The Terms of Service, Privacy Notice, Cookie Policy, Acceptable Use Policy, Security Overview, and subprocessor list below govern Collab Writer, operated by MAGE Innovation Corp, incorporated in the Commonwealth of Massachusetts, United States ("Collab Writer", "we", "us").
Last updated 10 November 2026.
These Terms of Service ("Terms") are a binding agreement between you and MAGE Innovation Corp ("Collab Writer", "we", "us"), a company incorporated in the Commonwealth of Massachusetts, United States. By creating an account or using Collab Writer (the "Service"), you agree to these Terms, the Acceptable Use Policy, and the Privacy Notice below.
You must be at least 18 years old, or the age of majority where you live, and legally able to enter this agreement. We ask for your date of birth when you create an account in order to confirm this, and accounts that do not meet the minimum age are refused. You sign in through Firebase Authentication using Google or an email address and password; you must verify your email address. Keep your credentials confidential, use the Service only under an account registered to you, and tell us promptly at support@collab-writer.com if you suspect unauthorized access. You are responsible for all activity under your account.
Collab Writer is a collaborative environment for writing documents (academic papers, work, and school projects): a structured editor, real-time co-editing, LaTeX and PDF and Word (docx) output, reference management, and optional AI writing assistance. We offer a free plan and a paid "Pro" plan. We may add, change, or remove features, and we may run beta features that are provided as is and may change or be withdrawn.
You keep all ownership of, and intellectual property rights in, the documents, uploads, images, comments, and messages you create or provide ("Your Content"). We do not claim ownership of Your Content.
You grant us a limited, non-exclusive, worldwide, royalty-free license to host, store, copy, transmit, render, reformat, and display Your Content, and to convert it between formats (for example between the editor model, LaTeX, PDF, and docx), solely to operate and provide the Service to you and to the collaborators you invite. This license ends when you delete the content or close your account, except for copies retained transiently in backups or as required by law.
You are responsible for Your Content, for having the rights to use and share it, and for what you choose to make available to collaborators. You should keep your own backups of important work.
You can invite other people to a document and grant them access. Collaborators you invite can view and edit the content you share with them, and may copy it. You are responsible for choosing who to invite and what to share. Access to a document is inherited by its appendices.
Collab Writer lets you use optional third-party AI models. Except for CollabAI, described below, these models run on an API key you provide. The providers you can choose from are Anthropic (Claude), OpenAI (GPT), Google (Gemini), Perplexity, DeepSeek, and SpaceXAI (Grok). When you invoke an AI feature, the prompt and the document context you submit are transmitted to the provider you selected and processed under that provider's terms. DeepSeek is operated from China, so if you choose it your content is processed there. We do not use Your Content to train AI models. AI output is generated automatically, is provided as is, may be inaccurate or unsuitable, and you are responsible for reviewing it before you rely on it. API keys and tokens you store with us are encrypted at rest and are never shown back to you or to any other user.
CollabAI is a Socratic writing coach that runs on our OpenAI account rather than on a key you provide, and it is included with Pro: a Pro plan carries a monthly allowance of coaching, and a separate smaller allowance for questions where you ask it to read your whole paper. When an allowance runs out the feature pauses until the next month; the other AI features, on your own key, are unaffected. When you use CollabAI we send OpenAI the passage you are working on, your question, and the recent exchange, or your whole paper on a turn where you ask it to read the whole paper. CollabAI does not write in your document: it asks questions and comments on what you have written, and every change to your text remains yours to make.
CollabAI can also run on an API key you provide, on any plan. It then works like the other AI features: your prompt and document context go to the provider you chose, under that provider's terms, and no allowance applies.
Pre-submission review writes a referee-style review of a paper before you submit it. It runs on an OpenRouter account you connect, never on ours: OpenRouter bills you for each review under its own terms, and you are responsible for the charges and fees on your OpenRouter account. A review stops before it spends more than the cap you set when you start it, and we limit how many reviews you can start each day. Only the owner and the editors of a paper can start a review of it, and a case-study document cannot be reviewed. A finished review is shown only to you, in the Review tab, until you move it to a new appendix of the paper. Everyone who can open the paper can read that appendix, and you can edit or delete it like any appendix. A review is generated automatically and may be mistaken; it is an opinion for you to weigh, not an assessment by us, by a journal or by any reviewer.
