Privacy Policy

Last updated: July, 2026

APACitation-Generator.com (“we,” “us,” or “the Site”) provides a free citation generator and respects your privacy. This Privacy Policy explains what information is gathered when you visit our Site, how it is used, who we share it with, and the rights you have over your personal data.

By using the Site, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent — for example, for cookie-based analytics or advertising — we collect that consent separately through our consent (cookie) banner, and not merely from your use of the Site.

Scope and current status. Some features described below — in particular cookie-based analytics (e.g., Google Analytics 4), advertising (e.g., Google AdSense), and our consent (cookie) banner — are being rolled out. Where a feature is not yet live, the processing described for it does not take place until it is. We will not enable consent-based analytics or advertising cookies in the EEA, the UK, or Switzerland until a Google-certified consent management platform (CMP) is in place.

1. Information We Collect

We have intentionally designed the Site to collect as little personal information as possible.

Citation details you enter. The reference fields you type — author, title, year, publisher, URL, DOI, ISBN, and similar — are used to generate your citations. Your bibliography list is stored in your browser on your own device and is not saved to an account.
Look-ups to auto-fill a reference. If you paste a URL, DOI, or ISBN to auto-fill a citation, that identifier and the related technical data needed to make the request are sent to our own server (the look-up runs on apacitation-generator.com), which retrieves the reference details from one or more third-party bibliographic metadata services. We do not use these look-ups to identify you personally.
Information you provide voluntarily. If you contact us by email, we receive your email address, your name (if you provide it), and the contents of your message. We use this only to respond to your inquiry and do not add you to any marketing list.
Information collected automatically. When you visit any page, our hosting/CDN provider (Cloudflare) may automatically log:
Your IP address, which may be processed or truncated by our providers according to their settings and policies
Your browser type and version
Your device type (desktop, mobile, tablet)
The pages you visit and the time you spend on them
The website that referred you to us, if any
Approximate geographic location (country and region, not a precise address)

Two distinct Cloudflare functions are involved. Cloudflare’s CDN and security layer processes request data (including your IP address and request metadata) in order to deliver and protect the Site. Separately, Cloudflare Web Analytics produces limited, aggregated website usage data collected without cookies or cross-site tracking identifiers. If we later add cookie-based analytics such as Google Analytics 4, it will be governed by the consent rules described below.

2. What Stays on Your Device vs. What Is Sent to a Server

Manually entered citation data is processed in your browser and stored in your browser’s local storage on your own device — unless you use a feature that requires server-side processing. Specifically:

Building a citation from details you type is handled in your browser.
When you use URL, DOI, or ISBN auto-fill, the identifier you submit and the related technical data for the request (such as your IP address) are transmitted to our server to retrieve the reference details. Your completed bibliography itself is not uploaded to an account.
When you export to Word or BibTeX, the file is generated from the list stored in your browser.

Your saved bibliography and optional settings — such as citation style, font, or sort order — do not leave your device except as described above, or if you export them yourself. You can clear them at any time using the “Clear list” button or by clearing your browser data; if cleared, the Site simply starts with an empty list and default settings.

3. Cookies and Similar Technologies

The Site currently uses only strictly necessary technology to load and operate securely, together with cookieless analytics (Cloudflare Web Analytics). We do not currently set advertising or cross-site tracking cookies, and we do not currently display a consent banner because no consent-requiring cookies are in use.

When the features noted in the status box are enabled, the following categories may apply:

Strictly necessary. Required for the Site to load and operate securely. These do not require consent and cannot be switched off through a consent banner.
Preference storage. Remembers optional choices such as citation style or font (stored as a cookie or in local storage). If disabled or cleared, the Site uses its default settings.
Analytics cookies. Only if we deploy a cookie-based analytics tool such as Google Analytics 4, and only where you consent in regions where consent is required.
Advertising cookies. Only once Google AdSense is live, served through a Google-certified CMP, and only where you consent in regions where consent is required.

4. Your Cookie Choices

Once our consent banner is live, when you first visit the Site from a region where consent is required (including the EEA, the UK, and Switzerland), the banner will let you:

Accept all cookies;
Reject non-essential cookies; or
Manage your preferences by category.

