Privacy Policy

This policy explains what personal data Milton collects, why we collect it, and what we do with it. Milton is operated by Pierre Jacquel, an individual based at 78 avenue de Paris, 94800 Villejuif, France ("we", "us", "our"). We're the data controller for the personal data described below.

The short version: Milton is local-first, so the notes, references, PDFs and other content you create live on your device. On the free plan that is the only copy — we hold none of it. Two things change that on the paid plan: cloud backup, which copies your library to servers we manage so you can restore it and sync it across devices, and which is part of the paid plan rather than an option you switch on (see section 5); and our AI features, which are opt-in and send the content you're working with to a third-party AI provider to generate a response (see section 6). Otherwise, the only personal data we hold is what we strictly need to run your account, take payments, and keep the product working.

1. What data we collect

Here's everything we touch, in plain English:

Account data

• Your email address (so you can sign in and we can reach you).
• An authentication token issued when you sign in (so we know it's you on the next request).
• A device record for each computer you sign in on — an identifier, a public key generated on that device, and when it was last used. It's how we recognise your machines and authorise one of them to fetch your files. The matching private key never leaves your device, and we never receive it.
• Optional profile fields you choose to add.

Billing data

• Your subscription tier and status, the amount you paid, and the date.
• We do not see or store your full card number — payment details are handled directly by our payment processor (Polar).

Product analytics

• Anonymous or pseudonymous usage events (which features are opened, error reports, app version, OS) so we can fix bugs and prioritise what to build next.
• We don't track the contents of your notes or references — just product interactions.
• You can disable analytics from the Milton settings at any time.

Website data

• Standard server logs (IP address, browser, page visited, timestamp) for security and debugging.
• Limited analytics on visits to milton.so, used for the same product-improvement reasons.

Support emails

• If you email us, we keep the message and your address so we can reply and find context later.

Referral data

• Your referral code, and — if someone signs up with it — a record linking the two accounts, including whether the two of you have used the same device.
• If you invite someone by email, a salted, one-way hash of their address. We don't store the address itself.

Both are set out in full in Referrals & invites (section 7), including the part that deliberately outlives an account deletion.

Your research content

Your notes, references, PDFs, tags, projects, collections and other Milton content are created and stored on your device, in a local SQLite database. Whether we ever hold a copy depends on your plan:

• Free plan — we hold nothing. There is no cloud copy. We don't see your content and can't access it. The flip side: your device holds the only copy, so an uninstall or a lost machine loses it, and we cannot recover it for you.
• Paid plan — your library is backed up to servers we manage, so it can be restored and kept in step across your devices. This is part of what the paid plan is, not a setting: there is no on/off switch, and upgrading turns it on. Exactly what is stored, where, how it's protected and for how long is set out in Cloud backup & sync (section 5).
• Either plan, if you use the AI features — the content involved in an AI request is sent to our AI provider to generate your response. AI is opt-in and separate from backup. See AI features & third-party processing (section 6).

2. Why we use your data

• To run your account — sign-in, password resets, plan management.
• To take and manage payments, issue receipts, and handle refunds.
• To support you when you contact us.
• To improve Milton — fix bugs, understand which features are useful, and decide what to build next.
• To keep things secure — detect abuse, prevent fraud, comply with the law.

3. Legal basis (GDPR)

If you're in the EU/UK, here's what we rely on under GDPR:

• Contract — to provide you with Milton (account, billing, support).
• Legitimate interests — to improve the product, keep it secure, and prevent abuse, in a way that doesn't override your rights.
• Consent — for optional analytics, where you can opt in or out.
• Legal obligation — for things like keeping invoices for tax purposes.

4. Who we share data with

We don't sell your data — ever. We share the minimum necessary with a small number of trusted sub-processors who help us run the service:

• Supabase — authentication and account data, and — on the paid plan only — your library metadata (see section 5).
• Cloudflare — object storage (R2) for your PDF files, on the paid plan only. The storage bucket is in Cloudflare's EU jurisdiction, so those files are held in the EU.
• Polar — payment processing and subscription management.
• PostHog — product analytics.
• Anthropic, PBC — AI model provider for chat-with-PDF and other AI features (see section 6).
• Mistral AI — text recognition (OCR) for scanned PDFs. If a PDF has no readable text layer and you ask Milton to process it, its page content is sent to Mistral to be transcribed (see section 6).
• Voyage AI — text embeddings. To make your documents searchable by meaning, extracted document text is sent to Voyage to be converted into numerical vectors (see section 6).
• Our hosting provider — to serve the website and any back-end services.
• Email provider — for transactional and support emails.
• Resend — delivery of referral invite emails, sent from invites@milton.so (see section 7).