Module safety review checks each version of a module that you submit to the module catalogue, if you have Pro. An AI model does the review on our OpenRouter account, and you pay nothing more for it. Without Pro, you can still submit a module, and a person at Collab Writer reviews it without the AI review. The review can block a version, raise its level, or send it to a person for a closer check. It never approves a version: a person at Collab Writer reviews each version before other writers can see it. If the review blocks your version, you see its findings, and you can correct the module and submit it again, or appeal to a person. The summary on a module's page comes from the review, and a person at Collab Writer approves it with the version. A review is generated automatically and can be wrong; it is not an assessment of the module by us.
Code modules that you install can send text to an AI provider only if they ask for that permission, which the install screen shows as level 3, Risky, and you confirm. Such a module's requests go to the providers it names, on the API key you saved for that provider, and never on our account. You set a monthly limit for each module when you install it, and its requests stop when the limit is reached. What a module sends, and when, is decided by the module's code, so install such modules only from people you trust. The provider processes those requests under its terms, as with the other AI features. We record how much each module spent in each month and how many requests it made. We do not store what it sent or received: the list of a module's requests and answers that Collab Writer shows you is kept only in your browser.
Mind map draws a map of a paper's key claims and how they connect. It runs on an API key you provide, on any plan, and never on our account: when you generate a map, we send the text of the paper, without its appendices, to the provider you choose, under that provider's terms. Only the owner and the editors of a paper can generate or change its map, and a case-study document cannot have one. The map is stored with the paper, holds short quotations from it, and can be seen by everyone who can open the paper. You can also ask an AI tool you connect to Collab Writer to draw the map, on your own account with that tool; its map is a proposal that changes nothing until an editor of the paper accepts it. It is generated automatically and may be mistaken or incomplete; it is a reading of your paper for you to check and edit, not an assessment by us.
Canvas is a whiteboard for a paper, on which an AI can draft a diagram of the paper, such as its conceptual model or its research design, for you to edit. It runs on an API key you provide, on any plan, and never on our account: when you ask for a diagram, we send the text of the paper, without its appendices or its reference list, and the details you add to your request, to the provider you choose, under that provider's terms. Only the owner and the editors of a paper can draw on its Canvas or ask for a diagram, and a case-study document cannot have one. The Canvas is stored with the paper, holds what its editors draw and the short quotations from the paper that a diagram's boxes cite, and can be seen by everyone who can open the paper. You can also ask an AI tool you connect to Collab Writer to draft a diagram, on your own account with that tool; its diagram changes nothing until an editor of the paper places it on the Canvas. A diagram is generated automatically and may be mistaken or incomplete; it is a reading of your paper for you to check and edit, not an assessment by us.
You may choose to connect optional third-party services, currently Zotero, Mendeley, Google Drive, Microsoft OneDrive, and Dropbox. If you publish modules, you may also link a LinkedIn or GitHub account, which your published modules then show (see the Privacy Notice). When you connect one, you authorize us to access it on your behalf within the scope you grant, so we can import references or attach files you select. Your use of those services is governed by their own terms and privacy policies. You can disconnect them at any time.
The free plan is subject to usage limits, which may include caps on document length, storage, uploads, and features. Pro is a paid subscription billed through Stripe on a recurring basis until you cancel. You authorize recurring charges to your payment method. Prices are exclusive of taxes unless stated, and you are responsible for any applicable taxes. We may change prices, and will give notice before a change takes effect on renewal. You can cancel at any time in your account settings; cancellation takes effect at the end of the current paid period, and fees already paid are non-refundable except where required by law. We do not store your full card details; Stripe processes payments.
You must comply with the Acceptable Use Policy. Compilation, import, export, and AI features are subject to fair-use limits and per-user rate limits. You must not use the Service as an automated processing engine or API for external systems, or generate requests in volumes inconsistent with individual human use.
