Privacy Notice
In force since November 7, 2026 · Version 2026-11-07.2
Privacy Notice
In force since November 7, 2026. This notice explains what personal data ScholarFolk processes, why, on which legal basis, how long it is kept and which rights you have. It is written for everyone who visits or uses the service anywhere in the world. Regional supplements at the end add what the law of your country requires.
1. Who is responsible
The service at https://scholarfolk.com ("ScholarFolk", "we") is operated by ScholarFolk, the data controller.
A privacy contact address will be published here before the public launch of the service.
2. What ScholarFolk is
ScholarFolk is an academic social platform. One account holds a researcher profile, a list of publications, posts and articles, photos, short-lived stories, direct messages and a video channel. Most of what you publish is meant to be seen by other people; this notice tells you which parts are public, which are private and how you control the difference.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Account data | e-mail address, sign-in method (e-mail link, ORCID, Google), language, time zone, legal acceptance record | you, the identity provider you chose |
| Profile data | display name, username, title, institution, department, biography, research fields, location, website and links, profiles on other networks, avatar and cover image, ORCID iD | you, ORCID (name only), Google (name and picture only) |
| Publications | bibliographic metadata of works you list (title, authors, venue, year, identifiers such as DOI), your own notes and corrections, import history | you, ORCID, Crossref, DataCite |
| Content | posts, articles, replies, photos and their alt text, stories, videos, subtitles, likes, bookmarks, reposts, reports you submit | you |
| Messages | direct messages, attachments, read state, participants | you and the people you write to |
| Social graph | who you follow, who follows you, blocked and muted accounts | you |
| Preferences | theme, playback, notification, privacy and messaging settings | you |
| Security data | sign-in events, device and browser description, IP address, session identifiers, two-factor secret (encrypted) and recovery code hashes, moderation actions concerning you | generated by the service |
| Technical data | server logs with IP address, request path, status and timing; error reports | generated by the service |
We do not ask for and do not need government identifiers, payment details or precise location. Photos are re-encoded on upload and location metadata (EXIF GPS) is removed before anything is stored.
4. Why we process it and on which basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Creating and operating your account, signing you in, remembering your language | account, security | performance of the contract (Art. 6(1)(b)) |
| Showing your profile, publications and content to the audience you chose | profile, publications, content, social graph | performance of the contract |
| Importing and synchronising publications from ORCID and resolving DOIs | publications, ORCID iD | performance of the contract; you start every import and can switch synchronisation off |
| Delivering messages and stories to the people you address | messages, content | performance of the contract |
| Sending notifications and system e-mails you have not switched off | account, preferences | performance of the contract; legitimate interest in keeping you informed |
| Keeping the service secure: rate limits, abuse detection, session management, two-factor authentication, activity log | security, technical | legitimate interest (Art. 6(1)(f)) in protecting the service and its members; legal obligation where applicable |
| Handling reports and moderating content | content, reports, moderation actions | legitimate interest in a safe platform; contract (Terms of Use) |
| Answering your requests and complaints | whatever you send us | legal obligation (Art. 6(1)(c)); legitimate interest |
| Statistics about how the service is used, in aggregate and without profiles of individuals | technical | legitimate interest in improving the service |
We do not sell personal data, we do not show advertising, we do not build advertising profiles and we do not use automated decision making that produces legal or similarly significant effects. Feeds are chronological or filtered by your explicit choices; there is no opaque ranking of people.
5. What is public and what is not
- Public by default: display name, username, title, institution, biography, research fields, links, profiles on other networks, avatar and cover, publications you list as public, posts and videos with the audience "Public", and the counts shown on your profile.
- Visible to followers only: anything you publish with the audience "Followers", stories by default, and the "Followers" audience for videos.
- Private: your e-mail address (unless you switch "Show my e-mail" on), items with the audience "Only me", drafts, bookmarks, messages, settings, the activity log, sessions and everything on your Settings pages.
- ORCID badge: the badge only states that an ORCID iD was linked through ORCID sign-in. It does not vouch for expertise or affiliation. An ORCID iD you typed in by hand is marked "not verified".
Search engines may index public pages. If you make something private later, it leaves our pages immediately, but copies cached elsewhere are outside our control.
6. Who receives data
We use service providers that process data on our behalf and under our instructions (processors): hosting and database infrastructure, object storage for images and video, an e-mail delivery provider for sign-in links and notifications, and error monitoring. They may not use the data for their own purposes.
Data also goes to the following independent recipients when you use the corresponding feature:
- ORCID (ORCID, Inc.) when you sign in with ORCID, link your iD or import works. We read what ORCID's permissions allow and store the access token encrypted. ORCID's own privacy policy applies to your ORCID record.
