TarCite Workspace ("TarCite", "the app", "we") is a desktop application for macOS and Windows. It is designed as a local-first tool: your research files, annotations, and library data are stored on your own machine and are not uploaded to any server operated by TarCite.
This document describes exactly what data TarCite processes locally, what limited data is transmitted externally, why, and under what conditions. We have written this to be specific — not to cover every possible scenario with vague language.
The following data is stored exclusively in a local SQLite database and ChromaDB vector store on your device. It is never transmitted to TarCite or any third party:
API keys you enter for external AI providers are stored only in a local settings.json file on your machine. They are never sent to TarCite's servers.
TarCite makes the following outbound connections. None of these involve your research content, PDFs, or annotations.
| Connection | Destination | What is sent | When |
|---|---|---|---|
| Device registration | api.tarcite.com | A randomly generated device UUID (no personal data, no hardware identifiers) | Once on first launch, non-blocking |
| Crossref metadata lookup | api.crossref.org | A DOI string and a contact email ([email protected]) in the User-Agent header, as required by Crossref's Polite Pool policy |
When a DOI is found in a scanned document |
| AI LLM call (TarCite API) | api.tarcite.com | The paragraph text you submit for citation suggestions or chat, plus retrieved evidence passages from your documents. No file paths, no full documents, no personal data. | Only when TarCite Default or Premium AI profile is active and you initiate a suggestion or chat |
| AI LLM call (custom provider) | Your configured endpoint | Same as above — paragraph text and evidence passages only — sent to whichever API URL you have configured | Only when a custom AI profile is active and you initiate a suggestion or chat |
| AI LLM call (local / Ollama) | localhost only | Nothing leaves your machine | When the Local AI profile is active |
The device UUID is a randomly generated identifier created on first launch and stored in a local file. It contains no personally identifiable information — it is not linked to your name, email, IP address, or hardware. It is used only to count active installs. You can find or delete this file at ~/.citation-workspace/device_id.txt (macOS) or the equivalent path on Windows.
When TarCite detects a DOI in a scanned document, it queries the public Crossref API to enrich metadata (authors, journal, citation count). The query sends the DOI and a contact email in the request header — this is required by Crossref's Polite Pool policy, which gives apps priority access in exchange for identifying themselves. The email used is [email protected]. No content from your document is sent.
When you submit a paragraph for citation suggestions or use the chat feature, TarCite sends that paragraph — and retrieved evidence passages extracted from your documents — to the active AI provider. This is necessary for the AI to evaluate relevance and generate suggestions.
What is not sent: full document text, file paths, annotation data, theme names, personal information, or any data beyond the paragraph and the specific evidence passages the pipeline selected.
To avoid any external data transmission for LLM calls, use the Local AI profile with Ollama — all processing stays on your machine.
The TarCite Default and TarCite Premium AI profiles require a paid subscription managed through api.tarcite.com. The following applies when you purchase or use a subscription:
All payments are processed by Stripe, a third-party payment processor. TarCite does not collect, store, or have access to your payment card details. When you purchase a subscription, Stripe may collect your name, email address, billing address, and payment information in accordance with Stripe's Privacy Policy.
TarCite receives from Stripe only a confirmation of successful payment and a subscription identifier — no card numbers or full billing details.
If you provide an email address during checkout (via Stripe), that email may be used by TarCite to deliver your API key and send subscription-related notices (e.g. quota alerts, renewal reminders). It will not be used for marketing without your explicit consent.
When you use the TarCite API (Default or Premium profile), your paragraph text and evidence passages are sent to api.tarcite.com, which acts as a gateway. The gateway then forwards your request to a third-party AI provider on your behalf. The specific provider may vary and is managed by TarCite. TarCite does not log, store, or use your request content — only aggregate usage statistics (token counts, request counts) are recorded for quota tracking. However, the AI provider that receives and processes your request is subject to its own data handling practices.
When you use a custom third-party AI provider (e.g. OpenAI, Mistral, or another custom endpoint), your data is sent directly to whichever API URL you have configured and is subject to that provider's privacy policy and terms. TarCite has no control over how those providers handle data. You are responsible for ensuring your use complies with your institution's policies and any applicable research ethics requirements.
When you use the Local AI profile (Ollama), no data is sent anywhere. All processing happens on your device.
Because TarCite stores your data locally, you have complete control:
device_id.txt at any time. A new UUID will be generated on next launch.If you are located in the European Economic Area, you have rights under the GDPR including the right to access, rectify, and erase personal data. Given that TarCite holds no personal data on its servers (the device UUID is non-identifying), there is nothing to request deletion of beyond what you control locally. For any questions, contact [email protected].
By downloading, installing, or using TarCite Workspace, you agree to these terms. If you do not agree, do not use the app.
TarCite Workspace is provided free of charge for personal and academic use. You may install and use the app on machines you own or control. You may not redistribute, resell, reverse-engineer, or create derivative works from the app without written permission.
You agree to use TarCite only for lawful purposes. You are solely responsible for the content of the files you add to the app, and for ensuring that your use of any connected AI provider complies with that provider's terms and your institution's policies.
TarCite is provided "as is", without warranty of any kind, express or implied. We make no guarantees about the accuracy of citation suggestions, metadata enrichment, or AI-generated outputs. Citation suggestions should always be verified by the user before inclusion in academic work.
To the maximum extent permitted by applicable law, TarCite and its authors shall not be liable for any indirect, incidental, special, or consequential damages arising from your use of the app, including but not limited to loss of research data, incorrect citations in published work, or any claim arising from AI-generated content.
TarCite integrates with third-party services (Crossref, AI providers). Your use of those services is governed by their respective terms and policies. TarCite is not responsible for the availability, accuracy, or conduct of those services.
TarCite is a tool to assist researchers in finding and formatting citations. It does not generate citations from scratch — all suggestions are grounded in your own library with evidence passages from your actual documents. Users are responsible for verifying suggestions and complying with their institution's academic integrity policies.
These terms are governed by the laws of the Republic of Indonesia. Any disputes shall be resolved in the courts of Indonesia, without regard to conflict of law principles.
We may update this policy as the app evolves. Material changes will be noted in the app's release notes and reflected in the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.
For privacy questions, data requests, or anything related to these terms, contact us at [email protected].