Each of these has its own privacy policy and is bound by data-processing agreements with us. We may update this list as the product evolves; we'll keep this page current.

We may also disclose personal data if we're legally required to (court order, valid law-enforcement request, etc.).

5. Cloud backup & sync

Milton's paid plan includes cloud backup: a copy of your library on servers we manage, so you can restore it if your machine dies and keep it in step across devices. This is the part of Milton where "local-first" stops being the whole story, so we'd rather over-explain it than let you assume something that isn't true.

Being precise about the trigger, because it decides whether any of this applies to you: backup is part of the paid plan, not a setting inside it. There is no on/off switch in the app — a free account has no cloud copy, and a paid account is backed up automatically. If you do not want your library on our servers, the free plan is the configuration that guarantees that.

If you're on the free plan

We hold no copy of your research content at all — there is nothing to describe here, and nothing we could hand over or lose. The trade-off is real and worth stating: your device holds the only copy, and if you uninstall Milton or lose that machine, the content is gone and we cannot restore it. One thing below still applies to you: Milton does not encrypt its local database, on any plan — see How it's protected.

If you're on the paid plan

• Your library metadata — references and their bibliographic details, tags, collections, projects, notes and PDF annotations, plus your saved filters and app settings — is stored in our database, under your account, hosted by Supabase.
• Your PDF files are stored in object storage we manage — Cloudflare R2, in Cloudflare's EU jurisdiction.
• The text of your documents is stored too, and we'd rather say so than let "metadata" cover it. To search your library by meaning and to answer questions about a paper, Milton extracts each PDF's text — including pages transcribed by OCR when the file is a scan — and turns it into numerical vectors. Both the extracted text and the vectors are backed up alongside the metadata, in the same Supabase database. They are backed up rather than recomputed for a plain reason: rebuilding them on a new machine means paying our OCR and embedding providers a second time for work you already have.
• Your AI conversations are backed up too. The questions you ask Milton and the answers it gives are stored alongside the rest of your library, in the same Supabase database, so they come back when you restore onto a new machine. This happens automatically, the same way your references, notes and annotations do. Images you attach to a chat are the one exception — they are never uploaded. They stay on the device you attached them from, and a restored conversation shows the description Milton wrote of the image rather than the image itself.

How it's protected — and the limits of that

• In transit — everything travels over TLS (HTTPS).
• At rest — your PDF files are encrypted at rest in Cloudflare R2. R2 encrypts every stored object with AES-256 automatically, without us having to opt in (see Cloudflare's R2 data security documentation). Your library metadata, extracted document text and vectors sit in our Supabase Postgres database, which Supabase encrypts at rest with AES-256 (see Supabase's security page).
• The database on your own machine is not encrypted. Milton does not encrypt its local SQLite file. Anyone with access to your computer and your user account can read it, so your device's own disk encryption and login password are what protect it there.
• There is no end-to-end encryption, and we won't imply otherwise. Encryption at rest protects your files from someone getting at the underlying storage; it does not mean we are technically unable to read them. True end-to-end encryption is mathematically incompatible with storing a single shared copy of an identical file, and we chose that shared copy (see below). If end-to-end encryption is a requirement for your work, the paid plan's cloud backup is not right for you — and since backup follows the plan rather than a setting, the free plan is the way to use Milton with no copy on our servers.

PDFs are deduplicated across users — and what that does not mean

Researchers store the same published papers as each other, so we store one copy of an identical file rather than one copy per user. Files are identified by a fingerprint (a SHA-256 hash) of their contents, and if the file you back up is byte-for-byte identical to one already stored, it points at the same object.

This does not give anyone access to anyone else's files, and it is worth being precise about why. You only ever get a reference to a file you have yourself uploaded: to obtain one you must actually transmit the bytes, and the storage layer verifies that what you sent matches the fingerprint you claimed. Knowing — or guessing — another user's fingerprint gets you nothing, and asking for a file you have never uploaded returns nothing. Deduplication saves us storage; it never widens who can reach your document.

How long a deletion stays recoverable

On the paid plan, deleting something doesn't erase it from our side immediately — it's marked as deleted and stays recoverable for 30 days, so you can undo an accident from Milton's Backup settings. After that, a scheduled sweep removes it permanently, including the PDF bytes once no user references that file any more. Two boundaries worth knowing:

• This covers deletions, not edits. Restoring brings back what was removed; it does not roll an edited note back to an earlier wording.
• If a paid subscription lapses, your cloud data stays restorable for 90 days before it enters the ordinary deletion clock.

