Privacy policy

Last updated: 16 October 2026

In plain language

• Your papers, notes, codes and writing are stored on our servers in Malaysia. Only you can see them.
• When you use an AI feature, only the text that feature needs is sent to an AI provider, which may be outside Malaysia. Providers may keep data and logs under their own policies, but none trains AI models on your data. Each one is named on our list of AI providers, and you agree to this in our End-User Agreement.
• Your notes and memos are never sent to an AI provider.
• The optional browser extension reads a page only when you use it, and sends what you save only to CurTask.
• We don't sell your data, we don't show ads, and we don't use tracking cookies.
• You can delete your account at any time, and you can download a copy of all your data yourself.

This box is a summary. The sections below are what bind us.

1. Who we are

CurTask is a reference manager, literature-analysis and writing tool for researchers. It is operated by HackEduTech Labs (202303169641 / LA0059120-V), Universiti Pendidikan Sultan Idris, 35900 Tanjong Malim, Perak, Malaysia ("we", "us"). We are the data user for the personal data described here under Malaysia's Personal Data Protection Act 2010 (PDPA).

This policy covers the CurTask website (www.curtask.com), the app (app.curtask.com) and the emails we send.

2. What we collect

Your account. Your name, email address, password (stored only as a secure hash by our sign-in service), two-step sign-in settings, preferred language and theme, your plan, and the devices and sessions you sign in from.

Your research content. The files you upload (PDFs, Word, OpenDocument, Markdown and text files), the text we read from them, their bibliographic details, and everything you create: projects, research questions, notes, highlights, codes and coded passages, memos, matrices, themes, manuscripts and citations.

AI results. The analyses, matrix values, suggestions and their evidence (page number and quote) that AI features produce for you, and a record of each AI job: what kind it was, when it ran and how many credits it used.

Payments. The plan or top-up you bought, its price, our invoice record and the payment provider's reference numbers. Card numbers and bank logins are never seen by us (section 6).

Messages. What you send us by email or through the feedback form, including a screenshot if you choose to attach one.

Your agreement. Which version of the End-User Agreement you accepted, when, the language you read it in and the kind of device and browser (for example "Chrome on macOS").

Technical data. Error reports, anonymous usage counts and days of use (section 11), and security logs (for example sign-ins and changes to your account).

The browser extension (optional). If you use Save to CurTask, the details of the papers you save from web pages, their PDFs when they can be fetched, and the extension's connection to your account (section 10).

Sign in with Google, Apple or Facebook (optional). If you choose one of these, that service tells us your name and email address so we can create or match your account. We receive nothing else from them.

Approximate location. We use your approximate location to show prices in your local currency. We don't keep it for this purpose.

We do not collect analytics on the content of your writing. We never sell personal data.

3. How we use it

We use your data only to provide CurTask to you and to keep it working and secure:

• to run your account, store your papers and show them only to you;
• to run the AI features you ask for, and to charge the credits they use;
• to take payments, issue invoices and keep the records the law requires;
• to send you the emails the service needs (sign-in codes, invites, receipts, notices about your account) and, only if you said yes, product news;
• to fix errors, prevent abuse and protect your account;
• to understand, in anonymous totals, which features are used, so we can improve them.

4. Where it is stored

Your account, your files, the text read from them, everything you create and the AI results are stored on servers we control at a data centre in Kuala Lumpur, Malaysia. Encrypted backups are kept in Malaysia too.

Your files are stored privately. No other user can see, search or download them, and checking for duplicate files never looks across users.

Some services we use are outside Malaysia. They receive only what is listed in sections 5 to 7 and on the sub-processor list. You agree to AI processing outside Malaysia in the End-User Agreement, which you accept when you sign in (section 5).

5. AI processing and providers

No AI runs on your device. AI requests go from our servers in Malaysia to an AI service provider, which may be outside Malaysia. We choose the providers that do each task best, and every one of them is named on the list of AI providers, with its country, what it receives, what it keeps and the date the list was last updated.

