Privacy Policy

Most of Athanor works without sending anything anywhere. On your device it keeps:

• Your documents, autosaved as you work (in the browser's storage, or the desktop app's).
• Desktop only: a daily backup of your documents in Documents/athanor backups, kept for 14 days.
• Your preferences (theme, tools, page size), your library imports, cached PubChem results and AI chat history.
• While you are signed in, a record of how you answered the app's predictions (which predicted product or route you kept, changed or turned down, by the day, under a pseudonym rather than your account). These records are never uploaded; they leave your device only if you export them to a file yourself.

Recording those answers is on by default, except in the European Union, the rest of the EEA and the United Kingdom, where it starts off and stays off until you turn it on. You can turn it off at any time in Settings, AI, which withdraws it on every device. So that this setting follows your account, we keep whether it is on, when it last changed, and how its default was decided. To decide the default once, we use your time zone, your browser's languages and, where we can tell it, the country of your IP address; when they disagree or cannot be read, recording starts off.

Drawing, checking structures, the built-in compound library and safety screening all run on your device. Deleting the app, or clearing the site's data in your browser, removes these copies.

The desktop app asks you to sign in with an arbastro account. The web app can be tried without one. When you sign in, Athanor reads your account ID, email, username, the name and picture from Google if you use Google sign-in, and the usernames of accounts you have linked on arbastro.com.

The desktop app keeps your sign-in in your operating system's keychain. The web app keeps it in memory and does not store tokens in your browser's storage. How the account itself is handled is in the arbastro Privacy Policy.

These are stored on our servers (Supabase, see section 9), tied to your account:

• Your documents: signed in, every document you save is also kept in your account a few seconds later, with its saved versions, so you can open it anywhere. This is on by default; turn it off for a device in Settings, Storage. Each plan has a storage limit (Free 10 MB, Suite Lite 100 MB, Suite Plus 500 MB, Ultra 3 GB).
• A structure index of those documents: the chemical structures each cloud document contains (as SMILES), so you, and the people you share a document with, can search them by structure. Only people who can read the document can read its index.
• Live collaboration: for a document you share live, its contents, every change, comments (with your name and picture), @mentions, reactions, who has access and with what role, and share links.
• Files on comments: pictures, PDFs and other files (up to 10 MB each) you attach to a comment in a document you share live, stored beside that document. Only people with access to the document can open them. In a document you have not shared, attached files are kept inside the document on your device instead.
• AI chats: your conversations with the assistant, so they follow you between devices.
• Your library and settings: molecules, icons and style sheets you import, and preferences such as theme and page size.
• AI provider keys you add while signed in, encrypted (see section 5).
• Review requests: if you ask us to review a structure the safety screen stopped, we keep your note, the rule involved and a fingerprint of the structure, and send the note with your account email to arbastro staff by email and a private staff channel.

Live editing traffic between collaborators is encrypted in transit with a key per document, and the key changes when someone is removed. This is not end-to-end encryption: our server holds those keys, and documents stored with us can be read by our systems so that they can be synced and shared. arbastro staff do not look at your documents except to fix a problem you report, or where the law requires it.

Shared documents are visible only to the people you invite, or to signed-in arbastro users who open a share link you create, with the role you chose (view, comment or edit). People you collaborate with can see your name, picture and email address, and each other's cursors while you work together. When someone shares a document with your arbastro account, we email you once to say so, with a link to it. When someone assigns you a comment or @mentions you in a document you can open, we email you the comment and a link to it, and list it under For you in the app. A share link can carry an end date and a password. We keep only a salted hash of the password, never the password itself, and remember which accounts have entered it so they are not asked again.

Huddles. A voice call with the people in a document goes directly between your devices. Your voice never passes through our servers and is not recorded; only the messages that set up the call travel through the document's encrypted channel. Because the connection is direct, the people in the call can see each other's network (IP) address.

