Privacy Policy

Automatically, from every visit

Our hosting provider records a log line for each request: your IP address, the page or endpoint you asked for, the time, your browser’s user-agent string, and the page you arrived from.

Separately, every request to an endpoint under /api/ increments a counter in our rate-limit store, so that one address cannot flood the site. That is not only the sign-in and account endpoints: it includes the open bases feed the homepage map loads before you have an account. The counter is keyed on your IP address, and on the auth endpoints on which of them you asked for. Nothing else about the request is recorded there, and it is never read back to build a history of your visits. The complete set of ceilings, and what each one is counted against:

• Most requests: 60 a minute, per IP address.
• The open bases feed and the invitation-acceptance endpoint: 30 a minute, per IP address.
• Signing in: 20 every 15 minutes, per IP address.
• Registration, password reset, password setup and email verification: 5 every 15 minutes, per IP address, counted separately for each of them.
• Asking us to send you an email: a forgotten-password link or a new verification link, 3 every 15 minutes, per IP address.
• Sending an invitation, or submitting an organization or data request: counted twice over, 30 an hour per IP address and 10 an hour per account. Changing the email address on your own account counts against that same per-account hourly cap; changing your name or your password does not.

Each counter covers a fixed window: a minute, fifteen minutes or an hour. The store deletes it by itself about twice that window after it is first written, so roughly two hours at the longest.

An IP address is personal information under the GDPR and under California law, and we treat it as such. We do not try to identify you from it, and we do not combine it with your account.

Page-view analytics

The deployed site runs Vercel Web Analytics, our host’s own page-view counter. Each page view sends a small beacon from your browser to our own domain, not to a third-party analytics host: normally under /_vercel/insights, though Vercel does not commit to a fixed path. Vercel publishes what it may store with every data point:

• the time of the page view;
• the page path (no query string), and the route pattern it matched;
• the page you arrived from;
• your location to city level: country, region and city;
• your device type, operating system and browser with their versions, and the version of the analytics script.

A few of our links carry a one-time token in the query string (a password reset, an invitation, a password-setup link), and the site removes the query string from every page view before the beacon is sent, so those tokens never reach Web Analytics. Although no cookie is involved, Vercel identifies a visitor “by a hash created from the incoming request” and discards it after 24 hours; within that window one visitor’s page views are linked to each other, which is not the same thing as each view standing alone.

What it does not do: it sets no cookie and stores nothing in your browser, it gives you no identifier that follows you to another site, and it does not receive your name, your email address or your account. We read it only as the aggregate counts Vercel’s dashboard shows, to see which pages are used and whether the site is working. Vercel guarantees the data stays stored and viewable for a 12-month reporting window on the plan this site runs on, and says it “may store your data for longer periods”. It does not run in a local development build.

When you create an account

Your email address, your name if you give one, and your password, which is stored only in a hashed form we cannot reverse; we never hold the password itself. Alongside those we store your role, your account status, the organization you belong to, and time-limited single-use tokens for invitations, email verification, email changes and password resets.

We also keep three pieces of security telemetry about your account: the number of consecutive failed sign-in attempts, the time an account lock expires, and the time you last signed in successfully. They exist to stop password guessing.

When you submit a request

An organization registration request stores the organization name, a contact email, an optional contact phone number, an optional website, and your free-text justification. The free-text fields accept up to 5,000 characters each; whatever you type in them is stored as written, so please do not put patient information or anything else sensitive there.

The data request form is not open yet. Researchers ask for data by email instead, as our Research page describes, and what you send us is covered by “When you email us” below. If we open the form, it will store the purpose, your institution, an IRB number if you have one, and a description of the data you want.

When you email us

Our public address is a Google Workspace group, so a message you send it is delivered to and stored by Google: the body, your address, the subject and anything you attach. We keep it for as long as the conversation is useful.