Your work stays yours.
Parlium asks you to bring work that is not ready to show anyone, so it owes you a plain account of what happens to it. This describes what the software does today, in beta. It is not a legal document, and where something is not yet settled it says so rather than promising.
You own what you write
Your ideas, notes, conversations and the judgements you record between them are yours. We claim no ownership of them and no licence to use them, and nothing you write here is published, sold, or shared with anyone else.
It is not used to train models
Answering you means sending the text of the conversation to the model that answers it — that is how the product works, and no wording can make it otherwise. What we can control is where it goes and what may be done with it there.
Requests are routed through OpenRouter with data collection denied, which restricts them to providers that do not retain prompts for training, and only to providers headquartered in the United States. Headquarters means corporate jurisdiction rather than the location of the machines; those two are not always the same, and we say the one we actually enforce.
Who can see it
You can. Every query the application makes runs as you, and the database enforces that rather than trusting the code to remember.
During the beta, the people running Parlium can also read project contents — ideas, notes and conversation transcripts — to diagnose faults and understand how the two modes are used. We would rather tell you that than have you find it out. If it is a problem for the work you had in mind, it is a fair reason to wait.
Deleting it
Deleting a project deletes everything in it: conversations and their transcripts, ideas, the links between them, and any full text fetched for its papers. There is no undo, which is why it asks you to type the project’s name.
Public bibliographic records — a paper’s title, authors and identifiers, fetched from PubMed or Semantic Scholar — are kept, since they are public reference data rather than anything you wrote. To delete an account outright, ask; there is no button for it yet.
Where it is kept
In a Postgres database hosted by Supabase in Amazon’s Frankfurt region, so what you write is stored in the EU. It is reachable only through the application.
Answering you is the exception, and it is the one described above: the text of that conversation goes to a model provider in the United States, which does not retain it.
Stored credentials — an OpenRouter key or a Zotero key, if you add one — are encrypted at rest. That protects them if the database is copied; it cannot protect them from the application itself, which has to decrypt a key to use it.