Privacy Policy

Who runs this site

drsun.dev is the personal website of Pascal Sun, a Ph.D. candidate at The University of Western Australia. The same site also serves three document tools: Reflex (reflex.drsun.dev), Unstructured DW (udw.drsun.dev) and WAMEX Explorer (wamex.drsun.dev), and the Talk2Reflex, Talk2UDW and Talk2WAMEX MCP servers that let AI assistants use those tools (at /api/mcp on each of those addresses). This policy covers all of them.

Questions and requests: [email protected].

What is collected

Your account

• You sign in through KAIA Platform. On first sign-in the site creates an account named by the email address KAIA Platform returns for you (or your KAIA username or user ID if no email is returned).
• If you fill in a profile: display name, handle, avatar URL, bio, website, LinkedIn and GitHub.
• Settings you save, such as which AI model a tool should use.
• API tokens you create: their name and a SHA-256 hash of the token. The token itself is not stored.

Your projects and documents

• Projects you create (name and description), the documents in them (titles, and the PDF files you upload or give a link to), the schemas you save and the results extracted from your documents.

Chat conversations

• The questions you ask the chat assistants in Reflex, Unstructured DW and WAMEX Explorer and the answers they give, saved as conversations under your account.
• In the travel tools on drsun.dev, a saved conversation can also hold the map location a message was sent from.

AI assistant tool calls (MCP)

• Each time an AI assistant calls a tool on the Talk2Reflex, Talk2UDW or Talk2WAMEX MCP servers, one record is kept: the time, your account, which tool and which server, the client (the name of the API token used and/or the client's User-Agent), the arguments it sent, whether the call succeeded, any error message, and how long the call took.
• Before arguments are stored, values that look like secrets (tokens, passwords, keys, signed links) are replaced by [redacted], long text is cut to 500 characters, and each record's arguments are capped at 4 KB.

Processing usage

• Each time documents are sent to KAIA Platform for a processing step (for example layout analysis, OCR or extraction): your account, the project, the tool, the step, the number of documents and the time.

Feedback

• Feedback you send with the feedback button: your account, the text, its category, the page and tool you were on, and any screenshots you attach.

Shared project links

• When someone opens a project through a share link and enters an email address (and, optionally, a name), the site stores that email and name with the project, and the times of their first and latest visit. Questions they ask the project's chat assistant are saved under that email address.

Payments

• If you make a payment or donation on drsun.dev, you pay on Stripe's checkout page; card details are entered there, not on this site. The site keeps your account, the amount, currency, status, payment type, any message you add, Stripe's references for the payment and the invoice link.

Cookies and browser storage

• pm_username: keeps you signed in; holds your account name and lasts 30 days.
• oauth_access_token: the KAIA Platform access token from your sign-in; it expires when the token does.
• oauth_state, oauth_code_verifier, oauth_origin: used only during sign-in; they last at most 10 minutes and are removed once you are signed in.
• Google Analytics runs on drsun.dev only (not on the Reflex, Unstructured DW or WAMEX Explorer addresses or the MCP servers). It loads Google's analytics script, which sets Google's own cookies and sends Google information about the pages you visit.
• Your browser's local storage keeps your language and theme, a copy of your tool settings, and, on shared project pages, the name and email you entered so you are not asked again.

Why it is used

• To sign you in and keep each account's projects, conversations and settings separate.
• To run the tools you ask for: store and process your documents, answer chat questions, carry out MCP tool calls.
• The site's operators review usage to fix problems and improve the service.
• To process payments.

Who can see it

• You see your own projects, documents, conversations and settings.
• When you share a project, anyone with its share link can view it until the link is revoked.
• The site's operators: administrator accounts can open any project, and the operators review usage to fix problems and improve the service.

Services that receive data

• KAIA Platform: handles sign-in, and receives your project documents and schemas to run layout analysis, OCR and extraction on them.
• S3-compatible object storage: holds the PDF files you upload and feedback screenshots.
• OpenAI: receives your chat questions together with the parts of your project used to answer them, project results you ask it to summarise, descriptions you ask the tools to turn into schemas or questions, and, in the travel tools, text to be read aloud.
• Google Analytics (drsun.dev only): page visits, as described above.
• Mapbox: draws the maps; your browser loads map data from Mapbox, and map-based tools send it the coordinates involved.
• OpenAlex: Reflex looks up papers and citations there using the titles, identifiers and search terms involved.
• Stripe: processes payments.
• The travel and research tools on drsun.dev also look places and topics up with public services such as OpenStreetMap's Overpass servers, Wikipedia and Tavily, sending them the place names, coordinates or search terms involved.
• When you use the MCP servers from an AI assistant, the tool results go to that assistant; what its provider does with them is covered by that provider's own policy.

How long it is kept

Nothing is deleted automatically: the data above is kept until it is deleted. You can delete some of it yourself:

• Deleting a project removes the project and its list of documents from this site's database. It does not remove the uploaded files from storage, the copies on KAIA Platform, the extraction results stored for it, its saved chat conversations, or the usage, tool-call and feedback records.
• You can delete your API tokens and travel conversations.

Getting your data deleted

To have your account or anything else listed here deleted, email [email protected] from the email address of your account (or, for a share-link visit, the email you entered) and say what you want removed.

Changes

When what the site collects or shares changes, this page is updated and the date at the top changes.