Koios

Privacy policy

What Koios — the paper reader and research workspace at koios.dev, “the app” below — does with your data, and what it never sees. It covers the website, the Koios desktop app, the Koios Companion you can install on your own computer, and the proxy at api.koios.dev that serves them.

Last updated 30 October 2026.

The short version. The app runs in your browser. It has no database and no account of its own: your library — the papers you collect, your highlights and notes, your reading progress — and your projects' code, data and drafts live in your own Google Drive, with a working copy in your browser, on your own computer if you install the Companion, or on a machine you choose to run code on. The one server involved is a small proxy that fetches what a browser cannot fetch, relays a few paid features on the site's own keys, and holds the little that collaboration and moving files between machines need. Nothing it sees is sold, used for advertising, or used to train anything. Every piece of this is open source, so none of it has to be taken on trust.

What the app receives from Google

Signing in with Google is how you open your library. Each scope is asked for in a window of Google's that names it, and none lets the app see anything beyond what is listed here:

When	Scopes	What the app does with it
Sign in	`openid`, `email`, `profile`	Shows your name, email address and picture so you can see which account is connected, names your library in Drive as yours, and — once per sign-in — tells the proxy whose account this is, so it can issue the pass described under Tokens.
Sign in	`drive.file`, `drive.appdata`	Creates and reads back only the files the app itself created: the `Papers_collection` folder and what is in it, and, in Drive's hidden app-data space, a spare copy of the library record and of the projects record. These scopes give no access to anything else in your Drive. The layout is under In your Google Drive.
Sign in, as an option you can untick there; or later, from the Calendar page	`calendar.events`, `calendar.calendarlist.readonly`	Lists your calendars and reads the events in the span on screen, to show them on the Calendar page by day, week or month. Your calendar changes only when you change it in the app: a meeting you add, edit or delete, or an invitation you answer, is written to the calendar you chose, and the app marks the events it made with a small private note of its own (the Zoom link or the meeting-notes setting it attached). Nothing else is ever written. Calendar data is held in the page while you look at it and is not stored on the proxy; the cases in which parts of it go elsewhere are under Sharing.
The first time you run code on Colab	`colaboratory`	Starts and talks to a Colab runtime as you, to run a project's cells or jobs. The proxy passes your Colab calls through with your token and keeps nothing of them; the cells and their output travel between your browser and the runtime, directly when Colab allows it and otherwise relayed byte for byte by the proxy, which does not read them.

Tokens, and where they are

The access token Google issues lasts about an hour and is held in the browser's session storage, for this tab. It is never written to disk by the app. When the hour is up the app asks Google for a new one on the grant already given.
A refresh token, if you stay signed in. When the proxy offers it, signing in keeps a Google refresh token so that you are still signed in next time: in the website, in the browser's local storage; in the desktop app, in a file sealed with the operating system's keychain. It is exchanged for new access tokens through the proxy, which adds the client secret and keeps neither token. Sign out revokes it with Google and deletes it.
The proxy's pass. Signed in, the browser shows the proxy your Google token once; the proxy asks Google whose it is and answers with a pass — your email address and an expiry, signed by the proxy, valid thirty days and renewed before it runs out — which the app sends with its requests. It is kept in the browser's local storage with your settings and cleared on sign-out. The proxy keeps no copy.
Your Google token on the proxy, in two cases you start. When you move a project's files between Google Drive and a computer or a machine, and while a project's data place is Google Drive (the default for datasets, checkpoints and run outputs), the proxy holds your current Google access token for as long as the move or the link lasts, and the machine doing the work fetches it from there to read and write that Drive folder. The page renews the token every twenty minutes and the link every six days; it is cleared when the move finishes, fails or is cancelled, and when the link lapses. The token carries every scope you granted, so a machine that holds it could in principle reach your calendar or Colab as well as Drive; the app's own code on those machines uses it for Drive alone.

You can withdraw any of these permissions for good at myaccount.google.com/permissions; Forget beside the calendar in Settings drops that permission in the browser.

Limited Use. The app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the features described on this page, as you use them. It is never sold, never used for advertising, never used to train any model, and never transferred to anyone except as set out under Sharing, with your action, or as required by law.

