Privacy policy

Who is responsible

Dorian Koch
Germany
do.ko1605.dk@gmail.com

This site is run by one person, so there is no data protection officer.

What is stored, and why

• Your account: username, password (only as a salted hash), the papers you save, mark as "not for this tag" or neutral, per tag, your latest digest and how many papers per tag it should have, and when you were last active. Needed to provide the service you signed up for (Art. 6(1)(b) GDPR). Kept until you delete the account.
• Your email address, only if you enter one: used for nothing but the weekly digest, which only starts after you confirm the address through a link we mail to it (double opt-in). We store when you confirmed, as the record of your consent (Art. 6(1)(a) GDPR). You can withdraw any time through the link in every digest or on your profile; the address is then deleted.
• Papers you add by link: if a paper isn't here yet, this server asks arXiv for it. The request contains only the paper's id, nothing about you. We keep a log of who added which paper for two days, to enforce daily limits.
• Technical data: to keep the site working and protect it from abuse (Art. 6(1)(f) GDPR), your IP address is held in memory for rate limits and forgotten within minutes, and an address entered for the digest is held in memory for a day, to limit confirmation mails. The application logs record requests without IP addresses or search terms; the mail server logs record recipient addresses of delivered mail. All logs are rotated (at most 30 MB per service). The reverse proxy in front of the site may log IP addresses for a short time as part of its standard operation.
• Sharing: only if you turn on read-only sharing, anyone with a link to your pages (they contain your username) can view your tags, recommendations and digest, and copy a tag into their own account; never your email address. Off by default, and turning it off ends that access at once.

Cookies and third parties

The only cookie is the session cookie that keeps you logged in, which is strictly necessary for the service (§ 25(2) TDDDG, Art. 5(3) ePrivacy Directive), so no consent is asked for. There is no tracking, no analytics, no advertising, and no third-party content: scripts and fonts come from this server, so your browser contacts no one else. Links to arXiv lead to arXiv's own site. The one other thing kept in your browser is whether you picked the "Cards" or "Titles only" view (local storage, never sent to the server), a setting you asked for (§ 25(2) TDDDG).

Who receives your data

No one, apart from the hosting provider (-), which runs the server under a data processing agreement (Art. 28 GDPR). Digests are delivered directly by this server to your mail provider. Nothing is sold or shared.

Backups

One backup copy of the account database is made daily and overwrites the previous one, so data you delete is gone from it within a day.

Your rights

You can access and download everything stored about you (download my data, Art. 15 and 20 GDPR), correct it (Art. 16), delete your account yourself on your profile (Art. 17), and restrict or object to processing (Art. 18 and 21). Write to the address above for anything else. You can also complain to a data protection supervisory authority, for example the one where you live.