The community library is public. When you upload a molecule to it, anyone, signed in or not, can see its name, description, structure, formula and your arbastro username, along with comments and ratings. Uploading, rating, commenting and reporting need an account. When you report an upload or a comment we keep who reported it, the reason and any note, for our moderators; the person reported is not told who you are. An upload reported by three different people is hidden until a moderator looks at it. When you search your library with the Community filter on (it is on by default), the search text is sent to our server so community results can be shown, even when you are signed out.

Publishing a document to the web happens only when you choose Publish on a document's Web page tab and confirm. Athanor then stores a picture of the document, as drawn at that moment, and its name, and shows them to anyone with the link. Nothing else about the document, your account or your other documents is published. Links are random and are not listed or searchable. Unpublish deletes the stored picture and the link stops working at once.

The assistant is for signed-in accounts only. Signed out, Athanor sends nothing to any AI provider.

arbastro AI, the default. Your requests go to arbastro's AI service, which passes them to Anthropic and sends the answer back. We do not store what you send or what comes back. For each account we keep a monthly count of requests, tokens and credits used, so your plan's allowance can be enforced; that count is all we keep. Anthropic handles the request under its commercial terms, which do not allow it to train on your data.

Your own provider key (Suite plans). You can instead use a provider you choose (Anthropic, OpenAI, Google, xAI, Meta or Alibaba) with your own API key. Those requests go directly from your device to that provider; they do not pass through arbastro, and we do not see them. Athanor tells you before your first message to each provider.

Predicting products as you draw is on by default when you are signed in: when you finish drawing a reaction, its structures and conditions are sent the same way, to predict the products. You can turn it off in Settings, AI.

What is sent with a request:

• What you type and the earlier messages in that conversation.
• A description of the page you have open: its structures (as SMILES, with positions), notes, your selection and the document name.
• Images you attach to a question.

Voice mode. If you add an OpenAI key, your voice goes directly from your device to OpenAI to be turned into words, and the replies are spoken by OpenAI. Without one, voice mode uses your browser's own speech recognition: in Chrome and Edge that sends your voice to Google or Microsoft to be turned into words, under their terms, and the replies are read aloud by your browser's voices (some of which are online voices of the browser's maker). What you said is then sent to the assistant as text, like a typed question.

The provider handles that data under its own terms and privacy policy. Please read them, especially before sending anything confidential. Your own keys are stored encrypted on our servers and handed back to your device when you use them.

Some features look things up for you. Each sends only what it needs, and only when you use it:

• Naming a structure and turning a name into a structure may send the name or structure to our chemistry service (athanor-ml.arbastro.com, run by arbastro, signed in only) and then to PubChem, run by the U.S. National Library of Medicine.
• Retrosynthesis and reaction prediction send the target structure, or the reactants and any reagents you drew, to our chemistry service at athanor-ml.arbastro.com, which runs on arbastro's own server and only while you are signed in. It keeps nothing about a request beyond its method, path, status and time. A route search you watch as it runs is held in memory for 10 minutes, so its result can be fetched again if the connection drops, and is then deleted.
• When our chemistry models are unavailable, these features fall back to arbastro AI or to the AI provider whose key you added, as described above.
• Protein structures send the ID you type to the RCSB Protein Data Bank or the AlphaFold database.
• Scientific illustrations from the NIH BioArt library are downloaded from our art server as you browse them.

Any website receives your IP address when your device contacts it. PubChem, RCSB and AlphaFold are public scientific services with their own policies.

Athanor has no analytics, advertising or crash-reporting software. It sends two kinds of anonymous events, in released versions only: how the sign-in prompt was answered (with the platform and app version), and the answers to the optional first-run questions about how you plan to use Athanor (with the site that referred you). These carry no account ID and no stored IP address.

Our servers and hosting providers keep short-lived technical logs (such as IP addresses and errors), as almost every web service does, to keep the service running and secure.

