If you never sign in
We store nothing about you. There is no advertising, no cross-site tracking, no
fingerprinting, and no third-party analytics script. The site keeps two values in your
browser's localStorage, which never leave your device and are not readable
by us: your colour theme and whether you prefer the table or the card layout.
The site is hosted by Vercel, which counts page views and Core Web Vitals without cookies and without building a profile of you. Vercel also keeps short-lived server logs containing IP addresses, as any web host does.
If you sign in with Google
We ask Google for three things and nothing else: openid, your email
address, and your basic profile (your name). We never ask for, and cannot read, your
Gmail, Drive, contacts or calendar.
We then store one row:
| What | Why | Shown publicly? |
|---|---|---|
| A Google account identifier | To recognise you as the same person next time. This is Google's opaque subject id, not your email. | No, never |
| Your email address | Account recovery, and contacting you if a contribution needs a question answered. | No, never |
| A handle, generated for you | How you are referred to on the site. Two words, assigned at signup, and yours to change. | Yes, if you publish your profile |
| A display name, seeded from Google | So credit can read as a real name if you want it to. Editable, and blankable. | Only if you publish your profile |
| ORCID and GitHub username, if you add them | So a reader can judge whether a check is independent. | Only if you publish your profile |
| Sign-up and last-seen timestamps | Abuse handling, and dormant-account cleanup. | Sign-up month only |
Your profile is private by default. Nothing above is visible to anyone else until you turn on the public profile switch in your account.
What we store when you use the site
Two more things, both tied to your account row and both deleted with it.
| What | Why | Shown publicly? |
|---|---|---|
| Triage signals: which entries you flagged, and how | To order the review queue. That is their only effect: a signal never changes a grade and never appears on an entry. | As a count only. Who flagged what is never shown, to anyone, including maintainers |
| Submissions you make, and what happened to them | So a maintainer can review one, and so you can see its status even if it is turned down. A rejected submission never reaches the public repository, so this row is the only record you would have of it. | Only once merged, and then as the credit on the entry itself |
Submissions that are still pending, turned down, or waiting on a question are visible to you and to maintainers, and to nobody else. A public profile shows merged work only: publishing what somebody tried and had refused would make submitting a risk, which is the opposite of the point.
The session cookie
Signing in sets one cookie, waf_session. It holds a signed reference to
your account row and nothing else: no email, no name, no tracking identifier. It is
HttpOnly, so no script on the page, ours or anyone else's, can read it. It
is SameSite=Lax, so other sites cannot use it to act as you. It lasts 30
days. It is not an advertising cookie and is not shared with anyone.
Deleting your account
There is a delete button in your account. It removes everything described above immediately: the Google identifier, your email, your handle, your settings, every signal you have cast and every submission you have made, accepted or not. No confirmation email, no waiting period, no retention window.
One thing does not disappear, and you should know before you contribute.
If a check or a correction you submitted has already been accepted and merged, the credit
for it lives in data/entries.json, which is a public file under CC BY 4.0,
published in a public git repository, and copied by anyone who has cloned it. That record
is the registry's audit trail: it is how a reader can tell who verified a result, and it
is the reason the grades can be trusted at all. We cannot retract it from the people who
have it, and we would not, because a registry that quietly edits its own history is worth
less than one that does not. If you would rather not be named there, you can contribute
under your handle instead of your name, or ask us before you submit.
What we do not do
- We do not sell or share your data. There is nobody to sell it to and nothing worth selling.
- We do not send marketing email. The only mail you could receive is a direct reply about something you submitted.
- We do not use your data to train anything.
- We do not load third-party scripts, fonts or images. The site's content security policy blocks them, which you can verify in your browser's developer tools.
Your rights, and who to ask
You can see everything we hold about you on your account page: that page is the complete list, not a summary. You can correct any of it there, and you can delete all of it there. For anything else, including a copy in a portable format, write to misik6@gatech.edu.
whataifound.org is an independent volunteer project, not a company. Questions about this page go to the same address.
This page describes the site as built. If what we store changes, this page changes in the same pull request, and the change is visible in the public history of this file.