If you never sign in
We store nothing about you. There is no advertising, no cross-site tracking, no
fingerprinting, and no third-party analytics script. The site keeps two values in your
browser's localStorage, which never leave your device and are not readable
by us: your colour theme and whether you prefer the table or the card layout.
Our host counts page views and load times without cookies and without building a profile of you, and keeps short-lived server logs containing IP addresses, as any web host does. Nothing in those counts is tied to an account.
If you sign in with Google
We ask Google for three things and nothing else: openid, your email
address, and your basic profile (your name). We never ask for, and cannot read, your
Gmail, Drive, contacts or calendar.
We then store one row:
| What | Why | Shown publicly? |
|---|---|---|
| A Google account identifier | To recognise you as the same person next time. This is Google's opaque subject id, not your email. | No, never |
| Your email address | Account recovery, and contacting you if a contribution needs a question answered. | No, never |
| A handle, generated for you | How you are referred to on the site. Two words, assigned at signup, and yours to change. | Yes, if you publish your profile |
| A display name, seeded from Google | So credit can read as a real name if you want it to. Editable, and blankable. | Only if you publish your profile |
| ORCID and GitHub username, if you add them | So a reader can judge whether a check is independent. | Only if you publish your profile |
| Sign-up and last-seen timestamps | Abuse handling, and knowing whether an account is still in use. Nothing deletes an account on a timer: the button in your account is the only thing that removes a row. | Sign-up month only |
| Your role | Reader unless a maintainer moves you up the ladder in GOVERNANCE.md. Nothing you can set yourself. | Only if you publish your profile |
| When you last changed your handle | To hold you to one rename per cooldown. A handle is how other people refer to your work, so it should not be a moving target. | No, never |
| A ban timestamp, if you are ever banned | So a banned account cannot sign up again into the same Google account and find its history gone. | No, never |
That row lives in one managed Postgres database that only this site's own server code can reach. There is no database client in your browser and no key on the page that could read it, which is why none of the above can leak from the front end.
Your profile is private by default. Nothing above is visible to anyone else until you turn on the public profile switch in your account.
What we store when you use the site
Two more things, both tied to your account row and both deleted with it.
| What | Why | Shown publicly? |
|---|---|---|
| Triage signals: which entries you flagged, and how | To order the review queue. That is their only effect: a signal never changes a grade and never appears on an entry. | As a count only. Who flagged what is never shown, to anyone, including maintainers |
| Submissions you make, and what happened to them | So a maintainer can review one, and so you can see its status even if it is turned down. A rejected submission never reaches the public repository, so this row is the only record you would have of it. | Once a maintainer approves it, and then as the credit on the entry itself |
Approving is the moment a submission becomes public, not merging. A maintainer's approval opens a pull request carrying what you wrote and the handle you wrote it under, and that pull request is public from the moment it opens, whether or not it is merged in the end. Until then a submission is visible to you and to maintainers and to nobody else, and a submission that is turned down before that point never leaves the database.
A public profile shows merged work only: publishing what somebody tried and had refused would make submitting a risk, which is the opposite of the point.
How much of this there is. One row per account, in three tables, and that is the whole of it. A signal is one row per entry per kind, so clicking the same flag twice cannot add a second. Submissions are capped at ten waiting for review and twenty a day. There is no event log, no analytics table, and nothing that grows with how much you read.
The two cookies
Signing in sets waf_session. It holds a signed reference to your account
row and nothing else: no email, no name, no tracking identifier. It is
HttpOnly, so no script on the page, ours or anyone else's, can read it. It
is SameSite=Lax, so other sites cannot use it to act as you. It lasts 30
days. It is not an advertising cookie and is not shared with anyone.
The round trip through Google sets a second one, waf_oauth, with the same
protections. It exists only to prove that the reply coming back from Google belongs to a
sign-in this browser started. It lasts five minutes and is deleted the moment you land
back on the site, whether the sign-in worked or not.
Deleting your account
There is a delete button in your account. It removes everything described above immediately: the Google identifier, your email, your handle, your settings, every signal you have cast and every submission you have made, accepted or not. No confirmation email, no waiting period, no retention window.
What it cannot remove, and you should know before you contribute.
Anything already approved has left the database by then. A pull request that has been
opened stays on GitHub whether or not it was merged, and if it was merged, the credit for
it lives in data/entries.json, a public file under CC BY 4.0 in a public git
repository, copied by anyone who has cloned it. That record is the registry's audit
trail: it is how a reader can tell who verified a result, and it is the reason the grades
can be trusted at all. We cannot retract it from the people who have it, and we would
not, because a registry that quietly edits its own history is worth less than one that
does not. If you would rather not be named there, contribute under your handle instead of
your name, or ask us before you submit.
What we do not do
- We do not sell or share your data. There is nobody to sell it to and nothing worth selling.
- We do not send marketing email. The only mail you could receive is a direct reply about something you submitted.
- We do not use your data to train anything.
- We do not load third-party scripts, fonts or images. The site's content security policy blocks them, which you can verify in your browser's developer tools. Two things sit outside that: a finding page with a video explainer shows a still image until you press play, and pressing it loads the player from YouTube in its privacy-preserving mode; and our host's anonymous page and load-time counts are sent to the host. Neither happens unless you press play or load a page.
Your rights, and who to ask
You can see everything we hold about you on your account page: that page is the complete list, not a summary. You can correct any of it there, and you can delete all of it there. For anything else, including a copy in a portable format, write to misik6@gatech.edu.
whataifound.org is an independent volunteer project, not a company. Questions about this page go to the same address.
This page describes the site as built. If what we store changes, this page changes in the same pull request, and the change is visible in the public history of this file.