The Service, including its software, design, and branding, is owned by us or our licensors and is protected by intellectual property laws. We grant you a limited, revocable, non-transferable license to use the Service for its intended purpose. You must not copy, resell, reverse engineer, or create derivative works of the Service, or remove any proprietary notices, except to the extent the law does not permit that restriction.
You can close your account at any time in your settings. We may suspend or terminate your access if you breach these Terms or the Acceptable Use Policy, fail to pay, or where we must for legal or security reasons. Where practical we will give notice and a reasonable opportunity to export Your Content. After termination we may retain limited data and backups as needed to comply with law, resolve disputes, and enforce our agreements.
The Service is provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Service will be uninterrupted, error-free, or that compiled output or AI output will be accurate. You use the Service at your own risk and are responsible for keeping your own backups.
To the fullest extent permitted by law, we will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill. Our total liability arising out of or relating to the Service is limited to the greater of the amount you paid us in the twelve months before the claim, or USD 100. Some jurisdictions do not allow certain limitations, so parts of this section may not apply to you. Nothing in these Terms limits liability that cannot be limited by law.
You agree to indemnify and hold us harmless from claims, losses, and reasonable expenses arising out of Your Content or your breach of these Terms or the Acceptable Use Policy, except to the extent caused by us.
We may update these Terms. If a change is material, we will notify you by email or in the app before it takes effect. Your continued use of the Service after a change takes effect means you accept the updated Terms.
These Terms are governed by the laws of the Commonwealth of Massachusetts, United States, without regard to conflict-of-law rules. You and we agree to the exclusive jurisdiction of the state and federal courts located in the Commonwealth of Massachusetts for any dispute, except that either party may seek injunctive relief where appropriate. This does not remove any mandatory consumer rights you have under the law of your place of residence.
These Terms are the entire agreement between you and us about the Service and supersede prior agreements. If any provision is unenforceable, the rest remains in effect. Our failure to enforce a provision is not a waiver. You may not assign these Terms; we may assign them to an affiliate or successor. We are not liable for delays or failures caused by events beyond our reasonable control. Legal notices to us should go to legal@collab-writer.com.
Back to topThe data controller is MAGE Innovation Corp, incorporated in the Commonwealth of Massachusetts, United States. For any privacy request, contact privacy@collab-writer.com.
The documents, uploads, images, comments, and messages you create ("Your Content") are yours. They are governed by the ownership and license terms in the Terms of Service (section 3), not treated as data we collect for our own purposes. We host and process Your Content only to run the Service for you: to store, sync, render, compile, export, and share it with the collaborators you invite. We do not sell Your Content, use it for advertising, mine it for analytics, or use it to train AI models. It is sent to an AI provider only when you invoke an AI feature, as described below.
We use personal data to provide and operate the Service, authenticate you, enable collaboration, process payments, send transactional email such as verification and notifications, respond to support requests, keep the Service secure and prevent abuse, comply with legal obligations, and improve the Service.
Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure the Service, prevent abuse, and improve our product); your consent (for optional integrations and non-essential communications, which you can withdraw); and compliance with legal obligations.
When you use AI features, your prompt and document context are sent to the AI provider you select (Anthropic, OpenAI, Google Gemini, Perplexity, DeepSeek, or SpaceXAI Grok) under that provider's terms. DeepSeek is operated from China, so choosing it means your content is processed there. We do not use Your Content to train AI models.
CollabAI runs on our own OpenAI account rather than on a key you provide, so using it sends your content to OpenAI as our subprocessor. What we send is the passage you are working on, your question, and the recent exchange; your whole paper is sent only on a turn where you ask it to read the whole paper. OpenAI processes this on our behalf under its API terms: it does not use API content to train its models, and it retains that content for up to 30 days for abuse monitoring before deleting it. We keep the running total of your monthly usage; we do not store the coaching conversation on our servers, and it is gone when you close or change document.
If you run CollabAI on your own API key, what it sends goes to that provider under your account and its terms, as with the other AI features, and not to OpenAI on our behalf.
Code modules you install may send text from your documents to an AI provider, on the key you saved for it, when you grant them that permission at install. What they send goes to that provider under your account and its terms, and not to any provider on our behalf. We keep only each module's monthly spend and request count. The record of its requests and answers stays in your browser.
