Plain-language privacy information.

Information we process

Reading public research does not require an account. We may process ordinary technical request data through our hosting and database providers, such as an IP address, browser or device information, requested page, time, and security logs. If you submit an issue report, we process the text you provide and an optional email address. Editorial administrators provide account and authentication information to use the private research system.

Why we use it

We use this limited information to deliver and secure the site, operate administrator authentication, receive correction and privacy requests, diagnose failures, and protect the integrity of the research database. Depending on the context and applicable law, processing is based on providing a requested service, legitimate interests in security and publication integrity, legal obligations, or consent where consent is required.

Cookies and browser storage

The public site currently uses essential browser storage only: administrator authentication/session storage, PWA service-worker caches needed for installable operation, security-related storage, and a local preference that remembers whether you acknowledged the privacy notice. The site does not currently use advertising cookies, cross-site behavioral advertising, or non-essential analytics. Essential authentication and technical storage are necessary for the requested service. If optional tracking is added later, it will remain disabled until any consent required by applicable law is obtained.

Service providers and transfers

Vercel hosts the website and Supabase provides the database and administrator authentication. These providers may process technical data on our behalf under their own security and retention controls. Their infrastructure may process information outside your state or country with the safeguards their agreements and applicable law require.

Retention and security

Issue reports are kept only as long as reasonably needed to investigate, document, and resolve the report or meet legal obligations. Administrator records are retained while access is active and as needed to protect revision and security history. Provider logs follow the provider's configured retention. We use access controls, row-level database policies, HTTPS, and an immutable editorial revision trail, but no internet service can promise absolute security.

Your choices and rights

You can use your browser settings to remove local storage and cookies. Where applicable, you may request access, correction, deletion, restriction, portability, or objection, withdraw consent, and complain to your data-protection authority. California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain sensitive-data uses, and receive non-discriminatory treatment. This site does not sell personal information or use it for cross-context behavioral advertising. Because it does not perform such sale or sharing, a Global Privacy Control signal does not need to disable an existing sale or sharing process.

Submit a privacy request. Select “Privacy request” and provide an email so the request can be verified and answered. We may ask for limited information to confirm identity before disclosing or deleting data.

Children and changes

This research site is intended for a general audience and does not knowingly collect personal information from children under 13. We will date material changes to this notice and provide a new privacy prompt when a change affects visitor choices.

Official guidance

This operational notice is not legal advice. Learn more from the European Commission's GDPR rights guidance and the California Attorney General's CCPA guidance.