Parallax Privacy Policy

Parallax is operated by Chenzhan Shang, an individual (referred to as "Parallax", "we" or "us"). We take your personal information seriously. This Policy explains what we collect, how we use and protect it, and your rights. Please read it carefully, particularly the provisions in bold.

1. Scope

1.1 This Policy covers our processing of personal information when you use Parallax's websites, clients and APIs (the "Service"). Read it together with the Parallax Terms of Service. This Policy prevails for personal-information matters if the two documents conflict.

1.2 This Policy does not govern third parties' own privacy practices, such as those of arXiv, AI or email providers. When you visit their services or pages, their own policies apply.

2. Information We Collect

2.1 Information you provide

• Account information: Email address for registration, login verification, security notices and service messages; username; password (we store only an irreversible password hash, not plaintext); language preference; and an optional avatar.
• User Content: Conversation messages, notes, pasted or uploaded text, images and attachments, collection and view names and settings, workspace goals, scheduled-task instructions and related settings. This content may contain personal information you choose to provide.
• Third-party sign-in information: If the Service offers and you choose Google or GitHub sign-in or account linking, we receive the provider's user identifier, email and verification status, and account display identifier to identify your account and support sign-in and linking. The authorization process creates short-lived verification records. We do not persist the provider access or refresh tokens obtained during that sign-in process. You may unlink an account in account settings subject to security verification and revoke authorization through the provider.
• Support and complaints: Contact email, name, subject, message body, attachments and handling records you provide through email, support tickets or rights notices. Service email is sent and received through Resend. Authorized administrators may access these records to handle inquiries, complaints and troubleshooting.
• Field and language requests: If you suggest a research field or language through the request form on our website, we collect your selections, any text you enter and, if you choose to provide it, an email address. We use that email address only to notify you when the field or language you requested becomes available.

2.2 Information generated through use

• Usage records: Conversation history, discussion tasks, note and collection actions, searches and reading activity.
• Task outputs and workspace records: AI replies, reports, task working-directory files, and workspace observations, memory, push messages, execution status and related semantic vectors, used to save results, retrieve relevant content and continue tasks you have enabled.
• Usage accounting: Credit grants, balances, reservations and consumption, quota usage and API-call statistics, used for metering, quotas and abuse prevention.
• Subscription records: Your plan, Subscription Periods, renewal and cancellation status, plan changes, and the credits issued or withdrawn in connection with each payment.
• Technical logs: Errors and task-execution records, including identifiers of processed papers, used for troubleshooting and security auditing.

2.3 Device and visit information

• Network requests generate information such as IP address, browser and operating-system type, access times and page interactions. Our first-party visit statistics use random visitor and session identifiers, masked IP addresses and available approximate location information. The identifiers are stored in your browser. Signed-in statistics may be associated with your account for feature analysis, troubleshooting and abuse prevention and are not fully anonymous. We do not integrate third-party advertising or analytics trackers.

2.4 Payments

• Payments for Paid Plans (as defined in the Terms of Service) are processed by Waffo.com Limited ("Waffo"), which acts as merchant of record. You enter card numbers, wallet or WeChat Pay details and billing information directly with Waffo. We do not receive or store your full card number, security code or payment credentials.
• To start a checkout, we send Waffo your internal account identifier, the email address on your account (to prefill checkout) and the selected plan.
• Waffo sends us transaction information needed to provide and account for your purchase, such as order, payment, subscription and refund identifiers, the plan purchased, amounts, currency, taxes, payment status, payment method type, Subscription Period dates, and dispute or chargeback status. Payment notifications may also include the email address and billing details you gave Waffo, such as your country.
• Waffo processes payment information under its own Privacy Policy and Buyer Terms.

