Last updated 18 August 2026.
What this covers: porcupineResearch is software for managing a literature review. You can use it two ways, and these terms cover both: the hosted service at porcupineresearch.me, operated by Dhrubojyoti Saha, and your own copy, installed from the repository onto infrastructure you control. Where a clause applies to only one of them, it says so. Your use is subject to all applicable laws either way.
Acceptance: by using the software you acknowledge that you have read and agree to these terms. If you disagree with them, the remedy is straightforward: do not run it.
A consequence worth stating first. If you run your own copy, most of what a normal terms-of-service document controls is simply not ours to control. We cannot suspend your account, cannot see your data, cannot lose it, and cannot bill you for it. Several clauses below say so where a template would have claimed otherwise.
Age: an account is created on your own instance, and you should be 13 or older to use the software. You are responsible for who else you invite to a project you administer.
Account security is yours, including the recovery passphrase. The passphrase shown once at enrolment is the only thing standing between the database and your encrypted messages, and there is no reset — not withheld, genuinely absent. Nobody, including whoever administers your instance, can recover encrypted content once it is lost. That is what end-to-end encryption means, and it is the trade the security page sets out in full.
Your data is yours, and it never leaves your instance. We claim no ownership of anything you put into the software and no licence to process it — a licence to process would be meaningless, since nothing you enter is transmitted to us. Your library, decisions, notes and extracted answers live in a database you administer, and export to CSV and Excel whenever you want them out.
What you put in is your responsibility. That includes copyright in material you import, and any ethics approval your data requires. The software will not check either.
There are none. No subscription, no seats, no storage plan, no card, on the hosted service or on your own copy. There is no billing code in this project — not disabled and not behind a flag — so there is nothing here to agree to about payment. If you self-host, the costs you carry are your own hardware, your own database and your own backups. Pricing explains why that is the arrangement, and what would have to change before it is not.
What not to do with it: (a) do not impersonate anyone, inside a project or in an academic output drawn from one; (b) do not use the search feature to abuse the bibliographic providers — they are free public indexes, they rate-limit, and hammering them spoils it for everyone; (c) do not use it in violation of applicable law or of your institution’s research-ethics requirements; (d) do not attempt to read another member’s encrypted content, or to represent extracted data as having been checked by someone who did not check it.
Reverse engineering is explicitly fine. A template would forbid it here. Read the source, audit the cryptography, modify it, run your own fork — the Apache License 2.0 grants you all of that, and a security claim you are not allowed to verify is not one worth making. The licence asks two things back: keep the notices, and mark the files you changed.
Google, and only if you connect it: nothing touches Google until a project member deliberately connects an account. From then on, documents in that folder are held in that member’s Google Drive under Google’s terms, and you must comply with them. The scope requested is drive.file, which reaches only files this app created or the member explicitly picked; porcupineResearch adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Bibliographic providers: the search screen queries OpenAlex, Crossref, arXiv, Europe PMC and Semantic Scholar. They are third parties with their own terms, they may log your instance’s address and your query, and they can be unavailable — the app is built to carry on when one of them is.
Vercel and Supabase, on the hosted service. The application runs on Vercel; the database and the authentication that emails your sign-in code are managed by Supabase. Those two are the sub-processors and they are named here rather than in a list you have to request. If you run your own copy, neither is involved: the stack is PostgreSQL and a web server on machines you chose, and whoever runs those is your sub-processor rather than ours. See data processing.
The software changes. Features are added, and occasionally removed — what shipped when is on the changelog. The hosted service is updated when the repository is, so it can change under you; a copy you run yourself changes only when you update it, because nobody else can deploy to it.
The hosted service can be suspended; your own copy cannot. Access to porcupineresearch.me may be interrupted for maintenance, and may be withdrawn from an account that abuses it — the search providers in section 5 are free public indexes and hammering them costs everyone. That is the extent of it: no other reason to terminate is being reserved. And it is worth knowing that the exit is always open. Export to CSV and Excel works at any time, the source is public, and if this project stopped tomorrow a copy you run yourself would keep working.
Damages: to the maximum extent permitted by applicable law, the author of this software will not be liable for any direct, indirect, incidental, special, consequential or punitive damages — including loss of data, loss of use, or lost work — arising from your use of or inability to use it.
The specific one to plan for: lose your recovery passphrase and your encrypted messages and manuscripts cannot be recovered by anyone. Keep backups of your database, and keep the passphrase somewhere you would still have it after losing the machine.
Provided as is: the software comes with no warranty of any kind, express or implied, including fitness for a particular purpose. It is in active development and parts of it are not built — the features page lists which, and that list is maintained rather than decorative.
It does not make your review correct. The app records decisions, enforces the rules you chose and refuses several things that would corrupt an audit trail. It does not judge papers, and the methodological soundness of your review remains yours and your supervisor’s.
Entire agreement: these terms, together with the Apache License 2.0 in the repository, are the whole of the agreement about using this software. Where the two meet, the licence governs the software and these terms govern the hosted service. Changes take effect when posted here, and material ones are recorded on the changelog.
Contact Us: If you have any questions about these Terms, please contact us at dhrubojyoti.saha@g.bracu.ac.bd.