Privacy Policy

Last updated: March 24, 2026

    Summary: Ibid does not collect, transmit, or store any personal data. All citation processing happens locally in your browser. We have no servers, no analytics, no accounts, and no way to access your data.
  

1. What data Ibid collects

None. Ibid does not collect any personal information, usage data, browsing history, or citation data.

2. How Ibid works

Ibid is a browser extension that processes citations entirely within your browser:

Citation formatting is performed by a Rust/WebAssembly engine running locally in the browser's service worker.
Metadata extraction happens via a content script injected only when you click the Ibid icon on a page (using the activeTab permission).
Your citation library is stored in chrome.storage.local on your device. It is never transmitted anywhere.
74 citation styles are bundled with the extension and loaded locally. No network requests are made to load styles.

3. Network requests

Ibid makes network requests in two scenarios:

a) Auto-enhance (when a DOI/identifier is detected on the page):

When Ibid detects a DOI, ISBN, PMID, or arXiv ID on a page you're citing, it automatically looks up complete metadata. This happens when you open the popup — no background requests. If no identifier is found but a title exists, Ibid may search by title as a fallback.

b) Manual enhance (clicking the "Enhance" button):

When you paste an identifier or URL and click Enhance.

All requests use multiple sources with automatic fallback. Only the identifier is sent — never personal data, browsing history, or cookies:

Service	URL	When	Data sent
OpenAlex	api.openalex.org	DOI lookup (primary), title search	DOI or title string
CrossRef	api.crossref.org	DOI lookup (fallback)	DOI only
Open Library	openlibrary.org	ISBN lookup (primary)	ISBN only
Google Books	googleapis.com/books	ISBN lookup (fallback)	ISBN only
NCBI/PubMed	api.ncbi.nlm.nih.gov	PMID lookup	PMID only
arXiv *	arxiv.org	arXiv paper metadata	arXiv ID only
Semantic Scholar *	api.semanticscholar.org	arXiv papers (fallback)	arXiv ID only
Citoid (Wikipedia) *	en.wikipedia.org/api	URL-based citation	Page URL only
doi.org *	doi.org	Follow DOI to publisher page	DOI only
GitHub	raw.githubusercontent.com	On-demand citation style download	Style filename only

* These services require optional host permissions (see section 4). They are only contacted if you have granted access. Without access, Ibid uses the other services which work without extra permissions.

All APIs are public and free. All requests are rate-limited (minimum 200ms between requests per host) to prevent abuse. No requests are made in the background or without your action.

4. Permissions explained

Required permissions (granted at install):

Permission	Why
`activeTab`	Read the current page's metadata when you click the Ibid icon. Only the active tab, only when you click.
`scripting`	Inject the metadata extraction script into the current page on demand.
`storage`	Save your citations, projects, and settings locally on your device.
`sidePanel`	Open the library management panel alongside your browser.
`contextMenus`	Add "Cite this page", "Cite linked page", and "Import DOIs" to the right-click menu.

Optional host permissions (requested only when needed, you choose):

Host	Why
`arxiv.org`	Fetch complete author lists and metadata from arXiv paper pages. Without this, arXiv papers may have incomplete author data.
`api.semanticscholar.org`	Alternative metadata source for computer science papers when arXiv is unavailable.
`en.wikipedia.org`	Resolve any URL to structured citation data via Wikipedia's Citoid service (uses Zotero translators).
`doi.org`	Follow DOI links to publisher article pages for Highwire/Dublin Core metadata extraction.

Optional permissions are never granted automatically. You are prompted only when Ibid needs access to one of these services for a specific citation. You can grant or revoke access anytime from Settings → Scholarly API Access. If denied, Ibid falls back to services that don't require extra permissions (OpenAlex, CrossRef, Open Library, Google Books, NCBI).

We do not request <all_urls>, tabs, webRequest, identity, or any other broad permissions.

5. Content Security Policy

The extension uses wasm-unsafe-eval in its Content Security Policy. This is required to run the Rust/WebAssembly citation engine. It does not enable arbitrary code execution — it only allows compiled WebAssembly modules bundled with the extension to run.

6. Data storage

All data (citations, projects, settings) is stored in chrome.storage.local on your device.
No data is transmitted to any server.
You can export all your data at any time (BibTeX, RIS, CSL-JSON, etc.).
You can delete all data from the extension's Advanced Settings page.
Uninstalling the extension removes all stored data.

7. Third-party services

Ibid does not use any third-party analytics, advertising, crash reporting, or tracking services. There are no third-party scripts, SDKs, or pixels included in the extension.

8. Children's privacy

Ibid does not collect any data from anyone, including children. There are no accounts, no registration, and no personal information collected.

9. Changes to this policy

If we ever change this privacy policy, we will update the "Last updated" date above and include a notice in the extension's changelog. Since we don't collect any data, changes would only relate to new features that might introduce network requests (such as cloud sync in future versions), which would always be opt-in and clearly disclosed.

10. Contact

If you have questions about this privacy policy, contact us at:

privacy@ibid.tools

    In plain English: Ibid is a tool that runs on your computer. We built it because existing citation tools collect data, show ads, or abuse your bandwidth. We don't do any of that. We can't see your citations, we don't know who you are, and we like it that way.
  