Privacy notice
Your references are yours
This page explains what ReferenceIt keeps about you, why, and how to take it with you or get rid of it. ReferenceIt is run by David Turner. Last updated 25 October 2026.
We have tried to keep it short; if anything is unclear, email hello@referenceit.org.
Who we are
ReferenceIt is run by David Turner, who is the data controller for the purposes of UK data protection law. The service is hosted by BigWetFish in the United Kingdom.
What we hold and why
| Data | Why we hold it | Legal basis |
|---|---|---|
| Your email address, and a name if you give one | To sign you in, send verification and password-reset links, and tell you about important changes to your account | Performance of a contract (providing the service you signed up for) |
| Whether you want product update emails (on unless you switch it off) | To send an occasional email when something new arrives, a few times a year at most. Every one has an unsubscribe link, and Settings › Email turns them off | Legitimate interest in telling existing users about the service they use |
| A one-way hash of your password, and, if you turn them on, two-factor secrets and passkey public keys | To keep your account yours | Performance of a contract; legitimate interest in security |
| Your references: titles, authors, dates, web addresses, notes, collections, and the style settings you choose | That is the service | Performance of a contract |
| Where a reference came from (for example “filled in from the web page” or “from Crossref”) and whether its web address still works | To help you check and repair your references | Legitimate interest in a useful, accurate service |
| Server logs: your IP address, browser type, the pages requested and the time | Security, debugging and abuse prevention, including limiting how many accounts can be created from one connection | Legitimate interest; kept for 14 days |
| Basic usage events such as when you last signed in | To understand which features matter and to tidy up abandoned accounts | Legitimate interest |
We do not sell data, show advertising, or use tracking pixels. We do not profile you.
Accounts from the original ReferenceIt
If you had an account on the original ReferenceIt (2011–2026), we moved it to this service so your references were not lost. On your first sign-in your old password is checked once against the old record and then immediately re-saved with a modern, much stronger method; the old record is erased. Accounts that were never activated and held no references were not migrated.
Who else sees your data
Nobody sees your references unless you choose to share a collection with a public link. To fill in references for you, the following services receive only the identifier or address you asked us to look up, never your name or email:
- Open Library (Internet Archive) and, if configured, Google Books, for ISBNs.
- Crossref for DOIs and citation matching.
- PubMed (US National Library of Medicine) and arXiv for their identifiers.
- The web page you ask us to reference, which we fetch from our server to read its title and author.
- The Internet Archive's Wayback Machine, to check for a saved copy when a link breaks.
We also use the following suppliers to run the service, each under a contract that restricts them to acting on our instructions:
- Our hosting provider, BigWetFish in the United Kingdom, for servers, database and backups.
- Resend, to deliver our emails: account email such as verification and password-reset links, and product updates if you get them.
Cookies
We set only the cookies needed to run the site: a session cookie (so you stay signed in as you move between pages), a “keep me logged in” cookie if you tick that box, a cookie that protects forms against forgery, and a browser-side preference for light or dark mode. There are no advertising or analytics cookies, so there is no cookie banner.
How long we keep things
- Your account and references: until you delete them. “Delete my account” in settings removes everything immediately; backups that contain the data expire within 30 days.
- References you delete yourself stay in “Recently deleted” for 30 days so you can undo, then are purged.
- Accounts whose email address was never confirmed are removed after 7 days, without emailing them.
- Server logs: 14 days.
Your rights
You can see, download, correct and delete your data yourself at any time from settings: “Download my data” gives you a complete copy in JSON, and “Delete my account” removes it all. You also have the right to object to or restrict processing, and to complain to the Information Commissioner's Office. To exercise any right that the settings page does not cover, email hello@referenceit.org; we answer within a month.
Security
Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. You can add two-factor authentication or passkeys from settings. If we ever discover a breach that affects you, we will tell you.
Children
ReferenceIt is for students and researchers of any age, but we do not knowingly collect more than an email address from anyone, and we ask that under-13s have a parent or teacher create the account.
Changes
If this notice changes in a way that matters, we will say so on the dashboard and update the date at the top.