Privacy Policy

Last updated: September 2026

ScholarList is currently developed and operated by Mahesh Kumar as an individual. This policy explains what personal information we collect, why, and how it is handled. It applies to everyone who uses scholarlist.org, whether or not you have an account, and it also covers how we handle publicly available information about researchers who appear on the Service but have never signed up themselves.

ScholarList is built around a simple principle: collect only what is genuinely needed to make the product work, and nothing more. This policy does not cover the practices of third-party services we rely on or link to, such as ORCID, OpenAlex, Crossref, or DataCite, each of which has its own privacy policy.

Information we collect about account holders

When you sign in with ORCID, we store your ORCID iD, your name as returned by ORCID, and an optional display name if you choose to set one in Settings. Creating an account does not require an email address, and we do not ask for one during the normal sign-in process.

We also store the researchers you follow, the custom WatchLists and ReadingLists you create, the papers you save, and any names, descriptions, or social links you voluntarily add to your account. If you make a ReadingList public, its contents and your public identity become visible to anyone with the link, which is covered in more detail below.

Information about researchers

ScholarList also stores information about researchers who may never have created an account here. This includes names, affiliations, employment and education history, publications, and related scholarly metadata retrieved from ORCID, OpenAlex, Crossref, and DataCite. This information is cached locally so that profile pages load quickly and stay reasonably current, and it is refreshed from those sources periodically.

A researcher's presence on ScholarList does not mean they have registered, reviewed, or approved their profile in any way. If you are a researcher and believe information shown about you is inaccurate or should be corrected, please reach out through the contact form linked in the footer, and we will look into it, including pointing you to the original source if the correction needs to happen there instead.

Contact and issue report forms

If you use the report an issue, feature request, or general contact forms linked in the footer, we collect the email address you provide along with your message, so we can reply to you directly. This is separate from the anonymous feedback widget described below, and it is the only place on ScholarList where we collect an email address at all.

Anonymous feedback

The feedback button available on every page does not require an account or an email address. A feedback submission includes the message you write, the page you submitted it from, and your IP address at the time, which we keep to help understand where feedback is coming from and to prevent abuse of the form, not to identify who sent it.

IP addresses and login history

We keep a short history of IP addresses associated with your account at login. This is retained for account security purposes, such as helping us notice unauthorized access, and it is deleted immediately if you delete your account. We also use IP addresses for rate limiting, which simply means slowing down or blocking an unusually high number of requests from one source to keep the Service stable and prevent abuse.

What we do not collect

ScholarList never asks for or stores a password. Authentication is handled entirely by ORCID's own sign-in system, and we never see or store your ORCID password. We do not run advertising, and we do not use third-party trackers that follow you across other websites for advertising purposes.

Cookies and browser storage

ScholarList uses a small number of cookies, each with a specific, necessary purpose.

• A session cookie that keeps you signed in while you use the site
• A cookie named scholarlist_remember, used only if you stay signed in between visits, valid for up to about four hundred days
• A CSRF cookie that protects account actions from being triggered by another website, set as HttpOnly, Secure, and SameSite=Lax

None of these cookies are used for advertising or sold to third parties. Separately, a couple of small conveniences are stored directly in your browser rather than on our servers: your recent search history, capped at ten entries, and your light or dark theme preference. Both stay on your device and are never sent to us.

Analytics

ScholarList uses Cloudflare Web Analytics to understand overall traffic and site performance. This tool is cookieless and does not track you individually or across other websites. It works from aggregated, anonymized request data collected at Cloudflare's network edge, and it does not affect anything said above about advertising or tracking cookies.

Other third-party services we rely on

A few outside services are involved in running ScholarList, each limited to a specific job. ORCID handles sign-in and provides the public researcher data the Service is built around. OpenAlex, Crossref, and DataCite provide additional publication and citation metadata. Cloudflare Turnstile checks that a real person, not a bot, is submitting our contact form, without using tracking cookies to do it. The KaTeX library used to render mathematical notation in some publication titles is loaded directly from the jsDelivr content delivery network, so a request for that file goes straight from your browser to jsDelivr rather than through us. Each of these services operates under its own privacy policy, and none of them receive any more information from us than is necessary for the specific job they do.

Data sharing

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Information is only exchanged with the services listed above where genuinely necessary to provide the features described in this policy, or where disclosure is required by law, necessary to protect the security of the Service, or necessary to investigate abuse.

Public information

Some information you create is meant to be public. If you make a ReadingList public, anyone with the link can view its contents without signing in, and it may be indexed by search engines or copied by visitors before you take it down. Please do not put confidential or sensitive information into a public ReadingList. Deleting a public list from ScholarList does not guarantee that copies others already made of it are removed as well.

Data retention and account deletion

We keep your account data for as long as your account remains active. When you delete your account from Settings, it enters a thirty-day grace period during which signing back in with ORCID fully restores it. After that period ends, your account, WatchLists, ReadingLists, remember-me tokens, and login history are permanently and automatically deleted. We may keep limited information longer where necessary for security, fraud prevention, or to comply with a legal obligation.

Security

We take reasonable technical measures to protect your information, including CSRF protection on account actions, rate limiting against automated abuse, and secure handling of authentication tokens. That said, no online service can be guaranteed to be completely secure, and we cannot promise absolute protection against every possible incident.

Your rights

Depending on where you live, you may have rights to access, correct, or delete personal information we hold about you, or to object to certain uses of it. For your ScholarList account, the fastest way to exercise most of these rights is directly through Settings, where you can update your display name or delete your account at any time. For anything else, including a request about researcher information that concerns you personally, please use the contact form linked in the footer, and we will respond as promptly as we reasonably can.

Children's privacy

ScholarList is intended for use by adults and is not directed at children. We do not knowingly collect personal information from children, and if we become aware that we have, we will take appropriate steps to remove it.

International users

ScholarList is operated from India and can be accessed from anywhere in the world. Using the Service means your information may be processed in India and in the countries where the third-party services listed above operate. If you are located in a region with its own data protection law, that law may give you additional rights beyond what is described here, and nothing in this policy is meant to limit those rights.

Changes to this policy

This policy may be updated as ScholarList evolves. Meaningful changes will be reflected by updating the date at the top of this page, and if we ever significantly change how we use your personal information, we will make a reasonable effort to let you know before that change takes effect.

Contact

Questions about this policy, or any request relating to your personal information, can be sent through the contact form available in the footer of any page.