Skip to content

Privacy Policy

Draft — not yet effective. Prepared on September 16, 2026. Before publication, the site operator must confirm their public identity and privacy contact, the effective date, and the actual retention and consent arrangements. This draft does not certify GDPR compliance.

Scope and operator

This policy covers https://en.papernotes.org/, the English edition of AI Paper Notes (the “Site”).

  • Operator / data controller: Yang, an individual operating AI Paper Notes.
  • Privacy contact: [email protected]. Do not submit private information through public GitHub issues.
  • Effective date: September 16, 2026.

This policy explains the Site's own practices and identifies external services. Those services may also process information under their own privacy policies.

Information processed when you visit

The Site provides publicly accessible research notes. Browsing does not require a Site account. Loading pages involves requests to hosting, security, analytics, and other service providers. Depending on the service, these requests may include your IP address, browser and device information, requested URL, referring page, request time, and technical or security information.

Information you voluntarily include in a privacy request may be processed to respond to that request. Please provide only what is necessary and do not send passwords, payment information, or other sensitive information.

Hosting, delivery, and security

The Site is hosted using GitHub Pages and uses Cloudflare for delivery and security. These providers process technical request information to deliver pages, maintain availability, and detect abuse. Any security cookies or browser storage used by these services are separate from advertising preferences.

Audience measurement

The Site integrates Cloudflare Web Analytics to understand page usage and performance. Cloudflare describes this product as cookieless analytics. That does not mean that visiting the Site creates no network requests or that other services on the Site do not use cookies.

See Cloudflare Web Analytics and Cloudflare's privacy information.

Google advertising and cookies

The English edition integrates Google AdSense. Google and other advertising vendors may use cookies, local storage, identifiers, IP addresses, and information about visits to this and other websites to deliver and measure advertising, limit repetition, and prevent fraud. Where the required consent is obtained, this information may also be used to personalize advertisements.

Google's advertising cookies enable Google and its partners to serve ads based on visits to the Site and other websites. Declining personalized advertising does not necessarily eliminate all advertisements or all technical processing. Non-personalized advertising may still involve cookies or other storage for functions such as measurement or fraud prevention, subject to applicable consent requirements.

The applicable advertising-partner list and purpose-specific choices must be made available through the consent interface before consent-dependent advertising is deployed. Partner participation and processing depend on the actual advertising configuration and your choices.

For visitors in the European Economic Area, the United Kingdom, and Switzerland, Google's EU user consent policy requires disclosures and consent for cookies or local storage where legally required, and for the collection, sharing, and use of personal data for advertising personalization.

Implementation status: The consent interface and a persistent Privacy settings entry point have not yet been verified for this policy. They must be configured and tested before this draft is published as a description of an operational consent process. This page itself does not collect consent or block advertising requests.

The intended consent interface provides Consent, Do not consent, and Manage options. Visitors must be able to revisit their preferences and withdraw consent as easily as they give it. Withdrawal does not affect processing lawfully carried out before withdrawal.

You can also manage or delete cookies through your browser. Clearing cookies may remove saved preferences and cause a consent request to appear again. Browser controls and Google's advertising controls do not replace the Site's obligation to provide a working consent and withdrawal mechanism.

The Site's local search uses an index downloaded from the Site and searches it in your browser. Search terms can appear in the search-page URL and browser history; URLs may also reach infrastructure or analytics providers. Do not enter confidential information in search queries.

Some search controls open Bing. When you use those controls, your query is sent to Microsoft. See the Microsoft Privacy Statement.

Some pages load MathJax from cdnjs, a Cloudflare-operated CDN, to display mathematical notation. Loading that resource sends a request to the provider, including technical connection information.

Links to papers, repositories, and other websites take you to services operated by third parties. Their privacy practices apply when you visit them.

Where GDPR or comparable law applies, each processing activity needs an appropriate legal basis. Consent is required for advertising personalization and for cookies or similar storage where applicable law requires it. Delivery, security, and responding to requests may rely on other applicable legal grounds, including legitimate interests or legal obligations, depending on the activity. A legitimate-interest basis is not a substitute for consent where consent is required.

Information may be processed by the hosting, security, analytics, advertising, and external-resource providers described above. Some providers operate internationally and may process information outside your country. Their privacy notices describe their processing locations and applicable transfer safeguards.

Before publication: The operator must confirm the legal basis for each activity, the relevant recipients and transfer arrangements, and any controller-specific disclosures. This draft does not assert that a particular transfer mechanism applies to every provider.

Retention

Service-provider retention varies by purpose and is described in their privacy documentation. Browser cookies and stored preferences may remain until they expire or are deleted.

Before publication: The operator must specify the actual retention periods or criteria for information under their control, including privacy correspondence and any logs they retain. No fixed retention period is asserted in this draft.

Your rights and requests

Depending on your location and the applicable law, you may have rights to access, correct, delete, or receive a copy of personal data; restrict or object to processing; and withdraw consent. These rights may be subject to legal exceptions. You may also complain to your local data-protection authority.

Use the privacy contact listed above once it has been confirmed. Verification may be needed to protect your information, but requests should not include unnecessary sensitive documents. Requests about data controlled independently by Google, Cloudflare, GitHub, or Microsoft may also need to be directed to the relevant provider.

Changes to this policy

This policy may be updated when the Site's services or practices change. The effective date will identify the published version. Where required, material changes to consent-based processing will require renewed notice or consent.