- Google (Google LLC) when you sign in with Google. We receive your name, e-mail address, its verification status and your picture; we do not receive your password or your Google contacts.
- Crossref and DataCite when you add a publication by DOI. Only the DOI is sent.
- Cloudflare Turnstile, only on servers where the operator has enabled it, to tell people from automated scripts on the sign-in form.
- Other members, to the extent you make content visible to them or write to them.
- Public authorities, if we are legally obliged to disclose data.
7. International transfers
Our infrastructure providers may be located outside your country. The server location will be published here before the public launch. Where data leaves the European Economic Area, the United Kingdom or Türkiye, we rely on an adequacy decision where one exists, otherwise on standard contractual clauses or an equivalent legal safeguard with the recipient. ORCID, Google, Crossref and DataCite process data in the United States under their own safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and profile | until you delete your account, then removed from our systems within 30 days |
| Content, publications listings, messages | until you delete the item or the account; shared bibliographic records that other authors list stay without your name attached |
| Stories | shown for 24 hours, then removed; the image file is deleted within a day after expiry |
| Sessions | until you sign out, until the device is removed in Settings, or 30 days after the last use |
| Account activity log | 365 days |
| Server logs | 30 days, unless needed for an ongoing security investigation |
| Moderation records | 2 years after the decision, for consistency of decisions and to answer complaints |
| Legal acceptance records | as long as the account exists, plus the period needed to prove acceptance |
| Backups | rotated within 35 days |
9. Security
Sign-in works without passwords: one-time e-mail links, ORCID or Google. You can add two-factor authentication with an authenticator app and recovery codes. Access tokens for ORCID and two-factor secrets are stored encrypted. Connections use TLS, every page is served with a strict content security policy, requests are rate limited, uploads are checked by their bytes and processed before they are shown, and private media is served only to people entitled to see it. You can review the devices signed in to your account and your recent account activity in Settings, and sign out any device.
10. Your rights
Depending on where you live you have the right to access the data we hold about you, to have it corrected or deleted, to restrict or object to processing, to receive your data in a portable format, to withdraw consent at any time where processing relies on consent, and to complain to a supervisory authority.
You can exercise most rights yourself:
- Access and portability: Settings > Your data and legal > Download your data gives you a JSON export.
- Correction: every profile field, post, publication listing and setting can be edited.
- Deletion: Settings > Your data and legal > Delete account removes your profile, content, messages, stories, media and connections. Shared bibliographic records used by other authors remain, without your name.
- Objection and restriction: switch off notifications, synchronisation, discoverability or messaging in Settings, or write to us.
For anything else, write to the privacy contact published on this page. We answer within one month; the law of your country may set a shorter period, which we respect.
11. Children
ScholarFolk is for people aged 18 and over. We ask you to confirm your age when you join and may ask you to verify it where the law requires this, for example through an official age verification service. If we learn that an account belongs to someone under 18, we close it and delete its data within the periods in section 8. If you believe a child is using ScholarFolk, please tell us.
12. Cookies
We use only cookies that are necessary to run the service: your session, the state of a sign-in that is in progress, your language and your time zone. There are no advertising or analytics cookies. The Cookie Notice lists every cookie with its lifetime.
13. Changes
When this notice changes in a way that matters, we show a banner asking you to review and confirm the new version, and we update the date at the top. Earlier versions are available on request.
14. Regional supplements
European Economic Area, Switzerland and the United Kingdom
The legal bases above refer to Article 6 of the General Data Protection Regulation (GDPR) and its UK equivalent. You may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement. Where we rely on legitimate interest, you can object at any time; we then stop unless we show compelling legitimate grounds.
Türkiye
The processing of personal data of people in Türkiye is also governed by Law No. 6698 on the Protection of Personal Data (KVKK). The separate Türkiye Personal Data Notice (KVKK) on this site fulfils the information duty under Article 10 of that law and describes how to apply under Article 11 and the Communiqué on the Procedures and Principles of Application to the Data Controller. It is available in your language; the Turkish text is authoritative.
United States
We do not sell or share personal information for cross-context behavioural advertising and we do not use sensitive personal information except as needed to provide the service you request. Residents of states with privacy laws (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon) may exercise the rights listed in section 10 using the same channels; we do not discriminate against anyone for doing so. Authorised agents may act on your behalf with proof of authorisation.
Brazil
For people in Brazil, Law No. 13.709/2018 (LGPD) applies. The legal bases above correspond to Article 7 of the LGPD. You may contact us to exercise the rights in Article 18 and may petition the Autoridade Nacional de Proteção de Dados.
Other countries
If the law of your country gives you additional rights, you may exercise them through the contact address above. Where a translation of this notice differs from the English text, the English text prevails.