Deleting your account is covered separately in section 9.

6. AI features & third-party processing

Milton includes optional AI features (for example, chat with your PDF). Alongside cloud backup, these are the ways your content leaves your device: to generate a response, the relevant content — the text of the PDF you're asking about, related reference data, and your question — is sent to our AI provider, Anthropic, PBC ("Anthropic"). If you never use the AI features, nothing in this section is done with your content. It does not switch cloud backup off, though: backup follows your plan rather than a setting, so on the paid plan section 5 applies whether or not you ever touch AI.

Two other providers are involved in preparing your documents. If a PDF is a scan with no readable text layer, its page content is sent to Mistral AI to be transcribed (OCR) so it can be searched and used in chat. To power search-by-meaning, extracted document text is sent to Voyage AI to be turned into numerical vectors. Both act as processors on our instructions, under data-processing terms, and neither is used to train models on your content.

What Anthropic does with it. Anthropic processes the content only to produce the AI response. Under Anthropic's commercial and API terms, Anthropic does not use this content to train its models. However, like most cloud AI providers, Anthropic may retain inputs and outputs for a limited period (up to around 30 days) to detect and prevent misuse, and longer where it is legally required or where content is flagged. In other words, an AI request is processed by a third party — we can't describe the provider's handling of it as fully private, and we won't pretend otherwise. For the details, see Anthropic's Commercial Terms and Privacy Center.

What we store. Milton's own systems (our AI metering gateway and our database) record only usage metadata for each AI request — things like token counts, the credits it consumed, and the provider's cost — so we can meter your plan and keep the service running. The AI pipeline itself keeps none of the content: the request we send, your question and the model's answer are not written to our metering systems as they pass through.

Your saved conversations are a separate matter, and on the paid plan they are backed up. The transcript Milton keeps so you can reopen a chat lives on your device, and — if you are on the paid plan — in your cloud backup along with the rest of your library, so it returns when you restore onto a new machine (section 5). The distinction is worth stating plainly rather than leaving to be inferred: the gateway that meters an AI request stores none of its content, and your backup stores the conversation it produced. Images you attach to a chat are never uploaded either way.

That is a statement about the AI pipeline, not about our servers as a whole, and the difference matters. On the paid plan, cloud backup separately stores your PDFs, your library metadata and the text extracted from your documents — which is the same text an AI request draws on. So "we don't keep your AI requests" does not mean "we don't hold the underlying text": on a paid plan we do, through backup, as set out in section 5. On the free plan we hold neither.

7. Referrals & invites

Every Milton account has a referral code. Share it, and when someone starts using Milton with it you both earn AI credits. Two parts of that involve personal data the rest of this policy doesn't cover: inviting someone by email means handling the address of a person who never signed up for anything, and the record that pays the reward is deliberately built to outlive an account deletion. Both are set out here in full.

If you send an email invite

• The address you type is passed to our email provider, Resend, so the message can be delivered. On our side we keep only a salted, one-way hash of it — our invite records have no column that could hold the address itself.
• The invite is sent from invites@milton.so. Your name appears in the subject and the message — and if you haven't set one, your email address appears there instead. Either way your own address is the reply-to, so a reply reaches you rather than us. If you'd rather not hand your address to the people you invite, share your code or link directly instead of using the email invite.
• You can send 10 invites in any 24 hours, and 100 in total. If the address already belongs to a Milton account, nothing is sent.

If someone invited you and you don't use Milton

Your address reached us one way only: a Milton user typed it into the invite box. We didn't buy it, scrape it, or take it from a list. We used it to send you one message, and we didn't keep it: what remains in our database is a salted hash, which can't be reversed and holds no name, no address and no identifier. The one place your address does still exist is the sending log of Resend, the provider that delivered the message for us — under their retention, and only ever on our instructions. They're listed in section 4.

That hash is there to make one promise enforceable: exactly one invite is ever sent to an address — ever, and not just by the person who invited you. There are no reminders and no follow-ups. There's no list to unsubscribe from, which is why the email carries no unsubscribe link, and no tracking pixel or images either.

Our lawful basis is legitimate interests (GDPR Article 6(1)(f)) — our interest in Milton being recommended by the people who use it, weighed against a message that is one-off, untracked, and answerable to a real person rather than to us. If you'd still rather we removed the record, email hello@milton.so. Because we hold a hash and not your address, tell us the address and we can recompute the same hash and delete the row — with one trade-off worth knowing: that row is also what guarantees you're never invited again, so removing it makes your address invitable once more.

