These terms govern your use of ProfMatch. By creating an account or using the service, you agree to them. If you do not agree, please do not use ProfMatch.

1. The service

ProfMatch is run by Hassan T. Malik (Pakistan). It helps students find researchers whose published work matches their interests, shows the publications behind each match, looks up publicly available contact details on request, and helps students write a first email. ProfMatch is an independent service. It is not affiliated with, or endorsed by, any university or researcher it lists.

2. Who may use ProfMatch

You must be at least 13 years old to use ProfMatch. If you are under 18 (or the age of majority where you live), you may use ProfMatch only with the permission of a parent or legal guardian, who agrees to these terms on your behalf. When you create an account, you confirm that you are 13 or older.

3. Your account

• Provide accurate information, keep your Google account secure, and do not share your account.
• You are responsible for activity on your account. Tell us promptly if you believe it has been used without your permission.
• You can download your data or delete your account at any time from the account menu.

4. Acceptable use

ProfMatch exists to help students contact researchers individually and respectfully. You agree not to:

• send bulk, automated or repetitive messages to researchers, or use ProfMatch to build mailing lists;
• collect, copy, sell or publish researchers' contact details;
• access the service with scripts, bots or scrapers, or try to get around its limits;
• misrepresent who you are, harass anyone, or send content that is unlawful, abusive or deceptive;
• interfere with the security or operation of the service.

We may suspend or close accounts that break these rules.

5. Information about researchers

Researcher information comes from public sources such as OpenAlex, ORCID, PubMed and Europe PMC, and from researchers' own public pages. It may be incomplete or out of date. Check a researcher's current position and contact details before writing to them. A researcher who would like their contact details excluded from ProfMatch can write to us at the address below.

6. Email drafts

Where available, email drafts are written automatically, on our own server, from your description and the researcher's published papers. They can contain mistakes. Review and edit every draft before you send it; you are responsible for the messages you send.

7. Availability and limits

ProfMatch is provided free of charge, "as is" and "as available". We may change, limit or discontinue features, and we apply fair-use limits to protect the service. To the extent permitted by law, ProfMatch is not liable for indirect or consequential losses arising from your use of the service, or for the outcome of any contact you make with a researcher.

8. Changes to these terms

We may update these terms. The date at the top of this page shows when they last changed. Continuing to use ProfMatch after a change means you accept the updated terms.

9. Contact

Questions about these terms: the contact address published by the site operator.

ProfMatch is run by Hassan T. Malik (Pakistan). This policy explains what information ProfMatch collects, why, who receives it, and the choices you have. ProfMatch does not sell personal information, does not show advertising, and does not use analytics or third-party tracking scripts.

1. Information we collect

• Account details: you sign in with Google, which gives us your name, your email address and an account identifier (and whether Google has checked the address), never your password. We store when your account was made and when you last signed in. We also store when you confirmed you're 13 or older. When you first sign in, these details are held for up to 10 minutes while you confirm your age, and your account is made only once you do. Signing in with an email address and password isn't offered at present. The parts of this policy about email sign-in (codes, passwords, the email sign-up and bot-check cookies, and the counts and logs of email sign-ins) apply only if we add it. We will update this policy before we add it.
• Your shortlist: the researchers you save, with your notes, status and follow-up dates. If you choose to write to a researcher, their email address is kept with your shortlist until you remove them or delete your account.
• Ratings you choose to give: the star rating, any comment, the text of the search it rates, and, when you rate an email draft, which researcher it was for and what kind of draft it was. Ratings are kept for up to one year. A rating you give while signed out isn't linked to you, so we can't find it to include in a download or delete it early; it is deleted after a year like the others.
• Usage limits: daily counts of searches, contact lookups, drafts (and, for about two days, which researcher each draft was for), researcher profiles, university suggestions, ratings and sign-up or password-reset emails, used to enforce fair-use limits. If you sign in with an email address, we also count failed attempts, each for 15 minutes, to stop people guessing passwords. When a browser has passed the check against bots, we count how many emails it asks us to send each day, so that it is checked again after five; this count is kept for about two days. The network addresses, email addresses and bot-check identifiers used for these limits are stored only in scrambled form (keyed, one-way hashes).
• Cookies: up to five first-party cookies, all strictly necessary: one keeps you signed in, for up to 30 days; one counts free searches for visitors without an account, for about 400 days; one briefly holds state during a Google sign-in, cleared within 20 minutes; one links this browser to an email sign-up until you enter its code, cleared 15 minutes after the last code is sent; and one, after your browser passes a quick automatic check against bots, lets this browser skip that check for up to 30 days; it holds only a random identifier.
• Server logs: our web server's access logs record your device's IP address, the time, the page requested and details your browser sends, such as its type and language; our application logs record your account number and the ID of a researcher whose contact details you look up, never your email or name; a failed email sign-in is logged under a scrambled form of the address (a keyed, one-way hash), never the address itself.

The optional "About you" details on the search page are saved only in your own browser, and are cleared from it when you sign out or delete your account. Your browser also keeps your light or dark theme, and, until you close the tab, which searches you've already rated. None of this is sent to us. Search descriptions are not stored, except the text of a search you choose to rate.

