Clear and practical
Here’s what Professor stores, where it stays, and which services are involved.
Profile and resume drafts, saved researchers, checked-profile markers, and outreach reminders use this browser’s local storage. If sending is enabled, Gmail-accepted outreach also records the public researcher ID in a list kept separately for each signed-in Professor account on this device; that list contains no message body and is not synced. Clearing browser storage removes these local copies.
Firebase Authentication provides sign-in. Student profile and resume synchronization use private Firestore rules. Email quota and send history are handled separately by the configured mail service.
Search terms are sent to OpenAlex to find scholarly works and authors. The site may query Wikimedia Commons for reusable portraits. OpenAlex authorship records do not verify a current professor role, availability, or email address. When you open an email draft from a researcher result, the public researcher details and selected paper context are stored in this browser tab with a 30-minute expiry; expired context is ignored, and closing the tab clears it. The link contains only a random reference. If tab storage is unavailable, no researcher details are put in the link and you can enter them manually.
When you generate an AI draft, Firebase AI Logic sends professor-side research details, purpose, and tone to Gemini. Your name, email, study area, interests, projects, skills, and resume are not included in that AI request; the page reads the student details on this device and combines them with the response locally. Firebase AI Logic itself does not store prompts or responses, but Google’s handling depends on the Gemini API service and whether the request uses unpaid or paid services. For unpaid services, Google may use submitted content and responses to improve services, and human reviewers may process them. Avoid sending confidential or personal information. If you choose to send the finished message, its full text—including any student details you kept in it—is sent to the Gmail account you connected. Profile or resume details are synced to Firestore only when you choose the account-save option.
If you submit the Contact form, your name, email, topic, and message are sent through FormSubmit to the site owner. The page does not add its URL or query parameters to the form request. FormSubmit says it may retain submissions for 30 days. Don’t include passwords, verification codes, or private student records.
If email sending is enabled and you choose Send through Professor, the reviewed recipient, subject, and full message are sent to Gmail through its API from the Google account you selected. Gmail access tokens are held in browser memory and passed to the secure Worker only for a send; the Worker does not store those tokens. The browser clears the Gmail connection when you sign out of Professor, switch Professor accounts, or the token expires. D1 stores recipient, recipient name, subject, Gmail message ID, send state, timestamps, and a one-way request fingerprint; it does not store message bodies. The Worker enforces 250 accepted sends per Professor account per UTC day. Gmail has its own per-account limits. Gmail acceptance does not confirm recipient-server delivery or inbox placement. Replies remain in the connected Gmail account and are not imported into Professor. Sending is currently disabled. Public sending still requires Google OAuth verification and the production website origin, privacy details, and App Check to be configured.
These third-party services receive information as described above. Their policies explain how they process and retain information, and may change over time.
These notes describe the current site behavior. Service policies can change; check the linked providers’ notices for their current retention and processing terms.