Private by default.
No cookies. No login. No tracking. This page documents every category of data the tool handles.
Your bibliography data.
All projects (bibliographies) and source records you create are stored exclusively in your browser's localStorage under the key namespace mla-citation:*.
Retention: Until you clear your browser storage or delete a project. Data is never transmitted to any server.
Google Docs OAuth token.
If you use the "Send to Google Docs" export, the OAuth 2.0 access token your Google account issues is stored in sessionStorage under the key mla-citation:session:gdocsToken.
Retention: Until the browser tab or window is closed. The token is sent directly to Google's API endpoints and is never transmitted to mla-citation.com servers.
Cookie-free page view counts only.
We use Plausible Analytics — a privacy-first, GDPR-compliant analytics platform that operates without cookies and without persistent client identifiers. Plausible collects only aggregate page view counts, referrer domains, and coarse geographic region (country level). No individual user is tracked.
Retention: Aggregate counts retained by Plausible per their privacy policy. No personal data is collected or retained.
URLs submitted for autocite.
When you use the URL autocite feature, the URL you submit is sent to our CORS proxy at proxy.mla-citation.com. The proxy fetches the target page, strips the originating browser's Referer header, omits any client identifier, and returns the page content to your browser.
Retention: The proxy does not log or store URLs or response bodies. The request is ephemeral. Source record content is never transmitted to the proxy.
None.
mla-citation.com sets no cookies of any kind — not session cookies, not persistent cookies, not third-party cookies, not analytics cookies. Plausible Analytics operates without cookies.
Only when you use autocite or Google Docs.
Your browser makes direct requests to CrossRef (api.crossref.org), OpenLibrary (openlibrary.org), and Google Books when you use DOI or ISBN autocite. These requests contain only the identifier you entered. If you use Google Docs export, requests go to Google's OAuth and Docs API endpoints using your access token. Your source records are never included in these requests.