Pre-submission review runs on the OpenRouter account you connect, so what it sends goes to OpenRouter under your account and its terms, and not to any provider on our behalf. When you start a review, we read the paper as it stands at that moment, with its reference list, and send it to OpenRouter with our instructions over a series of requests. Every request asks OpenRouter to use only endpoints with a zero data retention policy and to refuse providers that collect data, and our routing permits only Google Vertex AI, Microsoft Azure and xAI, with Amazon Bedrock as a fallback when none of them can serve a request. OpenRouter states that it does not use your inputs or outputs to train models and that it does not keep your prompts unless you opt in to prompt logging; it keeps a record of each request, such as the model used and its cost, which you can see in your OpenRouter account. Two settings in your OpenRouter privacy settings are yours to control. Prompt logging, if you turn it on, lets OpenRouter keep your prompts and use them under a broad licence, so we recommend leaving it off. Allow providers that may train on your data decides whether OpenRouter may route your other requests to such providers; pre-submission review's requests do not depend on it, and we recommend leaving it off as well. We store your OpenRouter key encrypted, as we store your other keys; removing it in Settings stops Collab Writer from using it but does not revoke it, which you do in your OpenRouter account.
Module safety review runs on our own OpenRouter account, so OpenRouter is our subprocessor for it. When you have Pro and you submit a theme, a layout or an agent to the module catalogue, we send OpenRouter the module file with our instructions, the tags and the language that you gave for the listing, and the facts that our checks found in the file. For an agent, the module file includes its start and the brief of each role. The module file contains the author name that you wrote in it. We do not send your account details, your email address, any identifier of your account, or any of your documents. Every request asks OpenRouter to use only endpoints with a zero data retention policy and to refuse providers that collect data, and our routing permits only Google Vertex AI, Microsoft Azure and xAI, with Amazon Bedrock as a fallback when none of them can serve a request. OpenRouter states that it does not use inputs or outputs to train models. We store the result with the version: the decision, the findings, the summary, the model that made it and its cost. We keep the result as long as we keep the version. We do not use your module to train AI models.
Mind map runs on your own API key, so what it sends goes to the provider you choose under your account and its terms, and not to any provider on our behalf. When you generate a map, we read the paper as it stands at that moment, without its appendices, and send it to that provider with our instructions; we do not store what we sent or the provider's answer. We store the resulting map with the paper: its text, the short quotations from the paper that its parts cite, which provider and model made it, and who made it and who last changed it. Moving the paper to the Trash keeps the map, deleting the paper permanently deletes the map, and deleting your account removes your name from the maps of papers that remain. If you ask an AI tool you have connected to Collab Writer, such as Claude or ChatGPT, to draw the map instead, that tool reads the paper through the connection under your account with it and its terms, and the map it sends back is kept as a proposal, with the name of the tool, until an editor of the paper accepts or discards it.
Canvas runs on your own API key, so what it sends goes to the provider you choose under your account and its terms, and not to any provider on our behalf. When you ask for a diagram, we read the paper as it stands at that moment, without its appendices or its reference list, and send it to that provider with our instructions and the details you added; we do not store what we sent or the provider's answer, which goes to your browser to be placed on the Canvas. We store the Canvas with the paper: what is drawn on it, including the text of each box and the short quotation from the paper that it cites, and who last changed it. Moving the paper to the Trash keeps the Canvas, deleting the paper permanently deletes it, and deleting your account removes your name from the Canvases of papers that remain. If you ask an AI tool you have connected to Collab Writer, such as Claude or ChatGPT, to draft a diagram instead, that tool reads the paper through the connection under your account with it and its terms, and the diagram it sends back is kept, with your name and the name of the tool, until an editor of the paper places it on the Canvas or discards it.
We do not sell your personal data. We share it with the infrastructure and service providers listed under Subprocessors, who process it on our behalf under contract; with collaborators you invite; with optional integrations only at your direction; and where required by law or to protect rights and safety.
A case-study document keeps a record of how its text is entered: when it was edited, the time spent writing, the number of characters typed, pasted and deleted, and the largest number typed in one minute. The record holds counts only. It does not hold the keys you press or the text, it does not identify who made each edit, and it is stored in the document, where the sessions of everyone who edits it are counted together.