3. How We Use Information

3.1 We use information for the following purposes:

• Providing and maintaining the Service: Registration, sign-in and account linking; saving User Content and task results; running discussion and background tasks you initiate or enable; generating AI replies; and vectorizing and retrieving relevant content.
• Usage and quotas: Measuring use and managing credits and allowances.
• Billing: Processing purchases, renewals, plan changes, cancellations, refunds and chargebacks; issuing and withdrawing credits; reconciling payments with Waffo; and keeping accounting and tax records.
• Communication: Account security, service changes, subscribed notifications, product update emails under section 3.4, support inquiries, tickets and rights complaints.
• Security and abuse prevention: Identity verification, quota enforcement, abuse detection and audit records.
• Product improvement: Analyzing feature use and operating conditions to improve the product. Account-associated statistics and pseudonymized data remain protected under this Policy; published aggregates must meet section 5.2. Without your separate consent, we will not use your conversations, User Content or the task outputs generated for you, such as reports and other Research Artifacts, to train our own models, and we will not make your task outputs available to other users or publish them.

3.2 Processing grounds: Depending on the activity and applicable law, we process personal information based on necessity to perform our contract, including providing the Service, managing quotas and processing purchases; legal obligations, such as accounting and tax record-keeping; your consent; or legitimate interests in security and abuse prevention where that basis is recognized by applicable law. We do not rely on legitimate interests as a standalone basis under mainland China's Personal Information Protection Law. For consent-based processing, you may withdraw consent under section 10. Withdrawal does not affect processing lawfully performed before withdrawal.

3.3 We do not sell your personal information or provide it to third parties for their direct marketing.

3.4 Product update emails: We may occasionally email registered users whose addresses are verified about Parallax's own product updates and research reports. We do not send third-party advertising in these emails. Where mainland China law applies, we rely on the consent you give when you register after being told about these emails; elsewhere we rely on consent or, where applicable law permits, our legitimate interest in telling existing users about our own similar services. Every such email has a one-click unsubscribe link, and you can turn them off in account settings at any time. Unsubscribing does not stop necessary service emails. We stop sending these emails to an address that hard-bounces or reports one as spam, and we keep a record of your subscription choices as evidence of them until your account is deleted.

4. AI Processing and Related Third-Party Services

4.1 The Service uses language models, vectorization and related content-analysis services. During conversations, discussion or background tasks you have enabled, the context needed for a call may be sent to the relevant provider to generate replies, vectors or other results. This may include messages and conversation history, attachment content, workspace goals and relevant observations or memory, working-directory files, and paper text, including original sections temporarily obtained under section 5.3 of the Terms of Service. If external search or similar features are enabled, queries and necessary context may also be sent to the corresponding service. The information sent depends on the feature and the task's needs.

4.2 The Service uses DeepSeek, TypeSafe, Perplexity and Resend through their official APIs with standard accounts. Provider retention, training use and processing locations depend on the applicable terms, settings and data-processing arrangements. Our commitment concerning training our own models does not mean that every third party refrains from retaining data or using it for training. Deletion by Parallax does not mean a third party has simultaneously deleted its copies. These providers, their purposes and relevant data categories are listed in section 5.1; see section 11 for international processing.

TypeSafe's published policy states that it does not train or fine-tune models on customer inputs. Perplexity's published zero-retention and no-training statement specifically covers its Chat Completions API; we do not extend that statement to its embedding API or other providers. The linked provider documents explain the scope of their commitments and any retained service or billing information.

4.3 Workspace background processing and scheduled tasks may continue while you are offline under the settings you have enabled, processing related content, calling these services and consuming usage allowances. You may pause workspace background processing or disable scheduled tasks. Existing observations or memory may be cleared through the corresponding feature; other deletion requests may be made under section 10. Pausing or disabling does not reverse completed processing or third-party requests already sent.