2. How we use information, and on what basis

To run searches, look up contact details you request, write email drafts you request, keep your account and shortlist, send sign-in and password-reset codes, enforce fair-use limits, protect the service from abuse, and improve result quality using ratings.

For users in the EU/UK: we process this information to provide the service you asked for, and for our legitimate interests in keeping ProfMatch secure, reliable and fair to use. We do not rely on your consent for this processing.

3. Who receives information

• OpenAlex receives the text of your search (with any background and skills you entered) to find matching publications.
• ORCID, PubMed, Europe PMC, Semantic Scholar and, optionally, Brave Search receive only a researcher's name and public identifiers, and only when you ask us to look up their contact details.
• Google, if you choose to sign in with it.
• Cloudflare carries all traffic between your browser and ProfMatch. To do that it decrypts the traffic on its servers, which are in many countries, so it can see what you send us, such as your searches and account details. We don't use Cloudflare's analytics or tracking features.
• Cloudflare Email Routing and Gmail (Google): emails you send to our contact address are forwarded by Cloudflare to the operator's Gmail account, where Google stores them.
• Google Drive stores encrypted daily backups of our account data. They are encrypted on our server before they are sent, with a key only we hold, so Google can't read them. Google doesn't let us choose which country Drive keeps them in.
• Cloudflare R2 stores a second copy of the same encrypted backups, in Cloudflare's Asia Pacific region. They are encrypted on our server before they are sent, so Cloudflare can't read them.
• Hosting: ProfMatch runs on a server we rent from Google Cloud, in the United States. Your account data is stored there. Google stores it for us under its cloud terms and doesn't use it for anything else.

Email drafts are written on our own server, from your description and the researcher's public paper details; they are not sent to any outside AI provider. Looking up a researcher's contact details sends only that researcher's name and public identifiers to public sources, never anything about you. We may disclose information if required by law.

4. Retention

Account data is kept until you delete your account. Usage counts are deleted within two days of the limit they count resetting; sign-in and reset codes expire after 15 minutes; a sign-in lasts at most 30 days; an email sign-up waiting for its code is deleted after 15 minutes, a Google sign-in waiting for you to confirm you're 13 or older is deleted after 10 minutes, and an account whose address was never confirmed after 7 days. Daily backups are kept for 14 days on our server and, encrypted, in Google Drive and Cloudflare R2; older copies are deleted permanently, not kept in a trash, so deleted data leaves all backups within 15 days. Our server logs are deleted within 31 days: the web server's access and error logs, which record IP addresses, and the application's log. One exception is the short list of lines the application writes when it starts, stops or runs its housekeeping; those hold no personal data and have a size limit instead. The other exception is copies of logs taken while we investigate a security incident; these are kept for at most 90 days. Messages to our contact address are deleted within 12 months of our last reply, or of when they arrived if we don't reply; deleted messages can stay in Gmail's trash for up to 30 more days. When you delete your account, that day's usage counts are kept for up to 48 hours under a scrambled identifier (a keyed, one-way hash of how you signed in), so that deleting an account and making it again doesn't reset the daily limits. After that they are deleted too.

5. Your rights

• See and download your data: use "Download my data" in the account menu.
• Correct it: your name and email address come from your Google account. Change them there, then sign out of ProfMatch and sign in again, and they update here. To correct anything else, email us.
• Delete your account: use "Delete account…" in the account menu; this removes your account and its data.
• Object, or ask us to limit how we use your data: email us and tell us what you'd like changed.
• Complain: you can complain to the data protection authority where you live.

Send requests by email to the contact address published by the site operator. We answer within 30 days.

6. Researchers

The researchers ProfMatch shows in search results are not ProfMatch users. For each one, we show their name, institution, and publications and metrics from OpenAlex and the other sources named in section 3, plus contact addresses and homepages they have published themselves. We do this for our legitimate interest in helping students find and write to researchers about their published work.

This is kept in our cache for 1 to 30 days depending on the type of information. Contact details are kept in our cache for 7 days, or 30 minutes if any source was unavailable during the lookup. If a student chooses to write to a researcher, that email address is also kept with the student's shortlist until they remove the researcher or delete their account. Contact details are shown one researcher at a time, only when a student asks about that researcher.

A researcher who would like their contact details not to be shown can write to us at the address above. Researchers can also object to how we use this information, ask to see or correct it, and complain to the data protection authority where they live.

7. Children's privacy

ProfMatch is intended for students aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13, and sign-up requires confirming an age of 13 or older. If we learn that we have collected personal information from a child under 13, we delete it.

For users aged 13 to 17, we collect only what the service needs, never sell their information, and never show them advertising. A parent or guardian may ask us to access or delete their child's information by writing to the address below.

8. Security

Connections are encrypted with HTTPS as far as Cloudflare (see section 3), and from there to our server through Cloudflare's encrypted tunnel. Passwords are hashed with scrypt, sign-in sessions are stored only as hashes, and access to the service's data is restricted.

9. Changes to this policy

We may update this policy. The date at the top of this page shows when it last changed.

10. Contact

Privacy questions and requests, including from parents and guardians: the contact address published by the site operator.