When you download a case-study document for submission, we record the file's fingerprint (a SHA-256 hash), its verification code, the time of the download, the number of pages and of pasted words, the totals of the document's writing record at that moment, the document's title, your name, your email address shown only as its first letter and domain, and the owner's name when you are not the owner. We do not keep the file. Anyone who holds the file or its code can see this record at collab-writer.com/verify, which checks the file in their browser without uploading it. We keep these records until you delete your account; deleting it removes the records of your downloads and your name from records of documents you owned that others downloaded.
We do not read your documents in the ordinary course of running Collab Writer. An operator can open a document they do not own only through a restricted administrative view, which is read-only and cannot change or delete your work, and only where it is necessary to investigate a fault you have reported, to enforce the Acceptable Use Policy, or to comply with the law. Every such access is recorded in an append-only log that the operator cannot alter or erase, showing who opened which document and when. If that record cannot be written, the access is refused rather than allowed to go unrecorded.
We are based in the United States and process data there and in other locations where our providers operate. If you choose to use the DeepSeek AI model, the content you submit to it is processed in China. For users in the EEA and the UK, transfers rely on appropriate safeguards, such as the Standard Contractual Clauses offered by our providers.
We keep personal data while your account is active and for as long as needed for the purposes above or to meet legal requirements. When you delete content or close your account, we remove it from active systems. Residual copies remain in our backups until those backups expire, which is no later than 98 days after deletion: the database supports point-in-time recovery over the previous 7 days, and we keep daily backups for 7 days and weekly backups for 98 days. We may retain limited records where the law requires.
A LinkedIn or GitHub link keeps the identifier, the name and the date until you remove the link or delete your account. Removing a LinkedIn link in Collab Writer does not remove Collab Writer from your LinkedIn account; you do that in your LinkedIn settings. We delete our access at GitHub when you link the account. The record that two-step sign-in is on is kept until you turn it off or delete your account.
A pre-submission review you run keeps, in our storage, a copy of the paper's text as it stood when the review started, the review's intermediate results and the finished review, so that a paused review can resume without being paid for twice. These are deleted when the paper is deleted. The record of each review you ran, which holds its status, mode and cost but none of the paper's text, is kept until you delete your account. A review you move to an appendix is then part of the paper and is kept and deleted with it.
Subject to law, you may request access to your data, correction, deletion, a portable export, or object to or restrict certain processing, and you may withdraw consent. To exercise these rights, email privacy@collab-writer.com.
EEA and UK users: you may lodge a complaint with your local supervisory authority.
California residents: under the CCPA and CPRA you have the right to know, delete, and correct your personal information, and to opt out of its "sale" or "sharing". We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.
Collab Writer is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
We will post changes to this notice here and, where material, notify you. Questions and requests: privacy@collab-writer.com.
Back to topCollab Writer uses only the cookies and browser storage the Service needs to function. We use no advertising or cross-site tracking cookies.
sid): keeps you signed in. It is HttpOnly and Secure. Blocking it prevents sign-in.Interface preferences such as editor zoom, pane widths, tab order, and split-view are stored in your browser's local storage on your device. They stay in your browser and are not transmitted to us as cookies.
When you start a Pro checkout, Stripe's hosted checkout may set its own cookies on Stripe's domain for fraud prevention and to complete the payment. These are governed by Stripe's cookie and privacy policies.
We do not embed advertising networks or third-party analytics or tracking cookies. If this changes, we will update this policy and, where required, ask for your consent first.
Control cookies in your browser settings; blocking the sid cookie prevents sign-in.
This policy applies to all use of the Service.
Compilation, import, export, and AI features are subject to per-user rate limits and fair-use principles. Features described as generous or unlimited remain subject to fair use. We may set and update reasonable limits, and may act where use places a disproportionate load on the Service or is inconsistent with normal individual use.
If you violate this policy we may warn you, throttle or suspend access, remove violating content, or terminate your account, depending on the severity. To report abuse, contact support@collab-writer.com.
Back to topWe take reasonable and appropriate measures to protect your data. No online service can be completely secure.