5. Sharing Information

5.1 We provide necessary information to the following recipients:

• DeepSeek: Generates AI replies and analyzes content using messages and the task context described in section 4.1. See its Open Platform Terms of Service.
• TypeSafe (Jev): Provides content classification and judgments using relevant paper content, classification criteria, questions and task context. See its Privacy Policy and Data Processing Addendum.
• Perplexity: Provides text embeddings and external search using the text selected for vectorization, search queries and any context included in those queries. See its API Privacy and Security documentation.
• Resend: Sends and receives account, service, support and product update emails, processing relevant addresses, subjects, bodies, attachments and delivery information. See its Privacy Policy and Data Processing Addendum.
• Alibaba Cloud: Provides cloud hosting, database and file storage, and disk backups, which may contain account information, User Content and operational records stored by the Service. We purchase these services through aliyun.com and use its Hong Kong region. See the aliyun.com Legal Statement and Privacy Policy and the terms applicable to the cloud services used.
• Waffo: Processes payments for Paid Plans as merchant of record, calculates and collects taxes, issues invoices, handles refunds and chargebacks, and sends order and subscription emails, as described in section 2.4. See Waffo's Privacy Policy.
• arXiv: Supplies public paper metadata and source materials. Requests may include paper identifiers, source URLs and metadata lookup parameters. This integration retrieves scholarly records and paper materials rather than processing general conversations. See arXiv's API Terms of Use.
• Sign-in providers, when offered and selected: Google or GitHub participates in authorization and identity verification as described in section 2.1.
• Legal authorities: Where required by law, regulations, regulatory requests, judicial proceedings or administrative enforcement.
• Parties to a rights complaint: Where required by the applicable notice or counter-notice procedure, we forward the relevant statement, supporting information and necessary contact details to the complainant or affected content provider. See section 10 of the Terms of Service.
• Business successors: In a merger, acquisition or asset transfer, subject to a requirement that the successor continue to follow this Policy.

The information shared depends on the feature used. Listing a provider does not mean that every provider receives all of your information; we send the information needed for the relevant function.

5.2 We may publish anonymized aggregate statistics that cannot identify you or be restored to identify you, such as feature-use trends. Removing a name or email, or substituting a random identifier, does not by itself make data anonymous. Pseudonymized data remains protected under this Policy.

6. Cookies and Similar Technologies

6.1 We use cookies, browser local storage and similar technologies to maintain sessions, save language preferences and store first-party visitor/session identifiers. Analytics identifiers support Service usage statistics and may be linked to an account after sign-in; see section 2.3. We currently do not integrate third-party advertising, marketing or analytics cookies.

6.2 You may manage or delete browser storage through your browser settings. This may affect features such as staying signed in. Deleting browser analytics identifiers does not stop subsequent statistics collection, and the Service currently has no separate in-app analytics switch. Our first-party analytics does not respond to "Do Not Track" signals and is not used for cross-site tracking. Contact us under section 10 about restriction-of-processing or consent-withdrawal requests.

7. Retention and Deletion

7.1 Principle: We retain information only for as long as necessary for the purposes in this Policy, then delete or anonymize it, subject to legally required retention, such as applicable audit or transaction records.

7.2 Deleting assets: Deleted conversations, notes, reports and collections cease to appear in normal views and enter a recovery period, currently 30 days by default. Periodic cleanup removes them after that period; physical deletion may occur after the period expires. Task working-directory files are removed with their conversation. Deleting a workspace removes it from normal lists and stops future background scheduling, but does not automatically delete its associated conversations, notes or collections; delete those assets separately. The workspace's own historical records are not subject to the same automatic cleanup deadline. You may request further deletion under section 10.

7.3 Closing an account: Sessions and login credentials become invalid, and account details such as email, original username, password hash and avatar are cleared or replaced. Private conversations, notes, reports, collections and workspaces become unavailable to you and are removed by periodic cleanup after the recovery period. Scheduled tasks, push records and related information also enter the account-closure cleanup process. Support tickets, public articles, support correspondence, payment and billing records (section 7.6) and necessary security or audit records may be retained for their respective purposes, along with internal account identifiers and some associated information. Clearing account details does not mean that all historical records have been deleted or fully anonymized. You may request deletion of records that still contain personal information under section 10; we will explain the outcome and applicable exceptions.

7.4 Temporary paper copies: Temporary original text of restricted-license papers is isolated by user and has a total validity period of no more than twenty-four (24) hours from writing the copy. After expiry, the system stops reading from it, and periodic background cleanup deletes it; physical deletion does not occur immediately when a single task ends. See section 5.3 of the Terms of Service for these limits, and section 4.2 here for third-party retention.

7.5 Separately retained records: Local support email threads and attachments enter periodic cleanup after 365 days without activity since the last message. AI-call traces and usage details are currently retained for 90 days by default; first-party visit statistics and email-sending audit records for 365 days by default. Closing an account does not immediately erase these records. Support tickets, public articles and records needed for disputes, security or legal compliance are handled according to their purposes and necessary retention periods, rather than the private-asset recovery period.

