Privacy policy
Last updated: 2 November 2026
The short version
This site has no accounts, no ads, no analytics and sets no cookies. It loads nothing from other companies.
The research planner, when it opens, keeps two things about you: your email address and a copy of the pledge you signed. We do not keep your research text, and we do not use anyone’s data to train AI.
1. Who is responsible
The entity and person responsible for your data is Librepisteme / Subhradeep Chatterjee, Kolkata, India. This person is the “controller” under the GDPR and the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act).
Contact for anything in this policy, and for complaints (our grievance contact under the DPDP Act): Subhradeep Chatterjee, librepisteme@gmail.com.
2. This website today
- No accounts, forms or comments. Nothing you do here is sent to us.
- No cookies, no analytics, no advertising or tracking tools, no social media buttons.
- Fonts and images come from this site itself, not from Google or any other company.
- Our website host, Cloudflare (Cloudflare Pages), receives your IP address and browser details when you open a page, as every web host does, and may keep server logs under its own privacy statement. We cannot see those logs.
- The tool cards link to other websites. Those sites have their own policies, and we are not responsible for them.
- The consent notice remembers your choice in your browser’s local storage for 12 months. It never leaves your device.
3. The research planner (not open yet)
To use the planner you read and sign a short pledge against academic harassment, then sign in with a code sent to your email. This is exactly what we keep, and for how long.
| Data | Why | How long |
|---|---|---|
| Your email address | To send you the sign-in code and your access key, to check the key when you return, and to reach you about your access. | While you have access. Deleted 12 months after you last use the planner, or sooner if you ask (see below). |
| A copy of your signed pledge: the pledge text you accepted, the name you signed with, your academic affiliation (if provided), and the date and time | To show what you agreed to, and to withdraw access if the pledge is broken or a complaint is made about misuse. A copy is also emailed to you. | While you have access and for 24 months afterwards, so a complaint can still be handled. Then deleted. If you ask us to delete it earlier we will, unless we need it to deal with a complaint or legal claim. |
| One-time sign-in code | To confirm the address is yours. | 10 minutes, or until used. |
| Your project description | Processed to build your plan. It is sent to Cloudflare’s Workers AI service, which acts for us as a processor, and the plan is shown on your screen. | Not stored by us. Cloudflare’s published terms say it does not use this content to train models or to improve its services, and does not keep it unless a storage service is used alongside, which we do not do. We switch off request logging for this text. |
| Your IP address | Security and limiting abuse. Handled by Cloudflare, which runs the planner. | Only as long as needed for those purposes. |
We do not sell or rent data, build profiles, run ads, or make decisions about you that have legal or similar effects. The plan is a suggestion. You are free to ignore it.
4. Why we may process it (legal bases)
Under the GDPR
- Email address, sign-in codes and access key: to provide the service you ask for (Article 6(1)(b)).
- Signing the pledge and keeping a copy: your consent (Article 6(1)(a)), which you can withdraw at any time, and our legitimate interest in being able to enforce the pledge and protect other users (Article 6(1)(f)). You may object to the second.
- Security and preventing abuse: our legitimate interest (Article 6(1)(f)).
Under the DPDP Act
- We process your email and pledge copy on the basis of your consent, given by ticking the pledge and privacy box when you sign. You can withdraw it as easily as you gave it, and then we stop and delete your data as explained above.
- Where the Act allows it, we also process data for the narrow “legitimate uses” it lists, such as complying with the law.
5. Cookies and similar storage
| Name | Purpose | Kept | Needs consent |
|---|---|---|---|
lp-consent (local storage) | Remembers your choice in the notice. | 12 months | No, it is strictly necessary |
| Sign-in token (local storage, planner only) | Keeps you signed in after you enter the code. | Until you sign out or it expires | No, it is strictly necessary for what you asked for |
Anonymous statistics are not used. If we ever add them, they will stay off unless you accept them, and we will update this page first.
6. Who else handles your data
- Cloudflare hosts this website (Cloudflare Pages), runs the planner’s server, stores the email and pledge copy, and provides the AI model service.
- Transactional email provider (such as Cloudflare Email Routing or Resend) delivers the pledge copy and sign-in codes under standard contractual data processing terms.
They process data only on our instructions, apart from Cloudflare’s own security logs. Some of them are in the United States or elsewhere outside your country. Where data leaves the European Economic Area, we rely on safeguards such as the EU–US Data Privacy Framework or standard contractual clauses, as those providers offer. For people in India, the DPDP Act permits transfers abroad except to countries the government restricts.
7. Your rights under the GDPR (EEA and UK)
You can ask us to show you the data we hold about you, correct it, delete it, restrict its use, give you a copy you can move elsewhere, or stop using it where we rely on legitimate interests. You can withdraw consent at any time. We do not make automated decisions with legal effect about you.
You can complain to the data protection authority where you live or work. In the EU, find yours through the European Data Protection Board. In the UK it is the Information Commissioner’s Office.
As an educational, non-commercial open-source project operated outside the EEA that processes minimal, non-sensitive data on an occasional basis for research access, we qualify for the exemption under Article 27(2)(a) of the GDPR. You may contact us directly to exercise any of your rights.
8. Your rights under India’s DPDP Act, 2023
As a “Data Principal” you can: get a summary of the personal data we process about you and what we do with it; ask us to correct, complete or update it; ask us to erase it; withdraw your consent at any time; use our grievance contact above to have a complaint resolved; and nominate another person to exercise these rights for you if you die or cannot act for yourself.
If we do not resolve your grievance, you can complain to the Data Protection Board of India. The main duties under the Act and its 2025 Rules start in phases and fully apply from 13 May 2027. We already follow them.
9. How to use your rights
Email librepisteme@gmail.com from the address you signed up with, or tell us how else we can check it is you. It is free. We aim to reply within one month. If we have to refuse something, we will tell you why.
10. Security and breaches
Connections use HTTPS. Sign-in codes expire quickly and allow only a few attempts. Stored data is encrypted by our hosting provider, and only the person named in section 1 can read it. Keys and secrets are kept in encrypted server settings, never in the website’s code. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires, for example the Data Protection Board in India and the supervisory authority under the GDPR.
11. Age
The planner is for adults only, aged 18 or over. It is not directed at children, so we do not knowingly collect their data.
12. Changes
If this policy changes, we will update the date above and, for anything important, tell planner users by email.