Legal, fetch stance, and privacy

Paperful is a local tool for one operator working with a library they already keep. This page is the written position the Roadmap asked for: what Paperful will fetch, what it will not do, and what never leaves the machine. It is not legal advice.

Fetch stance

• Open access first. The default lanes are publisher/open repositories and indexes (Unpaywall, OpenAlex, Crossref, CORE, arXiv, landing pages). A real contact email in config is sent to those APIs because their polite pools ask for one.

• Your access, your responsibility. Campus/EZProxy and session lanes replay your institution’s access in your browser profile. Whether a download is permitted by a publisher’s terms or your library licence is the operator’s call; Paperful does not grant rights it does not hold.

• Sci-Hub is opt-in only, off by default, and never enabled by a playbook you did not choose. See scihub.

• No CAPTCHA bypass, no bot-wall evasion. When a site challenges the fetch, Paperful stops and tells you; solving the challenge is a human action in your own session.

• Polite by default. Fetches identify with the configured email, honour per-host pacing and the circuit breaker, and screen every URL (and redirect) through is_fetchable_url so the workbench cannot be pointed at loopback, RFC1918, link-local, or cloud-metadata targets.

• Provenance is recorded. Run reports note which lane produced each PDF, so a library built with Paperful can answer “where did this come from?” later.

Credentials and privacy

• Secrets live in the environment, not the config file. paperful config check flags secret-looking keys in config.toml and points at the env var to use instead. .env is gitignored. An OS keyring backend was evaluated for 1.7 and rejected: headless/Docker operators have no keyring daemon, and env vars already work everywhere (see docs/plans/1.7-wave.md).

• On-disk tokens are owner-only. Mendeley OAuth tokens are written 0600; the session vault under state/sessions/ holds campus cookies and must be treated like a password — never commit, paste, or share it.

• Keys go only to their own API. A Zotero key is sent to Zotero, a Mendeley token to Mendeley; nothing is proxied through a Paperful service, because there is no Paperful service.

• No telemetry. Paperful phones home nowhere. The only outbound calls are the ones a command you ran makes: reference-manager APIs, scholarly indexes, and fetch lanes above.

• Update notice is opt-in. With [updates] check = true, doctor fetches the latest version string from PyPI at most once a day (cached under state/) and prints a line if you are behind. It sends no usage data and never runs in the background.

• Local by default. The workbench binds loopback, the mirror and run reports stay on your disk, and LLM/RAG lanes use providers you configure — prompts leave the machine only to the endpoint you chose.

Sustainability note

Paperful is maintained by one person under the licence in the repo root. If maintenance stops, everything keeps working offline: the mirror, run reports, and this documentation are plain files in your library folder.