Privacy Policy

• You can browse, examine and cite every published artefact without an account.
• We do not use advertising or tracking cookies and we do not sell personal data. Page views are counted without cookies (Cloudflare Web Analytics).
• Each record shows how often its page was opened. To count a visitor once a day, we keep for two days only a one-way hash of the day, your network address, your browser type and the record; never the address itself. Crawlers are not counted.
• An account stores only what is needed to sign you in and to show your own records.
• Questions and requests: [email protected].

OpenRTI (openrti.org) is a non-commercial, open-access research platform. OpenRTI is responsible for the account data described on this page (names, email addresses, ORCID iDs and sign-in records) and processes them only to run the service. The information and data of each record, including any personal data they contain (for example the names of people in a description), are the responsibility of the member who uploads them. Privacy questions and requests: [email protected].

Without an account. Your theme and display preferences, and the views you save while not signed in, are kept in your own browser (local storage) and are not sent to us. Like any website, our network and hosting providers process your IP address and basic request data to deliver the pages and protect the service.

When you sign in:

• With ORCID: your ORCID iD and the name your ORCID record shares.
• With Google: your Google account identifier, name and verified e-mail address, and the Google Workspace domain that manages that address, if any.
• With an e-mail link: the e-mail address you enter.
• The display name you choose, whether your ORCID iD may be shown next to your uploads, and which optional e-mail notices you want.
• The views you save while signed in.
• One session cookie that keeps you signed in for up to 30 days. We store only a hash of it, and a hash of your browser type. While you sign in with ORCID or Google, a second cookie protects the sign-in for ten minutes.
• For each sign-in e-mail: a hash of the one-time link, the address, and a hash of your IP address, used to prevent abuse and deleted after 24 hours.

Uploads: the files and descriptive information you upload, whether each record is private or published, and the name, size and SHA-256 digest of each original file, which are published with the record.

Sharing: the people you add to a record, and the e-mail address of each person you invite, which is deleted 60 days after the invitation.

Your e-mail address is never shown on the site, except that a record's owner sees the address an invitation was sent to. We never write to your ORCID record.

• To provide your account and the records you create: our service to you, under the Terms of Service.
• To publish the records you choose to publish, with the attribution you provide: at your request, under the Terms of Service.
• To sign you in with ORCID or Google: only when you choose to.
• To keep the service secure, prevent abuse and fix errors: legitimate interest.

We do not use your data for advertising or profiling.

We use a small number of providers who process data on our behalf, only to run the service:

• Cloudflare: network, hosting of the pages and published data, the membership API and its database, and page-view statistics (Cloudflare Web Analytics: no cookies, no profile of you; it records the page, referrer, browser type and country, and timing).
• Resend: delivery of the site's e-mails (sign-in links, invitations and notices about your records).
• GitHub: runs the weekly off-site backup job, which handles the database export briefly before it is encrypted.
• A separate storage service: the weekly off-site copy of the database (encrypted) and of the published data, used only to restore the service.
• ORCID and Google: only when you choose to sign in with them, under their own privacy policies.

These providers (Cloudflare, Resend, GitHub, Google and the off-site storage service) may process data in other countries, including the United States; these transfers rely on the providers' own data protection agreements (standard contractual clauses). We do not sell or rent personal data.

• Account data: until you delete your account.
• Sessions: up to 30 days, or until you sign out.
• Sign-in e-mail records: 24 hours.
• Invitations, with the address they were sent to: 60 days.
• Request logs of the service (network address, page, time): at most seven days, at Cloudflare.
• The audit log of a record (which account changed what, and when): as long as the record exists.
• Backups: the service is backed up every week twice, once within the hosting provider's storage and once to a separate storage service. The copies kept with the hosting provider hold display names, ORCID iDs, roles and saved views, without e-mail addresses; the off-site copy, encrypted, holds the whole database, e-mail addresses included. Data you delete leaves all backups within about thirteen months. Backups are used only to restore the service after a failure, and only the project's key can open the off-site copy. If the service is ever restored from a backup, accounts and data deleted since that backup are deleted again before the service reopens.
• Published records are meant to stay available so that citations keep working. Requests to remove a published record follow the complaints and removal procedure of the Terms of Service.

Depending on where you live, including under the EU GDPR and Turkey's Personal Data Protection Law (KVKK, No. 6698), you can ask to access, correct or delete your personal data, to receive a copy, or to object to its use. Write to [email protected]; we answer within 30 days. You can also complain to your data protection authority.

You can also download your data yourself on the account page, under “Your data”, and, if none of your records is published, delete your account there. Published records stay available so that citations keep working, so an account with published records is deleted on request: write to us.

We will update this page when our practices change and show the date of the latest version at the top. Significant changes will be announced on the site.