You will be able to change or withdraw your consent at any time through the “Cookie Settings” (or “Privacy Choices”) link in the site footer once that banner is deployed. Withdrawing consent does not affect processing that already took place while consent was in effect. You can also block or delete cookies through your browser settings, though blocking strictly necessary cookies may affect how the Site works.

5. Advertising

The Site does not currently display advertising. If and when we enable Google AdSense, this section will apply. In the EEA, the UK, Switzerland, and other regions where consent is required, ads will be served only in accordance with the consent you provide through a Google-certified consent management platform. If you decline advertising cookies, you may still see contextual or limited ads, depending on your location, your consent choices, and Google’s available ad-serving options. In other regions, Google and its partners may use cookies to serve personalized (interest-based) ads, subject to the controls below.

You will be able to control personalized advertising at any time:

Manage Google ad personalization at Google Ads Settings.
Opt out of many third-party vendors at info/choices.
Learn how Google uses data from partner sites at google.com/technologies/partner-sites.

6. How We Use Your Information

The limited data we collect is used to:

Operate, maintain, and secure the website and the citation generator.
Retrieve reference details when you auto-fill from a URL, DOI, or ISBN.
Understand which pages and tools are most useful so we can improve them.
If and when advertising is enabled, display and measure the performance of that advertising.
Detect and prevent fraud, abuse, or security incidents.
Respond to your direct inquiries or feedback.
Comply with applicable laws.

7. Legal Basis for Processing (EEA / UK)

Where the EU or UK GDPR applies, we process personal data on the following bases. For each activity we identify the data used and why the processing is necessary.

Operating the generator and serving pages. Data: the identifier you submit for a look-up and technical request data (such as IP and browser). Basis: our legitimate interests in providing the service you request. Necessity: we cannot return a citation or serve a page without processing the request.
Security and abuse prevention. Data: IP address, request metadata, and logs. Basis: our legitimate interests in keeping the Site available and secure.
Cookieless analytics. Data: limited, aggregated website usage data collected without cookies or cross-site tracking identifiers. Basis: our legitimate interests in understanding and improving the Site.
Cookie-based analytics and advertising (when enabled). Data: cookie identifiers and related usage data. Basis: your consent.
Responding to your emails. Data: your email and message. Basis: our legitimate interests, or steps taken at your request.
Legal compliance. Basis: compliance with a legal obligation.

Right to object. Where we rely on legitimate interests, you can object at any time by emailing [email protected]. We will stop unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise, or defend legal claims.

Providing your data. You are not under a statutory obligation to provide personal data. However, if you do not submit an identifier we cannot auto-fill a citation, and basic technical data is necessary to deliver any web page. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

8. Third-Party Services

We rely on a small number of third-party services. Each has its own privacy policy, which we encourage you to review:

Cloudflare — hosting/CDN and security (which process request data, including your IP, to deliver and protect the Site) and cookieless website analytics (Cloudflare Web Analytics).
Third-party bibliographic metadata databases — queried by our server to auto-fill references from a URL, DOI, or ISBN. Because the look-up runs on our server, these databases receive the identifier from us, not directly from your browser, and do not receive your IP address.
Google Analytics (when enabled) — cookie-based, consent-gated website analytics.
Google AdSense (when enabled) — display advertising, served via a Google-certified CMP where consent is required.

Cloudflare and our current metadata database(s) do not set advertising cookies through the Site. If Google Analytics or Google AdSense is enabled later, those services and their partners may set or read cookies subject to the consent choices described above. If we add or remove a third-party service, this section — and, once live, the consent banner’s vendor list — will be updated.

9. Data Sharing and Disclosure

We do not sell your personal information as the term “sell” is defined under the CCPA/CPRA. We may share limited data only in these circumstances:

With service providers (hosting/CDN, security, metadata look-ups, and — once enabled — analytics and advertising) under their applicable terms or data-processing terms. Some, such as Google, may act as independent controllers for certain processing under their own privacy policies.
When legally required, such as in response to a valid court order, subpoena, or government request.
To protect rights and safety, if we believe disclosure is necessary to prevent fraud, illegal activity, or harm.

