What SCP Researcher does with your information

What the app stores, and where

Everything SCP Researcher keeps about you — which articles you've read, your reading queue, your favorites and shelves, notes, the drafts you write and the pictures you add to them, saved offline copies, what the games articles link to save as you play, and settings — is stored on your device only, in the app's private storage. Alchemy Lab does not receive it and cannot see it.

Uninstalling the app deletes all of it.

Network requests the app makes

To show you articles, the app requests pages and metadata from services run by others:

• scp-wiki.wikidot.com and scp-int.wikidot.com (the SCP Wiki and its International Translation Archive) — the article pages you open or save, the themes and pictures they use, and the games they link to, mostly from the wiki's own file and theme servers (such as scp-wiki.wdfiles.com and cdn.scpwiki.com). Requests carry only the address of the page or file.
• api.crom.avn.sh (the Crom API) — article titles, ratings, authors, and tags, used to build lists and credit authors, when our mirror (below) can't answer; and an article's text, when you open one and the wiki isn't answering.
• scp-sandbox-3.wikidot.com (the SCP Wiki's sandbox) — only when you ask. To preview a draft (Write → Preview, or Refresh), the draft's title and text, and the name of its sandbox page if it has one, go to the wiki's own preview. That's what happens if you paste the draft into the sandbox's editor and press Preview, and the wiki sends back the page. To show the components a draft includes (such as the license box), the app also fetches them from the wiki by their addresses. To check your sandbox page (Write → Sandbox → Check your page), the app reads that page as anyone can: whether it's there, its text, and its list of files. Nothing of yours is sent. A game an article links to that's kept in the sandbox's files comes from there (scp-sandbox-3.wdfiles.com) when you open it.

It also downloads, from our own servers, what would otherwise mean every device asking the same questions: a daily list of the wiki's hubs from alchemylab.sh, our site, and, refreshed every six hours, the article information above (titles, ratings, tags and recent edits) from scp-researcher.nyc3.cdn.digitaloceanspaces.com, our mirror of Crom on DigitalOcean's storage. Those requests carry nothing about you. The Write view's tag suggestions and research use the same downloaded information, on your device: a draft's tags don't leave it.

These are ordinary web requests, like a browser would make. Those services can see your IP address and which pages you request, and handle that under their own policies. SCP Researcher sends them nothing else — no identifiers, no reading history, no account information.

Optional: Library Sync

If you sign in to Library Sync, your reading progress, queue, favorites and shelves, your notes and drafts (without their pictures, which stay on the device), and a few settings (the hubs and tags you follow, how often the app checks for changes, and whether it skips the wiki's adult-content warnings) are synchronized between your devices through Alchemy Lab's server. This is designed so that we cannot read your data:

• Your reading data is encrypted on your device with a key derived from your password before it is sent. The server stores only ciphertext and cannot decrypt it. If you lose your password and recovery phrase, neither can we.
• The server holds your email address (to identify your account) and the encrypted data. That is all.
• If you sign in with Google: Google confirms who you are, and the key that unlocks your library is kept in your Google Drive, in a hidden folder that only this app can see (Google calls it the app-data folder). The server still stores only ciphertext and cannot read your data; Google holds the key file but never the encrypted data. Neither alone can read your library. We receive your Google account's email address and a stable account identifier from Google, nothing else, and we never see your Google password. You can remove the app's access at any time in your Google account's third-party access settings; your recovery phrase then remains the way back in.
• All traffic is encrypted in transit.

You can sign out at any time in Settings, which removes the session from that device.

To delete your account and everything stored for it — every synced item, your keys, and the sessions on all your devices — use Settings → Library Sync → Delete account in the app (you confirm by typing your email), use the deletion page at alcove.alchemylab.sh/account/delete (sign in once there to prove the account is yours), or write to the address below and we will do it for you within 30 days. Our nightly database backups can hold a copy of deleted data for up to eight weeks. Your reading history on the device itself is yours and stays until you clear it in Settings.

Optional: Reports and feedback

If you choose to report a problem with an article, or send feedback from Settings, the app sends Alchemy Lab what you put in the form, and only when you press Send:

• the problem you picked and the words you typed;
• the article and the page of it the report is about, and the addresses of any pictures on that page that hadn't loaded;
• the app's version, and whether you use it on a phone, the web or a computer;
• a screenshot, only if you include one: either the app's own picture of the page as you saw it, which the phone and computer apps take when you tap the report button (it shows only the app, never your notifications or other apps, and you can untick it), or an image you choose. The app sends it as a newly made JPEG, so none of the original file's hidden details, such as where a photo was taken, go with it;
• your email address, only if you add one so we can reply.

It also sends a code that lets us count you once when you report the same problem again. The code is different for every problem, so it can't link your reports to each other, and it isn't tied to your account or your device. No reading history, account, or device identifier goes with a report.

Reports go to Alchemy Lab's feedback server (feedback.alchemylab.sh), which groups reports of the same problem and passes each problem to our own ticketing system, where it becomes one ticket for our support team. Versions of the app before 1.0.22 send their reports through our sync server (alcove.alchemylab.sh) instead, which passes them on unchanged and keeps no copy. The feedback server deletes a report 180 days after the last report of its problem; the ticket is kept as support correspondence. A screenshot stays on the feedback server only until it reaches the ticket, where it is kept with the rest of the correspondence. To have a report, or your address, removed, write to the address below.

Optional: Purchases

(Only in the Android app, and only if you buy something.)

SCP Researcher Pro (a monthly or yearly subscription, or a one-time lifetime purchase) and tips are sold through Google Play:

• Google Play handles the payment, under Google's own terms and privacy policy. Alchemy Lab never sees your card or bank details.
• Google keeps a record of each order for our app (such as the order number, what was bought, the price, the date and the country), which we can look up in Google Play's developer console if you contact us about a purchase or a refund.
• To know whether Pro is on, the app asks Google Play, on your device, which of its products your Google account owns. The answer is kept on your device, so Pro keeps working offline; it isn't sent to us and isn't synced to your other devices.
• Subscriptions renew until you cancel them in Google Play; Settings → SCP Researcher Pro → Manage subscription takes you there.

Deleting your data

• What's on your device: uninstalling the app deletes all of it. To clear only your reading history, use Settings → Clear Reading History.
• Your Library Sync account, and everything synced to it: in the app, Settings → Library Sync → Delete account (you confirm by typing your email); or the deletion page at alcove.alchemylab.sh/account/delete; or write to the address below and we will do it for you within 30 days. This deletes every synced item, your keys and the sessions on all your devices. Our nightly backups can hold a copy for up to eight weeks.
• A report or feedback you sent, or the email address you gave with it: write to the address below saying which one (the article, and roughly when), and we will remove it. Otherwise the feedback server deletes a report 180 days after the last report of its problem; the ticket is kept as support correspondence.

What the app does not do

• No advertising, and no advertising identifiers.
• No analytics, crash reporting, or usage tracking of any kind.
• No AI: nothing in the app writes, rewrites or summarises what you write, and your drafts are never sent to an AI service.
• No third-party SDKs that collect data for us or for advertising. Google's own components for Google Play purchases and Google sign-in work under Google's privacy policy.
• No selling or sharing of personal information — there is none to sell.

Children

SCP Researcher is not directed at children under 13, and the articles it displays are rated for older audiences. We do not knowingly collect information from children; the app does not collect information from anyone unless they sign in to sync or send a report.

Changes

If this policy changes, the new version will be posted at this address with an updated effective date.

Contact

[email protected]

The terms for using the app and Library Sync are at alchemylab.sh/scp-researcher/terms.