Security and privacy

This page explains how Pangur protects your account and your research material. It covers how you sign in and stay signed in, where your library is stored, which outside services see which data and when, what is kept on your own devices, and what Pangur records about what you do.

Signing in and staying signed inCopy Anchor Link

Pangur's sign-in service holds your password, and Pangur itself does not store it. When you sign in with an email address and password on Pangur's sign-in page, Pangur's server passes them to the sign-in service, which checks them. The sign-in service protects accounts against repeated guessing, and Pangur adds a limit of its own of 10 attempts for one address from one network in 5 minutes. A wrong password and a locked account get the same answer, so the sign-in form does not reveal whether an account exists.

You can also sign in with an account from another provider, such as Google, Microsoft, GitHub or Apple, where your Pangur deployment offers it. The buttons on the sign-in page show which providers are available.

Keep me signed in is ticked by default. With it ticked, the browser stays signed in across visits until the session expires or you sign out; without it, the session lasts only as long as the sign-in service's ordinary session. The browser holds your sign-in in two parts. A short-lived access token is kept only in the page's memory and never saved. A longer-lived refresh token is kept in a cookie that the page's scripts cannot read, which is sent only over HTTPS, only to Pangur's own sign-in addresses, and never with a request from another site.

Sign out ends the session at the sign-in service as well as in the browser. If several accounts are signed in on the browser, signing out of the one in use moves the browser to the next, and Sign out of all accounts ends them all. Several accounts in one browser are described under Accounts and switching between them.

Pangur for Mac and the iPhone and iPad app sign you in through the system's secure sign-in sheet, which opens Pangur's sign-in page, so the apps never handle your password.

Assistants and the command lineCopy Anchor Link

An assistant such as Claude, and the pangur command, each sign in separately with your Pangur account and hold a sign-in of their own.

An assistant receives a sign-in that reaches only Pangur's MCP server. Because it cannot call the rest of Pangur's API, an assistant can do only what the MCP tools allow, which is to read and to add without editing or deleting. To end an assistant's access, remove the Pangur connector in the assistant's settings. Pangur has no page listing the assistants you have connected.

The command line saves its sign-in in ~/.config/zcp/credentials.json, which only you can read on macOS and Linux, and pangur logout deletes that file. The details are under How the sign-in is kept.

Where your library and files are keptCopy Anchor Link

Everything in your projects is kept on Pangur's servers. Your library (items, notes, attachments and collections) is held in Pangur's own library service, with a separate library for each project. Everything you make from the library, such as documents, Ask conversations, analysis, transcriptions and exhibitions, is kept in Pangur's database. Your files, photographs and exhibition media are kept in Pangur's file store, which is private: every download goes through Pangur's server, which checks each time that you may open the file.

Pangur encrypts the secrets it keeps on your behalf, such as the keys that open your project libraries and the addresses of your private reference links. Passwords for password-protected exhibitions, and one-time links such as password-reset links, are stored only in a form that cannot be turned back into the original.

The search indexCopy Anchor Link

To search the text of your files and to answer Ask, Pangur reads each file into an index. The index holds the extracted text, split into passages, and a numerical description of each passage (a vector) that is used to find passages by meaning. Pangur computes these vectors on its own servers with a model that runs there, so your text is not sent to an outside service to be indexed. The index belongs to the project and is deleted with it, and removing an item removes its passages from the index the next time the library syncs.

A connected Zotero accountCopy Anchor Link

If you import from zotero.org, Pangur asks Zotero only for permission to read your library, notes and groups, and never to write. The connection is used for the import, and it is Pangur's own library that the import fills. Once the import has been merged into your Pangur library, Pangur erases the Zotero access key it held.

What Pangur sends to outside servicesCopy Anchor Link

Pangur uses outside services for some features. This table lists what each one receives and when.

ModelsCopy Anchor Link

Pangur's administrators choose which model provider serves each task, from those Pangur supports, which include Anthropic, OpenAI, Google, Mistral and others. Pangur sends material to a model when someone uses a feature that runs one, and also for a few background readings of a project's sources: the library map entry for each work, written once after the work has been read into the index, and a corpus's background reading, written after the corpus changes. Analysis, by contrast, reads a source only when someone asks for it. Which actions use a model is listed in Models, assistants and who pays.

When you work through an assistant such as Claude or ChatGPT, Pangur sends nothing to a model provider for that work. Your assistant's provider receives the passages and other material that Pangur's tools return to it, under your agreement with that provider.

Error reportsCopy Anchor Link

When something goes wrong, Pangur's web app and server send an error report to Pangur's own error tracker. The reports leave out who you are and your network address, and the web app does not record the clicks or console messages that led up to the error, so the titles in your library do not travel in them.

Copies on your devicesCopy Anchor Link

Pangur keeps copies of your work on your devices so that you can keep working offline. Those copies stay on the device until they are replaced or removed, so on a shared computer you should remove them when you finish. How the copies are used is explained in Working offline.

In a browser, Pangur keeps a copy of each project's library that you open (items, collections, notes, highlights and topics) and the 60 files you opened most recently. Signing out removes them. Changes you made offline that have not yet been sent stay in the browser, without the library copy, and are sent when the same account signs in again. Signing out of all accounts removes every account's copy. Switching to another account also removes the previous account's copy.

On iPhone and iPad, the app keeps the items you chose to keep offline, recently opened files, and changes waiting to be sent. Signing out erases the app's library copy but keeps the kept items and the file cache for the same account's next sign-in, and signing in with another account removes them. Settings → Offline in the app removes everything kept, or only the recently opened files. The app's files are protected by the device's data protection.

What Pangur records about your activityCopy Anchor Link

Pangur records each operation on your library on every surface (the web, the apps, the browser extension, the command line and assistants): who did it, in which project, through which surface, the operation and its arguments in shortened form, whether it succeeded, and when. The arguments can include, for example, the words of a search or the first part of an Ask question. Pangur keeps the record until you delete your account, and deletes it with the account.

The Account record page shows you the operations that you made yourself. To open it, go to Account & billing and choose Account record under More for your account, or use the Go palette (⌘K or Ctrl+K). The page lists the operations with the newest first, 50 at a time, and Show more loads the next 50. Each row gives the operation, the project's name, the surface and the time, followed by the arguments as Pangur stored them. A row is marked Failed when the operation did not succeed and Refused when Pangur did not allow it, and in both cases the row gives the reason where Pangur recorded one. The buttons above the list (All, Web, Apps, Assistants, Command line and Browser extension) limit the list to one surface, so you can check what an assistant did with your library by choosing Assistants. The page does not list sign-ins.

In an organisation's project, the project's owners and the organisation's administrators can see the project's activity, that is, who changed what, through which surface and when, but without the arguments. Organisation projects are not offered on every account or deployment; see Project members and roles.

Note that the Activity page is a different thing: it lists the background work you started, as described in Background work and notifications.

Links that work without signing inCopy Anchor Link

A few kinds of link open something without a sign-in, because the link itself is the credential. Anyone who has one of these links can use it for as long as it works:

Reference links are covered in Cite and export references and exhibitions in Publish, protect and take down an exhibition.