7.6 Payment and billing records: Subscription, payment, refund, chargeback and credit-allocation records are kept for as long as needed for accounting, tax, refund and dispute handling, fraud prevention and other legal obligations. They are retained after you close your account, linked to an internal account identifier rather than your cleared account details. Waffo retains its own transaction records under its policies.

7.7 Attachments, backups and third-party copies: If an attachment is referenced by multiple retained records, deleting one reference does not immediately remove the underlying file. Disk backups are made daily and retained for 30 days. Separately, the production deployment process creates a database backup before an update and retains the ten most recent deployment backups; this is a count-based limit, not a 30-day deadline. Backup copies may therefore retain information after it has been deleted from the online database. These backup rules are separate from the recovery period in section 7.2, and deletion of online data does not mean all backups are erased at the same instant. Backup locations are addressed in section 11. Copies received by third-party providers follow their applicable arrangements. Contact us under section 10 about related requests.

7.8 Email requests: Contact us under section 13 about notification delivery, deletion of email records or emails received after account closure. Necessary service emails, including account verification, security notices and support replies, do not all offer an unsubscribe link; product update emails always do (section 3.4). Order, invoice and subscription emails are sent by Waffo.

8. Security

8.1 We use reasonable technical and organizational measures to protect information, including HTTPS/TLS transport encryption, one-way password hashing, role-based access controls, operation audit logs and task/quota abuse controls.

8.2 No system can guarantee absolute security. If a security incident affects your personal information, we will respond as required by applicable law and notify you by email or within the Service about the incident and relevant measures.

9. Children

9.1 The Service is not intended for children under 14, and we do not knowingly collect their personal information. Users aged 14 to 17 should use the Service with a parent or guardian's consent and exercise care when providing personal information.

9.2 If we discover that we have collected a child's information in error, we will delete it promptly. Parents or guardians may contact us using section 13.

10. Your Rights and Requests

10.1 To the extent provided by applicable law, you may:

• Access and export your account information and User Content.
• Correct inaccurate information, including through available account settings.
• Delete assets through supported self-service features, or close your account in account settings. Submit other deletion requests through section 10.2. See section 7 for retention arrangements.
• Withdraw consent for consent-based processing, such as subscribed notifications and product update emails.
• Complain to us or a competent supervisory authority.

10.2 Use available self-service controls, or email support@parallax.ink for other requests. We may need to verify your identity to protect your information. We will handle requests without undue delay and provide a substantive response within 15 business days of receipt, or sooner where applicable law requires. If applicable law permits an extension, we will explain the reasons and provide the revised response deadline within the initial response period.

10.3 If you are dissatisfied with our response, you may complain to the personal-information or data-protection authority with jurisdiction.

11. International Processing

11.1 The Service uses Alibaba Cloud, and its primary data storage and backup storage region is Hong Kong, China. The providers listed in section 5.1 may process information in other countries or regions. DeepSeek's official API is provided by a company based in mainland China. Waffo is based in Hong Kong, China. TypeSafe and Resend describe processing in the United States; Perplexity's API documentation describes its language-model compute as hosted in North America. This does not establish the location of every API service or subprocessor. Provider processing locations and retention follow the arrangements applicable to the service used; see section 4.2. We may change our hosting provider or primary storage region in the future, including to the United States. Before such a change takes effect, we will update this Policy and notify you under section 12, and we will ask for any separate consent that applicable law requires.

11.2 For users in mainland China, storing personal information in Hong Kong or sending it to overseas providers may constitute an outbound transfer. The purposes, recipients and information categories are described in sections 3 to 5. We must provide any additional notice, obtain any separate consent and implement any other protection measures required by applicable law before the relevant processing. Requests concerning this processing may be made under section 10. This Policy does not replace a separately required consent.

12. Changes to This Policy

12.1 We may update this Policy and publish a new version. Material changes, such as changes to collection scope, recipients or your rights, will be notified within the Service or by email. Where renewed consent is required, we will ask you to confirm.

13. Contact

13.1 Operator: Chenzhan Shang, operating Parallax as an individual. 13.2 Privacy requests: support@parallax.ink 13.3 General inquiries, billing questions and rights complaints: support@parallax.ink. See section 10 of the Terms of Service for rights notices.