The desktop app checks our update server about once every half hour for a new version and downloads it when there is one. That request carries nothing about you beyond what any download does. Copies installed from the Microsoft Store are updated by the Store instead.

When you visit athanor.arbastro.com (this page, its help pages and this policy, not the web app at /app), the page tells our server that it was opened: whether this browser has visited before and how many times (a counter kept in your browser), the page, the site that sent you, and whether you clicked Download or Open in browser. Our server adds your approximate location (city, region and country, from Cloudflare's reading of your IP address) and your browser and operating system, and sends that to arbastro staff as a notification through ntfy. Your IP address itself is not included and none of this is stored by us.

This website also uses Google Analytics to count visits and see which pages are read. In the European Economic Area, the United Kingdom and Switzerland it runs without analytics cookies; elsewhere it sets Google Analytics cookies. Google processes this data under its own privacy policy; IP addresses are not stored by Google Analytics.

The structure box on this website sends what you type into it (a name, a SMILES or a CAS number) to PubChem, run by the US National Library of Medicine, to look the compound up, and the structure it finds to our chemistry service at athanor-ml.arbastro.com for the compound's other names. That second lookup needs no account. The service keeps nothing about it; to limit how many lookups one visitor can make, it counts them under a salted code made from your IP address, held in memory for one minute and never logged or stored. The box also shows Athanor's editor in a frame from /app. That editor saves nothing and sends nothing of its own.

The web app at /app and the desktop app do not use any of this; what they send is described in the sections above.

An arbastro account requires you to be at least 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to us at [email protected] and we will delete it.

Problem sets you keep or hand out as a file stay inside the document on your device, along with a student's answers and progress; they are not sent to us.

Assigning by link. When an instructor makes a link for a problem set, we store the student version of the set (the questions, with the answers hidden inside it), its title, its due date and whether it is graded or practice. When a signed-in student opens the link, we record that they opened it. When they hand it in, we store their score on each problem, which steps of a mechanism they got right, and a copy of the document they handed in. The instructor who made the link can see, for each student who opened it, their name, email address, when they opened and handed it in, their scores, and the work they handed in. Other students cannot see any of it. Scores are worked out by Athanor on the student's device and sent with the hand-in.

For an assignment shared by link outside a class, this is kept for a year after its due date (or a year after it was made, if it has none). The instructor can keep it a year longer at a time, up to four years after the due date, and is emailed 30 and 7 days before anything is deleted. Deleting the assignment, or the instructor's or the student's arbastro account, deletes it sooner. A student who wants a submission removed can ask their instructor, or write to us.

Classes. An instructor can make a class on Athanor's admin site (admin-athanor.arbastro.com) and invite students by a join code, a link, an email invitation or a list of email addresses. For each member we store their role (instructor, co-instructor, teaching assistant or student) and when they joined, and the class's settings. An invitation by email sends that address a message through our email provider. Instructors, and co-instructors and teaching assistants where the class allows it, can see the class's members and their results; whether student email addresses are shown is a class setting. We keep a log of changes to a class (who changed what, and when) for its instructors.

In a class, a submission is stored when the student hands it in, and kept for the retention period the class sets; after that it is deleted. Where the class allows it, a student can withdraw a hand-in: its score, detail and document are deleted and only the time it was withdrawn is kept. Instructors are emailed 30 and 7 days before a class's hand-ins are deleted. Ending or deleting a class, or deleting an account, deletes what it holds as described above.

Organizations. A school or company can set up an organization on the admin site, with departments, admins and settings for the classes in it. Its admins can see who is in the organization, their roles, and its classes. An organization can prove that an email domain is its own (such as @state.edu). It may then email people who already have an arbastro account at that domain, once, to offer them a place, and it is told only how many such people there are, never who they are. It can also let people with a confirmed address at that domain, or on a list of addresses it adds, join. Nobody is put into an organization without accepting. We keep a log of changes to an organization for its admins.