• What providers keep. A provider may keep data and logs about our requests under its own policy, as the list shows. Today our main provider, OpenCode Zen (United States), and our backup provider, OpenRouter (United States), are used only in ways that keep nothing after answering.
• No training. We only use providers that never use your data to train AI models.
• Your agreement. You agree to this, including the transfer of the text a feature needs to providers outside Malaysia, in the End-User Agreement when you sign in. When we add or change a provider, we update the list and email you (an account notice) before the change takes effect.

The answers are checked against your paper and stored only on our servers in Malaysia.

Nothing is sent until you confirm an analysis, answer the project interview or use an AI feature. What each feature sends:

Never sent to an AI provider: your notes, your memos on coded passages, the rest of your writing, project names outside the project interview, your name, your email address or any account number. Your codes and coded passages, and your accepted matrix values, themes and links, are sent only when you use an AI coding, theme, compare or writing feature that reads them; anything still marked Suggested is never sent as your analysis.

Automatic insights. On paid plans the insight margin asks automatically when you pause on a paragraph you changed. The "Automatic insights" switch in the Insight tab turns this off.

Short-term storage of answers. To avoid charging you twice for the same request, writing insights, claim-check results, comparisons, synopses and drafted opening paragraphs are kept on our servers for 30 days.

You can see the same list inside the app under Settings → AI & privacy.

6. Other services that receive data

• Hostinger runs the servers at our data centre in Kuala Lumpur, Malaysia, where everything is stored.
• Amazon Web Services stores our encrypted backups in its Asia Pacific (Malaysia) region.
• Resend (United States) sends our emails. It receives your email address and the email's content when we send you one. Open and click tracking is switched off.
• Stripe takes payments. When you buy a plan or a top-up, it receives your email address, your CurTask account number and what you are buying. You type your card details or choose your bank on Stripe's own page: card numbers and bank logins never reach us. Stripe processes payments in the United States and elsewhere and keeps payment records as financial law requires.
• Google, Apple and Facebook, only if you choose to sign in with them (section 2).

The full list, with what each one receives, is on the sub-processor list.

7. Searching research catalogues

Discovery. When you search on the Discovery page, the words you type and the filters you choose (years, open access, type, sort) are sent to OpenAlex and Semantic Scholar, two free, open catalogues of research run from the United States. Nothing else is sent: never your papers, notes, writing, name or email. Our servers ask on your behalf with CurTask's own key, so the searches are not linked to you.

Find similar papers. Only when you press "Find similar papers" in a project, our servers send Semantic Scholar the DOIs (public identifiers of published papers) of up to 20 of that project's papers. Nothing you wrote is sent. Which papers are in a project can say something about its topic.

Claim support (paid plans). To find studies you don't have yet, only a few short search keywords made from the claims you chose are sent to OpenAlex — never your sentences.

Import. When you import a result, we ask the catalogue for that record by its number and, if it has an open-access PDF, our servers download it into your library after a virus check.

Connections and free PDFs. When a paper in your library has a DOI (the public identifier of a published paper), our servers send that DOI to OpenAlex to list the works it cites and the works that cite it, shown on the paper's Connections tab. If you saved a paper without its PDF, our servers also send its DOI to OpenAlex and Semantic Scholar to look for a free, open-access copy and, if there is one, download it into your library after a virus check. This happens in the background. Only the DOI is sent, never your notes, writing, name or email, and the lookups are not linked to you.

8. Shared facts

Some facts about a published paper are the same for everyone who has it — for example its sample size or the year the data was collected. When a user accepts such a value for a paper with a DOI, we may keep the short value itself and reuse it for other users who run the matrix on the same paper. They then see it marked "reused, 0 credits".

A shared fact is only a short number or choice. It never includes your wording, quotes, notes, codes or edits, and never says who you are. It is used for another user only if its supporting passage is found again in that user's own copy of the paper.

9. What stays in your browser

To work quickly and when the connection drops, your browser keeps:

• your sign-in session, theme and language;
• offline copies of your notes, matrix changes and writing until they reach our servers, and records of which AI suggestions you accepted, edited or discarded — removed when you sign out;
• your "Automatic insights" choice;
• a reading engine (about 13 MB of open-source software) downloaded once from our own servers, so your browser can read the text of your files and scanned pages itself. The file is still uploaded to our servers, and the text your browser read is stored with the paper.

