Privacy policy

1. Who is responsible

The controller under the GDPR is Osama A.A. Mohamed, [Street: not filled in yet], [Postcode and city: not filled in yet], Germany. Email: hello@sciency.bio. See also the legal notice.

2. What we process, and why

Your account

Your email address and a password (stored only as a secure hash) to let you log in, plus your username. Legal basis: performing our agreement with you (Art. 6(1)(b) GDPR). Your email is used to log in, to confirm your account and to reset your password. We don't send newsletters.

Your profile

Everything else on your profile is optional: display name, bio, affiliation, a link, a profile photo and a cover image. Your affiliation is hidden unless you switch it on. You choose whether your posts and replies are listed on your profile and who may send you message requests. Legal basis: Art. 6(1)(b) GDPR.

What you post

Posts, replies, failure logs, Collab Board posts, bounties, Town Hall proposals and any images you attach are shown to signed-in members. Before upload, your browser shrinks images and removes hidden photo data such as location and camera details. Profile photos and covers are stored at a random web address that anyone with the link can open. Other images are only shown to members who can see the post they belong to. Legal basis: Art. 6(1)(b) GDPR.

Private messages

Messages are visible only to the two people in the conversation. Moderators can read a message only if one of the two reports it. If you delete a message or a conversation, it disappears for you only: the other person keeps their copy, and it is fully deleted when one of you deletes their account. Legal basis: Art. 6(1)(b) GDPR.

Votes, points and rewards

Town Hall and Fail of Fame votes are secret: other members only see totals. Your points history and the rewards you redeem are visible only to you and to the admins who deliver rewards. When a reward is delivered, the code or instructions are shown only to you. Sponsors are never told who redeemed what. Legal basis: Art. 6(1)(b) GDPR.

Verification

If you verify with a university or institute email, we send a one-time code to that address. We do not store the address. We keep only a one-way fingerprint of it, so the same address can't verify a second account, and its domain (for example uni-hamburg.de), which only you and the admins can see. If you ask for a manual check, we keep what you write to us. Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in one verified person per account, so that votes and rewards stay fair (Art. 6(1)(f) GDPR).

Invites

During the beta you join with an invite. We record which invite code your account used, and so who invited you. You can see the people who joined with your links; the admins can see all invites. We use this to keep the beta to real researchers and to trace waves of fake accounts. When either account is deleted, the link between them is deleted too. Legal basis: our legitimate interest in a safe community (Art. 6(1)(f) GDPR).

Safety and moderation

We keep the reports you send and the reports about your content, the decisions moderators make and a log of moderation actions. A public version of that log shows only the type of action and the reason, never who was involved. Content that several members report is paused or hidden automatically until a person reviews it. Legal basis: our legitimate interest in a safe community and our legal duties (Art. 6(1)(f) and (c) GDPR).

Contact and help requests

If you write to us through the contact page or the Town Hall help form, we use what you send to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR. We delete these messages when they are no longer needed.

Paper lookups

When you search for a paper or cite a DOI or PubMed ID, our server asks PubMed (US National Library of Medicine) and Crossref for the paper details. Only the search words or IDs are sent, from our server, not from your browser, and never together with who you are.

Server logs

When you open a page, our hosting provider briefly records technical data such as your IP address, the time, the page and your browser type, to keep the service running and secure. Legal basis: Art. 6(1)(f) GDPR.

3. Cookies and storage on your device

We only use cookies that are needed to keep you logged in. They are essential, so no consent banner is needed (§ 25(2) TDDDG). If you pick a light or dark theme, that choice is saved in your browser's local storage and never sent to us. Our fonts are delivered by our own server, so no font service sees your visit.

4. Service providers

These companies process data on our behalf, under data processing agreements:

• Supabase (Supabase Inc., USA): database, login and file storage. Your data is stored in Frankfurt, Germany (EU).
• Vercel (Vercel Inc., USA): hosting of the website. Pages are delivered from servers near you, and the parts that read your data run in Frankfurt, Germany.
• Resend (Resend Inc., USA): sending emails such as account confirmations, password resets and verification codes. Resend keeps a delivery log with the recipient address for a limited time.

Because these companies are based in the USA, data may be accessed from there. Such transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

5. How long we keep data

We keep your account data for as long as you have an account. When you delete your account in Settings, your profile, photos, posts, replies, logs, messages you sent, votes, points, rewards and invites are deleted. Replies other members wrote under your posts are deleted along with them. Copies may remain in our hosting provider's backups for a short time before they are overwritten. We keep data longer only where the law requires it.

6. Your rights

You have the right to:

• get a copy of your data (Settings, Your data, Download, gives you everything in one file),
• have wrong data corrected (most of it you can change yourself in Settings),
• have your data deleted (Settings, Your data, Delete account),
• restrict processing, and receive your data in a portable format,
• object to processing that is based on our legitimate interests,
• complain to a data protection authority.

To use any of these rights, write to hello@sciency.bio. The authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg (datenschutz-hamburg.de). You can also contact the authority where you live or work.

7. Age

Sciency is for people aged 16 or older.

8. Changes

When we change how we handle data, we update this page and the date at the top. For important changes we tell you in the app before they take effect.