does and doesn't do, so you can decide whether the tradeoff fits your manuscript.

What this service does

• Scrubs author names, firm names, and acknowledgement lines from your manuscript before any text is sent to Anthropic's Claude API.
• Returns up to four files per run: a reformatted .docx, a separate anonymized .docx with the title page stripped (for double-blind review), and a copy-editing report in HTML and Word.
• All output files exist only for the duration of your browser session and are deleted when the session ends.

What this service does not do

• No database of past manuscripts, no history, no saved drafts.
• No user accounts beyond a simple PIN; no separate password.
• No analytics or behavioural tracking added by us.
• No rewriting of your prose — only formatting, citations, references, and copy-editing notes. Authorial judgment stays with you.

What happens at Anthropic

• The scrubbed manuscript is sent to Claude for processing.
• Anthropic retains API content for approximately 30 days for trust-and-safety review and does not use API content to train their models.
• During that window the data exists on Anthropic's servers under their access controls.

About hosting

• The Shiny application runs on shinyapps.io, operated by Posit.
• This marketing site is hosted on Cloudflare Pages.
• Both keep standard operational logs (IP, timestamp, request) as part of normal hosting. We don't control these logs.
• Neither, by default, injects behavioural tracking into deployed apps.

Legal jurisdiction (CLOUD Act)

• Anthropic, Posit, Cloudflare, Google, and Stripe are US-headquartered companies. The US CLOUD Act allows US authorities to compel disclosure from US companies regardless of where the data is physically stored — including Canadian servers.
• Low probability but a real category, and it applies to any US cloud provider.

Embargo and NDA — the contractual layer

• Some publishers prohibit running an accepted (under-embargo) manuscript through any third-party AI service before publication. Check your acceptance letter.
• NDAs covering corporate data typically forbid sharing with any third party — Anthropic counts as a third party even if they delete in 30 days and don't train on your data.
• The breach happens the moment the data crosses to the third party, regardless of what the third party then does with it.

What scrubbing does and does not catch

• Catches: author names, firm names, acknowledgement-style lines, emails, ORCID IDs.
• Does not catch: distinctive findings, methodology details, unique phrasings, or table data that could re-identify the manuscript on its own.
• For most copy-editing this is fine. For high-sensitivity work it is not sufficient on its own.

Email handling for paid accounts

• When you purchase a PIN, your email is stored as the contact reference for that PIN. We use it to deliver the PIN, identify which account a run belongs to, and email you about account issues if needed.
• Your email is not stored with a name or a password. Your PIN is the only credential.
• Your email is not sold, passed, exchanged, or shared with any other party for marketing, analytics, or any other purpose.

Where PIN and email records live

• PINs and contact emails are kept in a private Google Sheet accessible only to the service administrator via a service account.
• Like Anthropic, Posit, Cloudflare, and Stripe (above), Google is a US-headquartered company subject to the same legal jurisdiction considerations described earlier on this page.
• Standard Google access controls apply. We do not add additional safeguards beyond those.

Payment processing (Stripe)

• Payment is processed by Stripe. We never see your full credit-card details — Stripe handles the entire payment flow.
• Stripe collects billing information per their own privacy policy: stripe.com/privacy.
• We receive only the email address you supply at checkout (used to deliver your PIN) and a confirmation that the charge succeeded.

Last updated 2026-05-06.