What the browser extension keeps, if you use it, is in section 10. More detail is in the cookie notice.

10. The browser extension

If you use the optional Save to CurTask browser extension for Chrome, Edge or Brave, this section applies. It works only with your CurTask account and talks only to CurTask's own servers.

What it reads. Only on a page where you open the extension or press one of its Save buttons, it reads what identifies the paper there: its title, authors, year, journal, DOI and the link to its PDF. On a Google Scholar results page you open it on, it reads the same for each result. It does not read other pages, your browsing history, the rest of the page or anything you type on websites.

The PDF. When you press Save and the page offers a PDF you can open, the extension downloads it in your own browser with your own access (for example your university library's subscription), as if you had clicked the PDF link yourself, so the publisher sees the same request it would see then. The file is then uploaded to our servers and stored only in your private Global Library, like any file you import (section 4). We never use your access for anyone else and never share the file. If the PDF can't be opened, only the paper's details are saved, and the paper is marked as having no PDF.

What it sends. Only to CurTask's servers, and only when you press Save: the paper's details, its PDF if one was fetched, the projects and tags you chose and your note. It sends nothing to any other company, shows no ads and contains no trackers, so it adds no service to the sub-processor list.

What it sees of your account. The names of your projects and your tags, so you can choose them. Never your papers' text, notes or writing.

Connecting it. You connect the extension by pressing Allow in a CurTask tab where you are signed in; the extension never sees your password. Like a new device, the connection is recorded in your security log and we email you about it.

What it keeps in your browser. In the extension's own storage: its connection to your account (a sign-in token, not your password), your last choices of projects and tags, and any saves waiting to be sent while you are offline. Removing the extension deletes them. You can see the connection and revoke it at any time in Settings → Security; the extension then can't save anything until you connect it again.

The permissions it asks for, in plain words:

• Read the page you are on, when you use the extension: to find the paper's details, only when you open it or press Save.
• Store data: to keep its connection, your last choices and saves waiting to be sent.
• Run in the background now and then (alarms): to send saves that waited while you were offline, and to follow a save's progress after you close it. It reads nothing while doing this.
• Show beside the page and in the right-click menu: to open as a side panel or pop-up and offer "Save to CurTask".
• Use Google Scholar and the journal sites on CurTask's list, asked for one site at a time and only when you choose it (for example by pressing "Show Save buttons on …"): to show the small Save buttons there and fetch the PDF you choose. We update the list of journal sites ourselves; the extension can only ask for a site on that list, and only after you agree in your browser's own question. You can switch the buttons off, and remove a site's access, in the extension's settings. It never asks for access to every website.

11. Analytics and error reports

Usage statistics. With "Share anonymous usage statistics" on (Settings), your browser sends a few anonymous events to our own analytics server in Malaysia. It uses no cookies. It records which screens are used and how often some features are used — for example a matrix value accepted or edited, the evidence line opened, a citation inserted, a manuscript compiled and its format, how long a new project takes to get its first matrix values (in ranges), and how fast scanned pages are read on your device (the engine, seconds per page, and rough ranges for the number of processor cores and memory). It also counts a few button presses anonymously, such as Start free or Upgrade; no account or content. It never records a value, quote, question, title, file name, paper text, note, writing, search words, your name, email or any account number. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is sent. Turning the switch off stops it immediately.

Days of use. With the same switch on, our server also notes, for each day you use CurTask, which parts you used (for example the library, the matrix or writing), by name only. We use these only to count, for example how many people use the matrix each week or come back after a month; we never look at one person's use, and any group smaller than 5 people is hidden. They are kept for 13 months. Turning the switch off, or a "Do Not Track" or "Global Privacy Control" signal, stops this, and turning the switch off also deletes what was kept.

Error reports. When something breaks, the app sends a technical error report to our own error-report server. These reports are always on, because we need them to fix problems. They are set up to contain no personal data: no account details, cookies, page addresses with search terms, or content.