Your school's learning platform. If your school connects Athanor to Canvas, Moodle, Blackboard or another learning platform (through LTI), opening an Athanor assignment there sends us that platform's identifier for you, your role in the course (instructor, teaching assistant or student), and which course and assignment it came from. The first time, you sign in with your arbastro account, and we keep the link between the two.

Student pricing. If you verify that you are a student, we email a link to the school address you give and keep that address, its domain, and when it was verified. A verification lasts a school year.

We share data with these providers only so they can run parts of Athanor for us:

• Supabase, Inc.: accounts, database, file storage and live collaboration.
• Oracle Corporation (Oracle Cloud): the servers for this website, the web app, updates, illustrations and the chemistry service.
• Cloudflare, Inc.: DNS and network protection for arbastro.com addresses, and the approximate visitor location used in section 8.
• ntfy (ntfy.sh): delivering this website's visit notifications to arbastro staff.
• Google LLC (Google Analytics): counting visits to this website.
• Resend, Inc.: sending email (a notice when someone shares a document with you or assigns or mentions you in a comment, class and organization invitations, notices before hand-ins are deleted, student verification links, and review requests to arbastro staff).
• Discord Inc.: delivering review requests to a private arbastro staff channel.
• Microsoft Corporation: distributing and updating Athanor through the Microsoft Store, if you install it there.

The AI providers in section 5 and the scientific services in section 6 are not our processors: your device contacts them directly, under their own terms. We do not sell or rent personal information, and we do not share it for advertising.

We keep what you store with us for as long as your account exists. You can delete documents, chats and library items from within Athanor, and a community upload can be removed by you or by us. Deleting a comment deletes the files attached to it; a file attached to a comment that is never sent is deleted after a day.

Deleting your arbastro account (from your account settings on arbastro.com) deletes the Athanor data tied to it. Comments you left in other people's shared documents stay in those documents without your account attached. Backups of our database are kept for a limited time and then overwritten.

Wherever you live, you can ask us for a copy of the personal information we hold about you, to correct it, or to delete it, and we will not treat you differently for asking. Residents of the EEA, UK, California and other places have these rights in law. Our legal bases under the GDPR are performing our agreement with you (running the features you use), your consent (optional features such as recording prediction feedback, or the AI providers you choose), and our legitimate interest in keeping Athanor secure and working.

Write to [email protected]. We may need to confirm it is your account before acting on a request.

arbastro Inc. and our providers are based in the United States, and data may be processed in the United States and other countries where they operate. Where the law requires it, transfers rely on safeguards such as the European Commission's standard contractual clauses in our providers' terms.

Connections to our services are encrypted, sign-in tokens are kept in your device's keychain or in memory, stored AI keys are encrypted, and our database restricts each person to their own data. No system is perfectly secure, so we cannot promise that data will never be exposed; if a breach affects you, we will tell you as the law requires.

Athanor's MCP server (mcp-athanor.arbastro.com) lets an AI assistant you connect it to, such as Claude, ChatGPT or Cursor, use Athanor's chemistry engine. The server receives only the arguments of each tool call the assistant makes, which are structures, names and options. It never receives your conversation with the assistant, your files, or anything else the assistant knows. What the assistant sends is decided by the assistant and its provider, under their privacy policy, not ours.

Its tools need no sign-in (convert, name, properties, depict, check, screen and library_search). They return a result and store nothing about the request. To limit each address to 60 calls a minute, the server keeps the times of an address's calls from the last minute in memory only; they are dropped after a minute and never written to disk. The server keeps no access log of addresses or arguments, only error messages. Requests pass through Cloudflare, which keeps its own standard logs of the connection.

We keep what you send through the "adopt Athanor for your course" form (name, school, role, course, class size, message and email) to reply to you; it is stored on our own server and deleted after 12 months or when you ask.

When Athanor starts sending something new, this policy changes with it, and the date at the top changes. For significant changes we will also tell you in the app. Questions or requests: [email protected], arbastro Inc.