Where your data is kept

In your Google Drive

Everything is an ordinary file in your own Drive, under Papers_collection (a name you can change in Settings). You can read, move or delete any of it yourself, and deleting it there needs nothing from the app.

library.json: your papers, collections and projects, your highlights and the comments on them, and the list of papers you removed; a spare copy in Drive's app-data space.
A folder per paper: its PDF (if saving PDFs is on), a small file of its details and your highlights, the Explain page written for it, as Markdown, and your notes on it — what you wrote and what you kept from the paper and its explanation — as a JSON file, … — notes.json. Papers you remove are moved to a Junk folder, not deleted.
playgrounds.json and Playgrounds/: each project's record and, when its home is Drive, its code — including the files the app writes there for you and for the coding agents: the paper's text and PDF, the explanation, the implementation plan, the agents' chat transcripts (with their reasoning), and the project's telemetry and run files when they are kept with the code. Playgrounds/Snapshot-… holds a read-only copy of a project that lives on another computer, refreshed every few minutes.
Data/: the data place — datasets, checkpoints and run outputs — when it is Drive, which is the default. Experiments/: runs you file. Projects/: the Write tab's LaTeX and your templates.

In this browser

A working copy of your library, one database per account, so the app opens quickly and works offline; Drive's copy is the one that counts, and signed in, the app opens on it. Your notes and the Explain pages are here too, as working copies of the files in Drive. Kept in the browser, and only there unless this page says otherwise: your whiteboards, the Colab notebook cells, the implementation plan's browser copy, an unshared project's logbook, your Ask AI conversations (the last forty), where you were in your last few papers, and your settings — including, if you enter them, your own Anthropic API key, a Granola key, the address and token of a Jupyter server, and the proxy pass above. Anyone who can use this browser can use what is in it; see protection. Clearing this site's data in your browser removes all of it and nothing else.

On your own computer, if you install the Companion

The Companion keeps its settings in ~/.reader-companion/, readable by your user alone: its own token, the computer's id and the account that claimed it, the keys for folders you mount or share, the pass for a compute machine you link, and — if you connect them there — Overleaf and GitHub Git tokens. Projects whose home is your computer live in ~/Reader (or the folder you chose), with the same files as in Drive above; moves and agent runs write logs under ~/.reader-agent/. The desktop app keeps its window state, a library you use without Drive, and the sealed refresh token in its application-support folder. What the Companion exposes, and to whom, is under The Companion.

On the proxy

The proxy is a Cloudflare Worker run by me. It keeps no copy of your library, your papers, your notes, your drafts or your calendar. What it does keep, each with its retention:

What	Why	Who can read it	Kept
Usage tallies per account per day — sign-ins, PDF fetches, searches, browser pane opens, compiles, AI answers with tokens and cost per model, last seen	To see what the site's paid keys are used for	Me only	90 days
A GitHub token and login, or an Overleaf Git token, if you connect them — sealed as described under protection, never sent back to any page	So no browser holds them	No one; the proxy uses them for the calls the app makes	Until disconnected, revoked, or 180 days unused
Sign-in cookies from publishers' sites, from the reader's own browser pane, per browser	So a journal you signed in to stays signed in for PDF fetches	That browser, with your pass	30 days unused; Forget sign-ins deletes them
Your computers, if you install the Companion: name, hardware, version, root folder, tunnel and local addresses, a hash of its heartbeat secret, when it last reported, and the Companion's token	So any browser of yours finds your computer	Any browser signed in as you; the proxy, to drive a move	Until you release or forget the computer
Per project: which machine its code runs on, the kernels and runs started and their log paths — no tokens, no output	So a run picked up from another browser is found	You	2 days unused
A long AI answer in progress (the request sent to the model, which can include a paper's text, code or images, and the answer as it streams), and, for that time, your own provider key if you use one	So an answer outlives the tab that asked	You	The key: until the provider answers. The job: 24 hours after it ends
A project being moved: its files as one archive in a storage bucket, a manifest of file names, sizes and hashes, the move's key, and your Google token while Drive is one end	Moving files between Drive, your computers and compute machines	The two machines, with the move's key	The archive: deleted once unpacked, or after 7 days; the token: when the move ends; the manifest: 7 days
A shared project's room: its members, the project summary, where each member is, its logbook and whiteboard	Collaboration; see Shared projects	Its members	Until the owner stops sharing; last-seen times 30 days
Invitations you send and receive, and a log of the emails sent for them	So an invitation can be taken up	You, for yours; me, for all	Links expire in 30 days; the record stays until account deletion
LaTeX sources and PDFs for a compile on GitHub Actions; the browser pane's session and a short diagnostic log (its last twenty events, including the addresses it opened)	While the compile or the pane runs	You	1 hour; the pane's log until account deletion

The Cloud Run compiler I run keeps a project's LaTeX folder on its instance's temporary disk for the next compile, thirty projects at most, and nothing on it outlives the instance; an Overleaf clone is deleted after each sync.

