Literia

Security

This page describes how Literia handles sign-in and your account, in plain language. It covers what we can state about how Literia works today; for how your information is collected, stored and kept, the Privacy Policy is the governing document.

Overview

Literia is a research workspace, and your library, notes, highlights and questions belong to your account. You have to sign in to use them, and requests are tied to your account by a token issued by the Literia backend rather than by anything the browser claims about who you are. We do not sell or rent your data. The sections below explain how sign-in works, how your documents are used by the AI features, how to delete your data, and how to tell us about a security problem.

Data protection

Your connection to Literia is protected in transit with HTTPS/TLS, as described in the Privacy Policy. Paper metadata and PDFs are kept on Literia's own servers behind access controls, and your papers stay in your account until you delete them. Details of how data is stored are described in our Privacy Policy and in Where is my data stored?.

Account security

  • Several ways to sign in. You can sign in with your email and password, continue with Google where it is available, or request a one-time sign-in link by email. See How can I sign in?.
  • Sign-in links are single-use and short-lived. A link expires in 15 minutes. Opening the link first shows which account it signs in to and waits for your confirmation, so an email scanner that merely opens the link cannot use it up.
  • Passkeys. Once you are signed in you can register a passkey under Settings and use it to sign in with biometrics or a hardware key, and you can revoke a passkey at any time.
  • Passwords. New passwords must be at least 8 characters, and you can change your password in Settings. Setting a first password on an account that signs in with Google requires you to confirm with Google again, so a stolen session alone cannot add one.
  • Sessions. Your identity comes from a token issued by the Literia backend. In the web app the short-lived access token is kept in the page's memory rather than in browser storage, and it is renewed through a separate refresh cookie. Signing in or out in one tab is reflected in your other tabs.
  • Password recovery. Requests for a password-reset email get the same answer whether or not the address has an account, and repeated requests are rate-limited.
  • Identity is never taken from the client. Literia does not accept a user ID supplied by the browser as proof of who you are. Requests are tied to your account only by the signed token, so no one can act as another user by changing a header.

AI and your documents

Your library and the papers in it are tied to your account, and AI answers are produced from the paper you are reading or the papers in the collection you choose. Questions and the passages they draw on are processed to produce an answer, and your Q&A history is saved to your account so you can reopen it. What the AI features do, where they fall short and how to check an answer is explained in How Literia uses AI.

Deleting your data

You can delete individual papers from your library at any time. To permanently delete your account and its server-side data, contact us from the email address on the account. See How do I delete my account?. Signing out of the web app stops the browser extension from accessing your account.

Report a vulnerability

If you think you have found a security problem in Literia, please tell us through the Contact page and include enough detail for us to reproduce it. Please do not access other people's data or disrupt the service while you look into it.