We read your extracts, not your thesis

The question we are asked before any other, by candidates and universities alike, is some version of: what happens to my document?

It is the right question and it usually gets a bad answer — a policy page, a certification badge, a sentence about encryption in transit. Those are real but they answer a different question. Encryption tells you nobody intercepted the file. It does not tell you what was in the file, or who read it once it arrived.

The specific answer is this: what reaches an AI provider is a citation string, the authors and year parsed out of it, and a capped window of the words around it — per citation, one at a time. Never a chapter. Never the document. Never your results, your methods or your discussion as continuous prose.

That is a narrower claim than "we only send a little", and it is the one that is actually true. Below is exactly what goes, how it is bounded, and what that adds up to across a whole thesis — including the part that is not reassuring.

What an extract actually is

A citation check has a narrow appetite. To decide whether (Okonkwo & Ferreira, 2022) corresponds to an entry in your bibliography, the only material needed is that citation string, that entry, and enough surrounding words to tell a citation from a date in a sentence.

In your thesis
  Outcomes improved substantially in the intervention arm,
  particularly for patients admitted outside standard
  hours (Okonkwo & Ferreira, 2022), which contradicts the
  regional finding reported in 2019 by the ministry.

What is extracted
  citation      (Okonkwo & Ferreira, 2022)
  context       "…admitted outside standard hours (…), which
                 contradicts the regional finding…"
  candidate     "reported in 2019 by the ministry"
                 — screened, deterministically, as not a citation

What is not
  your finding, your intervention, your patients, your
  argument, the chapter, the thesis

The context window exists for one reason: to tell a citation from prose that resembles one. "Reported in 2019 by the ministry" has a year and an actor and is not a citation, and distinguishing those two cases needs a few words either side. That is the whole purpose of the surrounding text, and it is why the window is short.

Every citation goes. The window around it is what is bounded.

We should be precise here, because the comfortable version of this claim is not the correct one. There is no filter that sends only the doubtful citations to a model and keeps the rest local. Every harvested citation is reviewed, in batches, and so is every parsed reference entry.

What limits exposure is not how many citations are sent. It is how much of your document travels with each one, and that is fixed in code rather than left to judgement.

authors        Okonkwo, C. B.; Ferreira, L.
year hook      2022
snippet        (Okonkwo & Ferreira, 2022)
context        up to 350 characters of surrounding text

Other decisions use their own caps, for their own reasons:
  confirming a duplicate                 400 characters
  confirming a bibliography match        500 characters
  reviewing an author mismatch           800 characters
  ranking a difficult reference match  1,500 characters

There is no path that sends a chapter, a section, or the
document. The unit is always one citation and its window.

The deterministic layer still does the work that does not need a model — parsing the document, matching strings, resolving identifiers against bibliographic records. That ordering matters for reproducibility, and we have written about testing it against real documents rather than constructed ones. But it is a claim about how answers are produced, not a claim that your citations stay on our machines. They do not.

The honest boundary is the window, not the volume. Nothing is sent as a document.

What we do not do, stated plainly

We do not train models on your work. Not on the thesis, not on the extracts, not on the corrections you accept or reject. The AI in the pipeline is a reasoning step over a handful of strings, not a learner accumulating a corpus. There is no version of the product that improves because you used it, and that is deliberate.

We are not building a research dataset out of customer documents. The annual measurement we publish is built from public theses that institutions have already made openly available — never from documents people uploaded to the tool. Those are two entirely separate corpora and they never mix.

We do not run a suspicion process. There is no report that flags a user, no channel that reports anyone to anybody, and no mechanism for detecting fabricated research data, ghost-writing or plagiarism — none of those are things a citation checker can see. What the tool does establish is narrower and factual: whether a cited source can be resolved to a real record. Where it cannot, that is shown to the person who ran the check, with the evidence, and it goes nowhere else. A reference to work that does not exist is academic misconduct; deciding what follows is not a decision a tool should be making, and the framing an institution applies to the results is theirs to set.

What this does not protect you from

Three honest limits, because a privacy claim without them is marketing.

Your reference list is not secret, but it is informative. A bibliography is published bibliographic data — nobody's personal information — but it does describe your field, your period and your influences fairly precisely. If the mere subject of your work is confidential, that is a real consideration, and the honest answer is that a citation check cannot be run on a document whose citations cannot be seen.

The windows add up. This is the number worth doing yourself. Six hundred citations, each carrying up to 350 characters of context, is on the order of two hundred kilobytes of prose — against a thesis that is perhaps four to six hundred kilobytes in total. Fragmented, non-contiguous, and unreconstructable into chapters, but not a trivial fraction. If your institution's rule is that no portion of an unpublished thesis may reach a third-party processor, this design reduces exposure and does not eliminate it, and the rule is what decides.

We hold your document while the check runs. The file has to be read to be parsed. What we do with it afterwards, and where the working session lives, is a separate subject we cover on its own — the short version is that it is a server-side session rather than something living in your browser, which has consequences worth understanding in their own right.

Why we designed it this way

Not primarily for privacy, though that is the outcome. The original reason is that citation matching is a bookkeeping problem, and bookkeeping should be done by something that produces the same answer twice. The ledger has to balance — every citation read out of the document accounted for in the result — and that guarantee is only available from deterministic work. You cannot promise conservation over a process that reasons freshly each time.

The bounded window fell out of the same reasoning. A model asked to judge one citation needs the sentence it sits in, not the chapter — so the window is cut to what the decision requires and the cut is in the code, not in a policy document. That is a weaker promise than "we barely send anything", and a more durable one, because it does not depend on anybody's restraint.

Which is the version worth trusting. A promise not to look at your thesis is a commitment someone has to keep. A pipeline that never asks for it is a fact about how the thing is built.