“Google user data” here is everything the scopes above give the app: your name, email address and picture; the files under Papers_collection and in the app-data space; your calendars and their events; and what a Colab runtime does on your behalf. None of it is sold, rented, or shared with any data broker, advertiser or analytics service; the app carries no analytics, no advertising and no third-party trackers, and sets no cookies of its own; and no human other than you reads it. It leaves your browser only in the cases below, each a feature you use, and only the part that feature needs:

To Google itself (googleapis.com): Drive, Calendar and Colab, as above. That is the data's home.
To the proxy (api.koios.dev): your Google token, once per sign-in, to issue the pass; your Colab calls, with your token, passed through; and the items in the table above, in the cases that put them there. For the features marked “through the proxy” on this page, the request that feature makes. The proxy keeps no Drive file, note, draft or calendar event.
To an AI model, only when you ask it something. Ask AI, Explain, the lookup card's background paragraph, the project agent and the meeting write-up send what the question is about to the model you picked — Anthropic (Claude) or Google (Gemini) — through the proxy on the site's keys or directly on your own key. DeepSeek is not used on koios.dev: its models are not offered, and nothing — not the question, the paper, your notes, nor anything that came through a Google API — is sent to it, on the site's key or on a key of your own. Anthropic's and Google's API terms do not allow them to train their models on what the app sends them. By default that is: the paper on screen (its text and, where you ask, pictures of its pages or figures), your question, the passage or selection in view, your highlights and notes, the Explain page and notebook, the library list on screen, the open project's files including unsaved edits, and the visible text of whatever page you are on — which includes calendar events if the Calendar page is open — with password, key and token fields always left out. Each of these has its own switch under the ⚙ by the question. A meeting write-up sends the transcript with the event's title, time and attendees' names. Nothing is sent until you use one of these features.
To the coding agents you choose to run — Claude Code (Anthropic), Codex (OpenAI), Gemini CLI and the like — on your computer or a compute machine, under your own account with that provider, never the site's: the project's folder, which the app has put the paper's text, PDF, explanation and plan into, so that the agent needs no web access to read the paper. What they send to their provider is governed by that provider's terms and your account with it; the app keeps their transcripts in the project's folder.
To the machines you run code on — Colab, a server you link, or a computer of yours with the Companion: the project's files, and your Google token or the Companion's token when the data place is Drive or that computer, so the machine can read and write there.
To Zoom, only when you make a Zoom meeting from an event: its title, time, length and timezone, through the proxy, in the site's Zoom account. To Granola, only if you set your own Granola key: the request for the notes of meetings you asked Granola to take; the proxy passes the key through and keeps it nowhere. To Recall.ai, only for a meeting you chose to record in the desktop app: that meeting's sound, from the computer and the microphone, to be transcribed; the proxy fetches the upload token and keeps nothing of the meeting.
To a LaTeX compiler, only when you write a paper: the draft's sources to the Companion on your own computer, a Cloud Run service run by me, or GitHub Actions in your repository; and to Overleaf, with the Git token you gave for it, if you link an Overleaf project.
To GitHub, only if you connect it: your notes and bibliography, mirrored to a repository you name; a project's code, to a repository made for it; each call made by the proxy with your sealed token, from a short allow-list of repository operations.
To the places papers live, for search and metadata: arXiv, OpenAlex, Semantic Scholar, Crossref, Unpaywall, DataCite, DBLP, OpenReview, PubMed Central, Europe PMC, Google Books, Open Library, Wikidata — your search terms, titles, DOIs and author names, and, where you set one in Settings, your contact email, which OpenAlex, Crossref and Unpaywall ask for; Google Scholar, through the proxy, when you choose it. PDFs and pages a browser cannot fetch go through the proxy, which sends the publisher the URL and any sign-in cookies you set in its browser pane.
To a dictionary, Wiktionary and Wikipedia: the word or term under the lookup card.
To a web-search service, only when you press Web in Ask AI: the searches the model composes, through the proxy to Tavily, Brave, Serply or SerpApi on the site's keys, and the proxy fetches the pages they turn up.
To Cloudflare, which runs the proxy and its storage, the reader's browser pane (a headless browser in Cloudflare's network, which sees the pages you visit in it and what you type into them), the Turnstile check on the welcome page where it is on (your IP address), and the tunnels the Companion opens; and to Browserless, a browser service the proxy turns to for pages behind bot checks, which receives that page's address and the pane's cookies.
To an email service (Brevo, Resend, SendGrid or Postmark, whichever the site uses), only when you invite someone: their address, your name and email as the reply-to, your note, and the project's name and question.
To the people you share a project with: what Shared projects lists, and nothing else of your library, and never your calendar or your Drive files.
To hosts that serve the page itself: Google Fonts, for the typefaces, and the sites the simulation picker's preview clips are loaded from (GitHub and a few simulators' own sites). Like any site, these see the visitor's IP address and browser; they receive nothing else.

