Trust before scale

Your data, and what we do with it

Lazy Research Lad is a suite of research tools. This page explains, plainly, where your work is stored, what leaves your device, and the controls you have. The short version: it's local-first and yours by default — the cloud is something you opt into, not out of.

Last updated: 20 October 2026

The four principles

Local-first

By default, your work lives only in your browser on your device. You can use every tool without an account.

Opt-in cloud

Cloud sync only happens after you sign in. It's off until you choose it, and it never removes the local copy.

Your data is isolated

When synced, row-level security means you can only ever read or write your own projects — never anyone else's.

No dark corners

You can export or delete your data at any time. We don't sell it, and we don't run ads.

Where your data lives

1 · On your device (the default)

Every tool works with no account. It stores your work in your browser's localStorage, keyed to that tool. Clearing your browser data, or using a different browser or device, means that local work won't follow you — that's the trade-off the cloud option below addresses.

2 · In the cloud (only if you sign in)

If you create an account on the hub, you can sync work to a hosted database (Supabase). Sign-in is via Google or a one-time email link. What's stored:

Projects — a named workspace per research project, owned by your account.
Per-tool state — each tool saves its slice of the active project (your draft, your plan, your library, and so on).
A preference — which project is "active", so it follows you across devices.

Access is enforced by per-user row-level security at the database: a signed-in account can only ever touch its own rows. The public key shipped in the app is designed to be public precisely because that rule, not the key, is what protects your data.

What each tool stores

Tool	What it keeps
IdeaBox	Your captured ideas and tags.
Wordmap	Only your theme preference — no personal data.
PaperCards	Your saved paper library and comparisons.
ResearchFlow	Your research plan (question, theory, design, etc.).
TheoryScope	Recent queries and saved comparisons.
ScaleScope	Browsing only; computations run locally in your browser.
Cadence	Study definitions and collected responses (see below).
ToolsScope	Datasets you load and the analyses you run — computed entirely in your browser.
JournalTime	Your article drafts and journal shortlist.

AI features

Several tools offer an AI "Generate" step. When you use one, the text you submit — a topic, an abstract, a draft — is sent to a third-party AI provider (such as Groq or Google) to produce the response. A few things to know:

Lazy Research Lad's own backend is stateless for these calls: it relays your request to generate a reply and does not keep your prompts.
Once text reaches an AI provider, that provider's terms govern how it's handled — which is outside Lazy Research Lad's control.
Practical rule: don't paste anything into an AI feature that you wouldn't be comfortable sharing with a third-party service. AI features are optional; the rest of each tool works without them.

Counting page views

Each time a page on one of the sites opens, it sends one anonymous count: which site and page, the website you came from (just its name, e.g. "google" or "linkedin"), and your country (worked out by the host, not stored as an IP address). Your browser also keeps a note of the date, so the first visit of the day can be counted separately. There are no cookies, no IDs and no third-party analytics, and the counts can't be linked back to you.

The "Who's visiting?" questionnaire

After about two minutes on one of the sites, a small card may ask who you are, what brings you here and where you could use help. It is optional and appears once per browser: answer it or choose "Don't ask again" and it won't return; "Not now" asks again after two weeks.

What is sent if you answer: your taps, any note you type, the site and page you were on, and your country (worked out by the host from your connection, not your IP address, which is never stored). Your email only if you choose to add one, so we can reply.
What is sent if you don't: an anonymous count that the card was shown or dismissed on that site. Nothing that identifies you.
Where it goes: a small private database read only by the person who builds Lazy Research Lad, to decide what to improve. It isn't shared or sold, and it isn't linked to any account.
Delete a reply: email syedfaceprep@gmail.com with roughly when you answered.

Research participant data

Cadence collects survey responses. Before any survey begins, participants are shown an informed-consent notice (voluntary, anonymous, withdrawable) and must actively consent; the time of consent is recorded with their response. Today, responses are stored in the browser, keyed to the study. Participants can pull out a copy at any time with "Download my data," or erase everything they submitted from the device with "Delete my responses."

Cloud collection of participant data is deliberately not enabled yet. Holding other people's data at scale carries real obligations — consent, ownership, retention, deletion, and ethics-board review. We're building that governance layer before turning on cloud-backed participant collection, rather than after. Until then, participant data stays on the researcher's device.

Your controls

Export — tools offer downloads (e.g. Cadence "Download my data", ToolsScope CSV/Word, others as JSON). Your data is never trapped.
Delete — clear a tool's local data via your browser; delete a cloud project from the hub dashboard (it's removed from the database).
Sign out — ends the session and clears the active-project pointer on that device.
Stay anonymous — simply don't sign in. Everything still works, locally.

For ethics boards & IRBs

If you're reviewing a study run with these tools, here is the data posture in brief:

Informed consent. Cadence shows participants a voluntary, anonymous, withdrawable consent notice before the survey starts; consent must be given to proceed and is timestamped with the response.
Local-first by default. Without an account, all data — including any participant responses in Cadence — stays in the researcher's own browser.
Cloud sync is opt-in and currently scoped to the researcher's own working artifacts (plans, drafts, libraries), not pooled participant data.
Per-user isolation. Synced data is protected by database row-level security; accounts cannot access each other's data.
Export and deletion are available at every stage, supporting data-subject requests and retention limits.
No secondary use. Data is not sold, and there is no advertising.
AI is explicit and optional. Text is sent to a third-party provider only when a user invokes an AI feature; researchers are advised not to submit identifiable participant data to it.

Questions or a data request? Contact syedfaceprep@gmail.com.

This document describes the suite as it works today and will evolve as the governance layer above lands. It's a plain-language summary, not a contract.