Privacy

Last updated 22 June 2026.

The short version. vahtian.com has no accounts and no advertising trackers. The interactive demos run entirely in your browser. The downloadable tools are local-first — your manuscripts and ratings stay on your device.

Who we are

Vahtian (Heidi Andersén), Vaasa, Finland, is the data controller for this website. Questions or requests: privacy@vahtian.com.

What this page covers

This notice is about the website (vahtian.com) and the demos shown on it. Each downloadable tool has its own behavior — the MatchVahti and MatchVahti Lite apps are covered in their own section below, and for CiteVahti see the contributor privacy notice (the optional, default-off evidence-contribution feature).

What we collect

• No accounts, no sign-in, no advertising cookies.
• Cookieless analytics. We use Cloudflare Web Analytics, which records aggregate metrics (page views, referrers, approximate country) without cookies and without building a personal profile or tracking you across other sites.
• Technical logs. Our host (Cloudflare) processes standard request data, including IP address, to deliver and protect the site. We do not use it to identify you.
• The on-page demos (e.g. CiteVahti's "check one claim") run entirely in your browser. Anything you type or paste is not sent to us or stored.

What we do not do

• We do not sell or rent your data.
• We do not run advertising/retargeting pixels or cross-site trackers.
• We do not require an account to use any free tool.

MatchVahti and MatchVahti Lite (apps)

The MatchVahti and MatchVahti Lite apps are local-first. Your projects, claims, papers, ratings, notes, and the on-device validation log live only on your device — they are not uploaded, and there are no accounts, no advertising, and no analytics or tracking in the apps. Network requests happen only when you act. With the optional features off — the shipped default — the only thing that leaves your device is the PubMed search you run.

What the apps send, and when:

• PubMed search (both apps). Your query is sent to the US National Library of Medicine's NCBI E-utilities to return results. It is search-only; we do not receive or store your queries. An optional NCBI contact email / API key (for NCBI's rate-limit etiquette) is sent with those requests and is stored only on your device.
• AI second opinion (MatchVahti only — optional, off by default). If you enable it, after your own rating is recorded, the selected claim, the paper title, and its abstract are sent to the model endpoint you configure, using your own API key. The key stays on your device and is never sent to us — your chosen AI provider is the recipient, not Vahtian. Leave it off and nothing is sent.
• Semantic Scholar citation map (MatchVahti only — optional, off by default). If you use it, the public identifiers (PMIDs/DOIs) of the papers you select are sent to the Semantic Scholar Graph API to fetch the citation graph. No personal data and no claim text are sent.
• Corpus contribution (MatchVahti only — optional, off by default, explicit per-send consent). Contributing de-identified judgment metadata to the shared Vahtian evidence corpus is a separate, deliberate action — never automatic. What a contribution carries, who receives it (Vahtian and its EU-based processors), where it is stored (an EU database), how long it is kept, and how to revoke it are set out in the contributor privacy notice shown in the MatchVahti app before any contribution. Each contribution is revocable from within the app.

MatchVahti Lite has none of the optional features above. Its only network call is the PubMed search; captures and the Zotero .ris export stay on your device.

Legal basis (apps)

• PubMed search, AI second opinion, citation map: to deliver the function you actively request when you run a search or switch on a feature (GDPR Art. 6(1)(b)); the AI provider and Semantic Scholar act as your chosen recipients under their own terms.
• Corpus contribution: your consent (GDPR Art. 6(1)(a)), recorded per opt-in.

Your rights

Under the GDPR you may request access, correction, erasure, restriction, or portability of any personal data we hold, and object to processing. You may also withdraw any consent at any time (Art. 7(3)); withdrawal does not affect the lawfulness of processing carried out before it. For corpus contributions you can revoke directly in the app, which deletes the data and leaves only a dated tombstone proving erasure. Because the website is cookieless and account-free, we usually hold no data that identifies you. Contact privacy@vahtian.com. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Changes

If this notice changes — for example if we add a feature that processes personal data — we will update this page and the date above.