Beyond these, Google user data is disclosed to no one, unless the law requires it — in which case only what is required, and I would tell you where I am allowed to. No Google user data is transferred as part of any sale, merger or change of control; there is nothing to transfer, since it lives in your Drive, your browser and your computers. Each service named above has its own privacy policy, and I have no control over what it logs.

How your data is protected

The data the scopes give access to is sensitive, and the app is built to hold as little of it as possible, for as short a time as possible, in as few places as possible:

It stays where it already is. Your library's home is your own Google Drive, protected by your Google account, its password and its two-step verification; the proxy keeps no copy of any Drive file, note, draft or calendar event, and the few things it does hold are listed above with their retention. There is no server-side store of your library to breach.
Everything travels encrypted. Every request the app, the proxy, the Companion and the desktop app make — to Google, to the proxy, to the services above, through a tunnel — is over HTTPS or secure WebSockets (TLS). The site is served only over HTTPS, with HSTS, from koios.dev.
Tokens are short-lived or sealed. The Google access token lasts an hour and lives in session storage. The refresh token, where kept, is in local storage on the website and in a keychain-sealed file in the desktop app, and is revoked on sign-out. The proxy's pass is signed so it cannot be forged or altered, and expires. The proxy holds your Google token only for a move or a data link you started, cleared when it ends.
What the proxy keeps for you is sealed. A GitHub or Overleaf token is encrypted at rest with AES-256-GCM under a key derived (HKDF) for you and for that purpose alone from a secret only the proxy has, bound to your account so that a copy is useless under any other; its records are filed under a keyed hash (HMAC-SHA-256) of your email address, not the address itself; a token unused for 180 days is forgotten. The proxy's own secrets live in Cloudflare's encrypted secret store, never in code. Requests are rate-limited per person and per address.
The least access that works. drive.file and drive.appdata reach only the files the app created; calendar access can be left unticked at sign-in; Colab is asked for at the first run, in Google's own consent window. The proxy makes GitHub calls from a short allow-list only. Compute machines get the project's files and the one token the data place needs.
Your own API keys. An Anthropic key you enter is kept in this browser and sent to Anthropic directly — except that a long-running project-agent job sends it to the proxy with the job, which holds it only until the provider answers and then deletes it. The Companion passes your key to a coding agent as an environment variable, never written to the machine.
Your computer, if you install the Companion. The Companion answers only to its own token and only to koios.dev as an origin; pairing needs a six-character code that lasts fifteen minutes; once a Google account claims a computer, only that account can pair with it. Its settings are readable by your user alone. See The Companion for what the tunnel exposes, since that part is in your hands.
Access is yours to withdraw, at once. Sign out revokes the browser's tokens; myaccount.google.com/permissions withdraws every permission for good; disconnecting GitHub or Overleaf in Settings has the proxy delete the sealed token; Delete my account in Settings does what Deleting your data says.
The code is public. The browser app, the proxy, the Companion and the desktop app are all in the app's repository, so none of these claims has to be taken on trust.

If I ever learn of a breach affecting Google user data, I will tell the people affected by email, without undue delay, and say what was involved and what was done.

The Companion, and your own computer

The Koios Companion is optional. Installed, it runs on your computer under your user, so that the app can keep a project's files there, run code and terminals on your machine, compile LaTeX locally, mount a folder of yours on a compute machine, or share a folder with another computer of yours. Things to know before you install it:

A paired page can run commands on your computer, as you: the Companion serves a Jupyter server with a terminal, guarded by its token. Treat pairing like handing over a terminal.
Once a signed-in account claims it, the Companion opens a tunnel by default — a Cloudflare quick tunnel at a random trycloudflare.com address, or a named tunnel on your own Cloudflare account if you set one up — so that your other browsers and the machines you run code on can reach it from anywhere. Everything the Companion serves is then reachable from the internet by anyone who has its token; the token is held by your browsers (through the proxy's record of your computers), by the proxy for moves, and by a compute machine when that computer is its data place. Mounted and shared folders use a key of their own per folder; the port proxy that shows a live 3D viewer or TensorBoard uses a signed ticket. You can turn the tunnel off with reader-companion release, or run with it off.
Folders. It can list any folder from your home folder down and link one you choose into its root; it refuses to share your whole disk or home folder. To open a page in a browser profile of yours, it reads your browsers' profile lists, which name the Google account each profile is signed in to; it sends none of that anywhere.
Computer to computer. A folder mounted on a compute machine, or shared with another computer, travels over the tunnel directly: the page, the proxy and I are not on that path. A named tunnel's Argo Smart Routing, if you turn it on, is billed by Cloudflare to you.
It updates itself only from koios.dev, and keeps a log of its own on your computer. It sends the proxy a heartbeat every five minutes with the items in the proxy's table above, and nothing of your files.

AI features and coding agents

Three kinds of AI run in or around the app, and they differ in whose account they use:

The app's own features — Ask AI, Explain, the lookup card, the project agent, meeting write-ups — use the model you pick on the site's keys through the proxy, or your own key directly. What they send is itemised under Sharing. The proxy streams these through and keeps nothing of them, except a long project-agent answer, kept a day so it survives the tab.
Coding agents — Claude Code, Codex, Gemini CLI and others — are installed and run on your computer or compute machine under your own account with their provider. The app starts them with the paper and plan in the project folder and web tools off, and files their transcripts beside the project; their logs stay on the machine.
The simulation and experiment tools write run metrics, checkpoints and media to the project's data place — Drive by default — and nowhere else.

Answers you keep go into your notes, in this browser, and into the project's folder where the feature says so. No AI output is used to train anything, by me or by the app.

A project is private until you share it. Sharing one makes a room on the proxy, and every member of the room sees: the members' names, email addresses and Google pictures and their roles; where each member is in the project right now and last; the project's summary — its name, question, start date, to-do list, the list of its papers with their details, where its draft is kept (including the paths of its folders on the computers that hold it) and which repository its code is in; and its logbook — meeting notes with attendees and transcripts, links, the notepad, the whiteboard, and the records of filed experiments. Members never get access to your Drive, your library, your notes or your Ask AI conversations. Viewers can only read; the owner alone changes roles and the join link, removes members, or closes the room, which deletes it.

Inviting someone sends them an email naming you, the project and its question, with a link that lasts thirty days. A personal invite link shows whoever opens it your display name and note. Records of invitations and of the emails sent are kept on the proxy, readable by you for yours and by me for all.

Meetings

The Calendar page shows your events and lets you change them, as above. Three optional features reach outside: Make one creates a Zoom meeting through the site's Zoom account and writes its link into the event; a Granola key of yours fetches Granola's notes for meetings you had it join; and in the desktop app, recording a meeting sends its sound to Recall.ai for transcription, then the transcript to your chosen AI model for a write-up, which is filed in your project's logbook — on the proxy if the project is shared, otherwise in this browser. Recording a meeting is your decision and your responsibility toward the people in it; the app asks for the microphone and screen permissions it needs and records nothing until you start it.

Deleting your data

Everything at once: Delete my account in Settings erases, on the proxy, your usage tallies, sealed tokens, browser-pane cookies and session, computers, kernel records, invitations and personal links, and the rooms you own; leaves the rooms you are a member of with your address removed from what you wrote there; clears this browser's storage and databases; and signs you out. It does not touch your Drive, which is yours; and two things expire on their own rather than at once — an AI answer in progress (within a day) and a move's archive (within seven days).
Piece by piece: delete the Papers_collection folder in Drive yourself; clear site data for koios.dev in this browser, or sign out, which forgets this browser's copy of the library; revoke Google's permissions at myaccount.google.com/permissions; disconnect GitHub and Overleaf in Settings; Forget sign-ins for the browser pane's cookies; forget or release a computer in the Companion; stop sharing a project to delete its room; uninstall the Companion and delete ~/.reader-companion and ~/Reader.
By asking: write to the address below and anything the proxy holds under your account is deleted.

Children

The app is not directed at children under 13, who may not use it, and it knowingly collects nothing from anyone.

Changes

If this policy changes, the date at the top changes with it, and every edit is public in the app's repository, where this page lives as public/privacy/index.html.

Contact

Questions about this policy, or about the app's use of Google user data: es16btech11007@gmail.com.

Koios is open source: github.com/saurav717/reader. Its terms of service are a separate page.