This page explains what data PhD Command Center collects, why, and how it's protected. This is an independent, single-developer project — there is no marketing team, ad network, or data broker involved. Nothing here is sold, and nothing here is used for advertising.
What we collect
- Account info — name, email address, and a bcrypt hash of your password (we never store or can see your actual password).
- Profile info you choose to add — institution, department, program, research field, and similar fields on your Settings page.
- Your research content — everything you enter into the app: projects, experiments, papers, results, advisor meetings, dissertation drafts, and so on.
- AI provider API keys, if you choose to add one — encrypted at rest with AES-256-GCM before being stored. It's decrypted only in-memory, only to make a request to your provider on your own behalf, and is never logged or shared.
- Basic operational data — sign-in timestamps, IP addresses tied to login/signup attempts (used only for rate-limiting abuse, auto-deleted after the rate-limit window closes), and error reports if you configure error monitoring.
What we don't do
- We don't sell or rent your data to anyone.
- We don't run ads or third-party trackers/analytics on this site.
- We don't read your research content except to debug a bug you've reported.
- We don't send your AI provider key anywhere except directly to that provider, from our server, on your behalf, when you use an AI feature.
Who else sees your data
A small number of infrastructure providers process data on our behalf to run the service:
- Railway — hosts the application and the Postgres database.
- Resend — delivers transactional email (email verification, password reset, collaborator invites). We don't use it for marketing email.
- Your AI provider (Anthropic, OpenAI, etc.) — only if and when you use an AI feature, using your own key.
If you invite a collaborator into your workspace, they see whatever your chosen access level (view, or view + comment) exposes — you control that grant and can revoke it any time.
Backups
The database is backed up on a daily schedule to a private, access-controlled storage bucket, retained for 30 days, so research data isn't lost to an infrastructure failure.
Your choices
You can edit or delete most of your research content directly in the app at any time. There isn't yet a self-service "delete my account" button — to have your account and all associated data permanently deleted, email emmanuelherohackman@gmail.com from the address on your account, and it will be done by hand within a few days.
Changes to this policy
This policy may be updated as the service evolves. Material changes will be reflected by updating the date at the top of this page.