Collab Writer runs on Google Cloud Platform, using Cloud Run for compute, Firestore for the database, Cloud Storage for files, and Secret Manager for key management. Google's data centers hold independent certifications, including ISO/IEC 27001 and SOC 1, 2, and 3. These certifications belong to Google as our infrastructure provider; Collab Writer does not currently hold its own ISO or SOC certification.
All connections to the Service use HTTPS with TLS. Third-party credentials you store (AI and reference-service API keys and tokens) are encrypted at rest with AES-256-GCM, and the master encryption key is held in Google Secret Manager, separate from the database, so a database or backup leak alone yields only ciphertext. Stored credentials are never returned to any client. Data held in Google Cloud storage is additionally encrypted at rest by Google.
Sign-in is handled by Firebase Authentication (Google, or email and password with email verification). Sessions use an HttpOnly, Secure cookie. Access to each document is enforced per document, so collaborators can reach only the documents shared with them.
Expensive operations are rate-limited per user to limit abuse. The database supports point-in-time recovery over a 7-day window, and files are held in redundant cloud storage.
If you believe you have found a security vulnerability, please report it to security@collab-writer.com and give us a reasonable time to respond before any public disclosure. Please do not access, modify, or delete other users' data, or degrade the Service, while testing.
Use a strong, unique password, keep your credentials and API keys private, sign out on shared devices, and keep local backups of important work.
Back to topWe use the third-party providers below to run Collab Writer. They process personal data on our behalf, under contract, only as needed to provide their part of the Service. Where you are an institution and we act as your processor under the GDPR, these are our subprocessors.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Google Cloud Platform (Google LLC) | Hosting, database (Firestore), file storage, key management | All Service data | United States |
| Firebase Authentication (Google LLC) | Sign-in and identity | Email, authentication identifiers | United States |
| Stripe, Inc. | Payment processing for Pro subscriptions | Billing and payment details | United States |
| Resend (Resend, Inc.) | Transactional email (verification, notifications, contact form) | Email address and message content | United States |
| OpenRouter, Inc. | Safety review of modules submitted to the module catalogue: Google Vertex AI, Microsoft Azure and xAI endpoints with zero data retention, and Amazon Bedrock as a fallback | The submitted module file, with the author name in it, and the listing's tags and language | United States (endpoints in the United States or the European Union) |
AI features are optional. Most of them run on an API key you provide: when you select a model and invoke one, your prompt and the document context you submit are sent to the provider you chose, and you control which of these, if any, you use. Two features are exceptions. CollabAI runs on our own OpenAI account, so using it makes OpenAI our subprocessor for the content you send it. The module safety review runs on our own OpenRouter account, so submitting a module to the catalogue makes OpenRouter our subprocessor for that module. We do not use Your Content to train any of these models.
| Provider | Model | Location |
|---|---|---|
| Anthropic, PBC | Claude | United States |
| OpenAI, L.L.C. | GPT; CollabAI (on our account) | United States |
| Google LLC | Gemini | United States |
| Perplexity AI, Inc. | Sonar | United States |
| DeepSeek | DeepSeek | China |
| SpaceXAI LLC | Grok | United States |
| OpenRouter, Inc. | Pre-submission review, on your own OpenRouter account; module safety review, on our account. Both use Google Vertex AI, Microsoft Azure and xAI endpoints with zero data retention, and Amazon Bedrock as a fallback | United States (endpoints in the United States or the European Union) |
The following are used only if you choose to connect them, and only for the action you request (importing references or attaching files). They act on your authorization and are governed by their own terms: Zotero, Mendeley (Elsevier), Google Drive (Google), Microsoft OneDrive (Microsoft), and Dropbox. If you publish modules and link a LinkedIn account, LinkedIn handles the sign-in and sends us the identifier and the name described in the Privacy Notice. If you link a GitHub account, GitHub does the same with the number and the user name of your account. The word-synonyms feature sends only the single word you select to a public dictionary API (Datamuse) from your browser; it does not send your document.
We may update this list as our providers change, and will reflect changes here. Institutional customers who need a data processing agreement can request one at legal@collab-writer.com.
Back to top