Opening an invite link

A milton.so/r/… link works without an account, and shows the first name of the person who shared it when they've set one — so if you publish your referral link, that much is visible to anyone who opens it. Visiting the page is an ordinary visit to our website, covered by the server logs and limited analytics in section 1; the page's address contains the code, so it appears in those records like any other URL. Beyond that, the link records nothing about you: checking whether a code is real happens on our own server, so that check never sees your device or your IP address.

What a redeemed code leaves behind — including after you delete your account

When someone signs up and enters a code, we write one record: which two accounts it links, the code used, the date, a salted hash of the new account's email address, and a yes/no flag for whether the two accounts have used the same device — set by comparing the device records described in section 1, and never used to block a referral. The record is what pays the referral reward. The hash is what stops one person redeeming a code over and over by deleting their account and signing up again; the device flag is how we see whether people are referring themselves from a second account.

So it is built to outlive the account, and we'd rather say that plainly than let "we delete your data" quietly cover it. Deleting your Milton account removes the account, your library, your cloud backup and the identifiers tying this record to you — but the record stays, and so does the email hash. What's left carries no name, no address, and — once both accounts are gone — no account ID, can't be turned back into an address, and is put to two uses only: refusing a second referral redemption from the same address, and counting how often referrals link accounts that shared a device, so we can tell whether the programme is being gamed. The hashes behind email invites survive for the same reason — if they went with the sender's account, every address that account had invited would become invitable again.

Both kinds of hash are kept indefinitely: one that expired would re-open the loop it exists to close. The reward records themselves — account IDs and credit amounts, no addresses — are deleted with the account. If you want the redemption record removed as well, ask us at hello@milton.so.

8. International transfers

Some of our sub-processors are based outside the EU/EEA (for example in the United States). When personal data is transferred internationally, we rely on safeguards approved by the European Commission — typically Standard Contractual Clauses — to make sure your data stays protected.

9. How long we keep your data

• Account data — for as long as your account is active. If you delete your account, we remove it within 30 days, except where law requires longer retention and for the one narrow exception in the referral bullet below.
• Backed-up library content (paid plan) — for as long as your paid account is active. Something you delete stays recoverable for 30 days and is then swept permanently; if your subscription lapses, your cloud data stays restorable for 90 days first. Deleting your account removes it on the account-data timetable above. See section 5.
• Billing records — kept for up to 10 years to comply with French tax and accounting law.
• Analytics events — typically retained for up to 24 months in pseudonymous form, then deleted or aggregated.
• Support emails — kept for up to 3 years so we can give you context if you write back.
• Referral hashes — the salted email hashes behind the referral programme are kept indefinitely, including after the account they relate to is deleted. They hold no address and no identifier, and exist only to stop a referral being claimed twice. Section 7 explains what they are, why they outlive the account, and how to ask us to remove one. Referral reward records are deleted with the account.

10. Your rights

If you're in the EU/UK (and in many other places), you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectify — correct anything that's wrong or incomplete.
• Erase — ask us to delete your data ("right to be forgotten").
• Restrict or object to processing in certain cases.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with your local data-protection authority. In France, that's the CNIL.

These rights cover all the personal data we hold about you, including your account data and the AI usage data (credits and usage metadata) tied to your account — you can ask us to access or delete it. To exercise any of these rights, email us at hello@milton.so. We'll respond within one month.

11. Cookies & similar technologies

The Milton website uses a small number of cookies and similar technologies — essential ones to make the site work (e.g. remembering your session), and optional ones for analytics. You can refuse non-essential cookies through your browser settings, and we'll add a clear cookie banner if and when we deploy any non-essential trackers.

The Milton desktop app stores its data on your device using standard OS storage (SQLite database, application support folder) — and, on the paid plan, also on our servers as described in section 5. It does not set cookies in the traditional web sense.

12. Data security

We take security seriously. We use encryption in transit (HTTPS) for all communication with our servers, encrypted storage on the back-end — including automatic AES-256 encryption at rest for backed-up PDF files in Cloudflare R2 — and we limit access to personal data to the few people who actually need it. What we do not offer is end-to-end encryption, and section 5 explains why and what follows from it. No system is 100% secure — but we do our best, and we'll tell you promptly if a breach affects you.

13. Children

Milton is not designed for children under 13. We don't knowingly collect data from anyone under 13, and if we discover we have, we'll delete it.

14. Changes to this policy

We may update this policy from time to time as the product evolves or the law changes. When we do, we'll update the "Last updated" date at the top of this page, and for material changes we'll notify you by email or in the app before they take effect.

15. Contact

Questions about your data, this policy, or anything privacy-related? Email us at hello@milton.so. A real human will answer.