Privacy Policy
OSPREY stores as little about you as it can. This page covers what is kept and why.
Signing in
Sign-in runs through ORCID. You never set a password here, and OSPREY doesn't keep ORCID credentials or access tokens after sign-in finishes. What OSPREY does keep is your ORCID iD, your name as ORCID provides it, and whatever you add to your profile yourself, such as display name, bio, institution, and avatar.
OSPREY only holds an email address if you add one. It gets used for activity notifications, such as questions on your projects, replies to your threads, use reports, and wiki suggestions, and for the occasional service notice that affects your account, like a change to this policy. No marketing and no newsletters go to this email address. Mailjet, the service that delivers OSPREY's email, is the only other place the address goes, and only so the mail can be sent.
You can remove the address in notification settings at any time, and disabling email notifications removes it too. Either way the address is deleted immediately and any queued mail is cancelled.
If a project owner gives us a collaborator's email address to send a contributor invitation, it's used to send that one invitation and isn't kept.
What you publish
Projects, wiki edits, discussion posts, and use reports are the point of the platform and are public by design. Publishing a project also deposits a snapshot with Zenodo, the CERN-operated research archive, which is what mints the DOI. That snapshot includes the project files and the contributor list, names and ORCID iDs included. OSPREY is built to be an archive, so published records are meant to stay part of the public research record. Drafts stay private until you publish them.
Suggestion Box and privacy requests
If you send something through the Suggestion Box, OSPREY keeps your message, the screenshot if you chose to attach one, and coarse browser information (browser family, operating system, window size) so problems can be reproduced. Requests sent through the privacy request form keep just your message. Only staff can see either.
Cookies
Three cookies are used. One keeps you signed in, one protects forms against forgery (CSRF), and one remembers your theme choice. There are no analytics or tracking cookies.
Your rights
OSPREY is run by pHalkon Industries LLC, which is the data controller for everything above. You can see and correct your profile yourself, and notification settings removes your email address whenever you want. Deactivating your account stops it from being used; signing in with ORCID again reactivates it.
For full account deletion, send a request through the privacy request form and staff will handle it. Be aware of what deletion can and can't cover on an archive: your email address, notification history, preferences, and profile details are removed, but published projects, their Zenodo records, and the attribution on them stay part of the public research record, the same way a published paper keeps its author list. People in the EU and similar jurisdictions also hold the formal GDPR rights, from access and correction through portability and lodging a complaint with their data protection authority.
For questions or requests about your data, please use the privacy request form.