10. International Data Transfers

We and our providers (including Cloudflare and, once enabled, Google) may process your data in the United States or other countries. Where required by law, such transfers are made under appropriate safeguards, such as the standard contractual clauses used by those providers. Where you ask, we can point you to the relevant provider’s transfer safeguards.

11. Your Privacy Rights (EEA / UK — GDPR)

If you are in the European Union or United Kingdom, you have the right to access, correct, delete, or restrict processing of your personal data; to object to processing based on legitimate interests; to request data portability; to withdraw consent; and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). To exercise any of these rights, email [email protected].

12. Your Privacy Rights (California — CCPA / CPRA)

If you are a California resident and the CCPA/CPRA applies to us, you have the right to know, correct, and delete your personal information; to opt out of the “sale” or “sharing” of personal information; and not to receive discriminatory treatment for exercising these rights.

Categories collected (last 12 months). Identifiers (e.g., IP address and, once cookies are used, cookie IDs); internet or network activity (pages viewed, referral data); approximate location; the identifiers you submit when using URL, DOI, or ISBN look-up; and any information you include in an email to us. Citation details you enter and process only in your browser are not collected by us.
Directly from you, and automatically from your device and our hosting/analytics providers.
Business/commercial purposes. Operating and securing the Site and citation generator, retrieving reference metadata, analytics, responding to inquiries, and — once enabled — advertising.
Disclosed for a business purpose (last 12 months). To our hosting/CDN and security provider (Cloudflare) and our metadata look-up provider(s), for the purposes above.
None. We do not sell personal information.
Shared for cross-context behavioral advertising. None currently. If we later enable behavioral advertising, using identifiers for that purpose may be “sharing” under California law; we will disclose it and honor opt-outs.
See the Data Retention section; we keep each category only as long as needed for the purpose listed.
Verifying requests. Because the Site does not offer user accounts and most citation data remains on your device, we may hold little or no information that can reasonably be linked to you. Where verification is required, we will request only the information reasonably necessary to verify and process your request.
Authorized agents. You may use an authorized agent to submit a request; we may ask for proof of authorization.
Opt-out preference signals. Where the law applies, we treat a Global Privacy Control (GPC) signal sent by your browser as a valid request to opt out of any “sale” or “sharing.”
We do not knowingly sell or share the personal information of consumers under 16 years of age.

To submit a request, email [email protected].

13. Response Times

We respond to verifiable rights requests within the period required by applicable law. Where the EU or UK GDPR applies, this is generally one month. Certain California requests are generally handled within 45 days, subject to permitted extensions.

14. Data Retention

We keep personal data only as long as needed for the purpose it was collected:

Contact emails — up to 24 months after your inquiry is resolved, then deleted.
Server and security logs (Cloudflare) — retained only as long as needed to deliver, troubleshoot, and secure the Site, after which they are deleted or aggregated; Cloudflare’s own retention periods for the products we use also apply.
Cookieless analytics (Cloudflare Web Analytics) — aggregated usage data retained for Cloudflare’s standard reporting window.
Your bibliography and local settings — stored on your device until you clear them; we do not hold a copy.

The tools below are not yet live. When they are enabled, the following retention will apply and this section will be updated: cookie-based analytics such as Google Analytics 4 (per our GA4 configuration, which supports up to 14 months for user and event data); consent records (retained for the period needed to evidence your consent choice); and advertising cookies (for the lifetimes set by Google and its partners).

15. Children’s Privacy

The Site is intended for a general audience and is not directed to children under 13. We determine our audience based on our content, language, imagery, any advertising, audience data, and marketing — none of which targets children.

We do not knowingly collect personal information from a child under 13. Under the U.S. Children’s Online Privacy Protection Act (COPPA), if we obtain actual knowledge that we have collected personal information from a child under 13, we will delete it promptly and, where required, take reasonable steps to prevent further collection. If you believe a child has provided us with personal information, email [email protected] with details so we can locate and delete it.

16. Data Security

We use reasonable technical and organizational measures — such as HTTPS, appropriate hosting security, and ongoing software maintenance — to help protect the information handled through the Site. However, no internet transmission or storage is 100% secure, and we cannot guarantee absolute security.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The “Last updated” date at the top of this page will always reflect the most recent revision.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, email us at [email protected].