12. Emails and product news

We send emails the service needs: sign-in and security emails, invites, receipts, notices about your jobs and credits, and account notices about important changes to the service, prices or these terms. Account notices go to everyone they concern and say why they were sent.

Product news is opt-in. At sign-up the box "Send me product news by email" is unticked; you can change your choice in Settings → Notifications & email. We record your choice, when and where you made it. Every product-news email has a one-click unsubscribe link, and marking one as spam also turns news off.

Notifications under the bell in the app are about your own jobs, credits, plan and payments, and messages from CurTask. They are deleted after 90 days.

Invites. If CurTask invites you, we keep your email address until you join (then 30 days), or 90 days after the invite expires.

Waitlist. If you join the waitlist, we keep your email address and name, the optional details you choose to give (your role, field of study and what you would use CurTask for), and the language you used. We use them only to confirm your address, to decide whom to invite and when, and to email you about the waitlist and your invite — including one email when CurTask opens to everyone. We delete them 30 days after you create an account, 12 months after you joined if you never created an account, or 7 days after you signed up if you never confirmed your address. Every waitlist email has a link to remove yourself at once. If you try to create an account without an invite (for example with Google), we keep that email address, and the name Google gives us, for up to 15 minutes only to fill in the waitlist form for you. We delete them as soon as the form opens, or within the hour.

13. Student status

Student status uses your sign-in email: it must be a university address, and you declare that you are enrolled. We keep the university's domain (for example "siswa.upsi.edu.my"), when you claimed and declared, and a one-way fingerprint of the address. Once a year we send a code to your sign-in email to check again.

If you used the student price, we keep a one-way fingerprint of your university email after your account is deleted, only to stop it being used for the student price again. It cannot be turned back into your address.

14. How long we keep data

When you delete your account, it is locked straight away and you are signed out everywhere. For 90 days you can restore it by signing in. After 90 days your research content — papers, files, projects, notes, codes, writing and AI results — is deleted permanently. A locked record of the account (name, email, plan) is kept for up to 5 years and then removed. Invoices are kept for 7 years. Deleted data leaves our backups within 35 days.

Shared facts (section 8) contain nothing about you and stay after you delete a paper or your account.

15. Security and data breaches

Your data is encrypted in transit and our backups are encrypted. Every table has access rules so that one user can never read another's data, and we test this for every part of the app. You can protect your account with two-step sign-in and see and sign out your devices in Settings. Uploaded files are virus-checked and opened only in an isolated service.

If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable (within 72 hours of learning of it) and tell the people affected without undue delay.

16. Your rights

Under the PDPA you can:

• access the personal data we hold about you;
• correct it — most of it you can edit yourself in Settings → Profile;
• withdraw consent, for example to product news or usage statistics, at any time in Settings;
• stop direct marketing — use the unsubscribe link or the switch in Settings;
• take your data with you. In Settings → Profile, Download all my data makes one file (ZIP) with everything in your account: your profile and settings, your papers with the files you added and their text, your notes, codes, matrices (with the page and quote behind each AI value), synthesis, manuscripts (as Word, Markdown and in full), your references (BibTeX, RIS and CSL-JSON), your credits, invoices and notifications. It uses open formats and includes a guide to each file, in English and Bahasa Melayu. We tell you in the app and by email when it is ready; you download it after signing in. The copy is deleted from our servers after 7 days, and you can ask for a new one once a day. You can still download single files, export a matrix as a spreadsheet (CSV) and compile a manuscript at any time. If you cannot use the download, email us and we will help;
• delete your account in Settings → Profile (section 14).

To use any right, or to complain, email hello@hackedu.tech from the address on your account. We reply within 21 days. You can also contact the Personal Data Protection Department of Malaysia.

17. Children

CurTask is for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

18. Changes to this policy

We may update this policy as CurTask changes. For important changes we send an account notice by email before they take effect. The date at the top shows the latest version.

19. Language

This policy is available in English and Bahasa Melayu. If the two versions differ, the English version prevails.

20. Contact

HackEduTech Labs (202303169641 / LA0059120-V)
Universiti Pendidikan Sultan Idris, 35900 Tanjong Malim, Perak, Malaysia
Email: hello@hackedu.tech