Privacy & data use

Last updated: 30 July 2026

This page covers personal data handled by My Library. The educational curriculum, paper registry, dataset atlas, and arXiv Radar are static public content and do not need a personal account.

Data My Library can contain

The personal tracker can contain paper titles and identifiers, authors, reading status, tags, comprehension and confidence ratings, private notes, review history, review dates, due dates, and deletion markers. Deletion markers retain paper identity fields such as an internal/catalog ID, title, locator, year, and logical revision so another device cannot silently restore an older copy. Do not enter patient identifiers, protected health information (PHI), credentials, controlled clinical data, or information that requires a stronger audited system.

Every storage mode keeps a working copy in the current browser profile:

• This browser only keeps the personal library in browser localStorage.
• Portable JSON downloads a plain-text recovery copy at the reader’s request.
• Google Drive sync, when configured and explicitly connected, also sends versioned device snapshots directly from the browser to that reader’s hidden Google Drive application-data folder.

The repository, GitHub Actions, and generated website do not receive or contain these personal libraries.

Google user data

Google Drive sync requests only https://www.googleapis.com/auth/drive.appdata. This permission lets the application read and write files that it creates in its own hidden app-data folder; it does not let the tracker browse unrelated Drive files.

After authorization, the tracker uses Google user data only to:

1. identify the selected Drive account so local caches remain separated;
2. hint the previously selected account during a user-initiated reconnect when the locally retained label is an email address;
3. download and validate this application’s reading-library snapshots;
4. merge reading records, review history, and deletion markers across devices;
5. update the current device’s snapshot;
6. after explicit confirmation, delete My Library snapshots during the erasure flow.

The raw Drive account identifier and OAuth access token are kept only in page memory. A SHA-256-derived account key and the selected account’s email/display label are kept locally so the reader can verify which account cache is active. The browser also keeps an opaque device ID and context-revision token for per-device snapshots and cross-tab erase safety; neither value contains a paper record or Google credential. The site has no application database or server-side token store.

Google Identity Services issues short-lived browser access tokens. This static site cannot silently identify an account on a new device and does not store a refresh token. A returning reader chooses Continue with Google Drive or selects the same Google account; the tracker then retrieves the hidden app-data snapshots directly from Google. Google records the permission grant per reader and OAuth client ID, so the same unchanged scope normally does not require consent again. Google can still request sign-in, account selection, or consent after revocation, a scope or policy change, or expiration of a Testing-mode grant. Authorization itself is not treated as proof that a Drive snapshot was read or saved.

When Google Drive sync is configured, the My Library page preloads the Google Identity Services script so the visible Connect or Continue action can work on its first click. Loading that script contacts Google, but the tracker requests no Google account, OAuth token, or Drive data until the reader chooses the action.

Google user data is not sold, used for advertising, transferred to data brokers, or used to train models. The project does not initiate sharing with another user; a reader can explicitly select and confirm copying live records, including notes, into another Google account. Use is limited to the user-facing synchronization and account-copy actions described here and follows the Google API Services User Data Policy, including its Limited Use requirements.

Retention, access, and deletion

• Browser records remain until the reader clears that library, clears site data, or removes the browser profile. Successful migration from the legacy v1 browser key verifies the v2 copy before removing the legacy key; browser-only Clear library also removes both generations.
• Portable JSON and calendar files remain wherever the reader saves or imports them; the site cannot delete those files.
• Each connected browser profile writes its own Drive snapshot. Snapshots remain in Google’s hidden app-data folder until the reader deletes that application data or Google removes it under its platform policies. Cleared or abandoned browser profiles can leave older full snapshots behind.
• Sync, then disconnect first attempts to save unfinished submitted changes, then stops sync and clears the token from page memory. If Drive cannot confirm that save, proceeding requires an explicit local-only warning. Disconnect does not delete the browser cache or existing Drive snapshots.
• Clear library removes the records from the merged view but, in Google mode, retains identity-bearing tombstones and does not physically rewrite every older device snapshot. Browser-only Clear removes its local tombstones.
• Revoking OAuth access prevents later API access but does not itself promise deletion of already stored app data.

The site operator has no backend copy to retrieve, inspect, or delete. For a browser-only copy, use Clear library or clear this site’s browser data.

For a Google-linked library, first close or disconnect every other open device, then choose Erase Drive + this account cache for the intended local account cache. The flow durably stops new sync and stores its upload guard before requesting the same narrow drive.appdata authorization, if needed, for a separate in-app deletion-only path. That application path verifies the account and never pulls, merges, or uploads the library. It waits for this browser profile’s earlier sync work, deletes every listed My Library snapshot, erases this browser’s account cache, and leaves the browser-only library active. Other browsers must still be cleared separately; an authorized device left open can recreate a snapshot. If deletion is interrupted, a local erasure guard survives reload and blocks automatic upload until the reader retries Erase or explicitly confirms that the guard should be cancelled. Guard cancellation does not pull or upload a library; restoring synchronization requires a separate Connect action. If the browser lacks the Web Locks API required to serialize tabs, the tracker fails closed and does not start in-app erasure; use the provider-side fallback below.

As a provider-side fallback, stop sync first, open Google Drive Settings → Manage apps, find the application, and choose Options → Delete hidden app data. Then clear this site’s browser data and do not reconnect unless restoring. Browser settings generally clear all local libraries for this site origin, not just one account cache. Deleting hidden app data while an enabled local cache remains can otherwise cause a later upload to recreate it. Export a private recovery copy first if appropriate.

Security boundary

Browser storage, Google Drive snapshots, portable JSON, and calendar files are not end-to-end encrypted by this project. Google protects Drive data under the connected account and its own controls, and the browser uses HTTPS for API requests. Anyone with access to the browser profile, an exported file, the Google account, or a compromised same-origin page session may be able to read the records.

All project paths under https://chengjiahao1234.github.io share one browser origin. A sibling project page is therefore inside both the local-storage and OAuth-origin trust boundary. A dedicated, verified custom domain authorized as the only production origin is recommended before offering Google authorization broadly.

Contact and changes

Privacy or deletion questions can be sent privately through the repository owner’s GitHub profile. Do not include personal reading records or credentials in an issue. Material changes to this data flow will update this page and its date before deployment.