Privacy notice

What we collect

When you visit the website or call the API

• Cloudflare runs our hosting. Each request passes through a Cloudflare data centre near you, which uses your IP address to deliver the request and to protect the service from abuse.
• Our services write log lines, which Cloudflare keeps for us: when something happened, what it was, and random ids for the request, your organisation and your API keys. We write them to leave out your IP address, your browser and your email address.
• If you choose a theme, a cookie remembers your choice. We do not use advertising cookies.

Google Analytics on the public pages

On the home page, the dataset pages, the access page and the docs, Google Analytics measures how the website is used. A page you open anywhere else, such as sign-in, sign-up, feedback or your dashboard, does not load it. If you go on to such a page from one of the measured pages, it notes only that page's address, without the part after the question mark, and what you do there, such as how long you stay. We do not tell Google who you are.

• What it records: the pages you view and the page you came from, each without the part of its address after the question mark (so no search words or filters), apart from the campaign tags of a link we shared; your browser, device, screen size and language; the country and city you are probably in, which Google works out from your IP address without storing it; and what you do on the page, such as how far you scroll and the links to other websites you follow.
• Cookies: Google Analytics sets cookies named _ga and _ga_ followed by our measurement id, so it can tell when the same browser comes back. They last 2 years. In the European Economic Area, the United Kingdom and Switzerland it sets no cookies and measures visits without them.
• We have turned off Google's advertising features and Google signals, so nothing Google Analytics records here is used for advertising.
• To stop it, install Google's opt-out browser add-on, or block cookies and scripts from Google in your browser.

When you sign up or sign in

You can create an account with your email address or with GitHub. While sign-up is open, anyone can create one; while it is closed, a new account needs an invitation from us.

• Your email address, and your name if you give it.
• Each sign-in link that is asked for, stored with the email address it was asked for. We store it even when we do not send it: while sign-up is closed, we send links only to existing accounts and to addresses we have invited.
• If you sign in with GitHub: GitHub sends us your profile and your email addresses, and we keep your GitHub user id, your name (or username), one email address and the web address of your profile picture. We ask GitHub only for your profile and email addresses, and we do not keep the access tokens GitHub issues.
• A record of each session: when it started, when it expires, and the IP address and browser you signed in from. Cookies keep you signed in.
• Counts, kept in our database, of recent requests to our sign-in service from each IP address and of the sign-in links asked for each email address, so that no one can flood the service or fill someone's inbox. We store the count for an email address under a keyed hash of the address, not the address itself.
• Before we send a sign-in link, and before a GitHub sign-in starts, Cloudflare Turnstile checks that a person is asking. To do this it looks at information about your browser and device, and we pass it your IP address.

If we invite you

Your email address, which we use to send the invitation, and a record of the invitation: who created it, when it expires and whether it has been used.

Your organisation and API keys

• At your first sign-in we create an organisation for you on the free plan, named with a random code. We record a region code for the continent you signed up from, as Cloudflare sees your connection. Your organisation's usage counter runs in a Cloudflare data centre chosen when it is first used: near you, or in the region we recorded.
• For each API key: the name you give it, what it may be used for, any expiry date, who created it and when, and the last day it was used. We store each key's secret only as a keyed hash, which cannot be turned back into the key. We also keep a record of each change to your keys: who created or revoked a key, when, and the key's name and settings.

When you use the data

For each request you make with an API key, and each explore run: the time, a request id, the key or signed-in user that made it, the dataset and release, the kind of request, whether it succeeded, whether it was served from our cache, and how many rows, units and bytes it used. We add these records to totals for your organisation by time, key or user, and dataset.

When you write to us

What you send us and your email address, whether you write to ops@opendatarouter.com or use the feedback form on this website. With a message from the feedback form we also keep what it is about, any link you add, when you sent it, and your account and organisation. To stop the form being flooded, we count how many messages each account sends, in our database.

Payments

We do not collect payment details: payments are not switched on, and nothing is charged. If we start charging, you will pay on Stripe's own pages, so your card details will never reach us, and we will update this notice first.

How we use it

• To run the alpha: to send invitations and sign-in links, keep you signed in, check API keys, apply usage limits, show you your usage, keep the service secure and fix faults.
• To improve the service: we look at how the alpha is used, and at your feedback, to decide what to build next. Google Analytics shows us how the public pages are used.
• To contact you about your account and about changes to the alpha.

We do not sell personal information, and we do not use it for advertising.

Who else handles it

These companies handle personal information for us:

• Cloudflare: hosting, network, storage, logs and the Turnstile check. Cloudflare also forwards email sent to ops@opendatarouter.com.
• PlanetScale: our database, which runs in Sydney, Australia.
• Amazon Web Services: Amazon SES sends our email from Sydney and tells us if a message to you bounces or is reported as spam. Amazon S3 in Sydney holds encrypted copies of our backups.
• GitHub: if you sign in with GitHub, it confirms who you are and sends us your profile and email addresses, of which we keep only the details listed above. Our backup jobs also run on GitHub's servers, which handle a copy of the database while each backup is made and encrypted.
• Google: Google Analytics measures the public pages, as described above, and email sent to ops@opendatarouter.com arrives in a Gmail inbox.

Where it is kept

• Your account, organisation, API keys, usage totals and messages from the feedback form: in our database in Sydney, Australia.
• Your organisation's usage counter, the request records waiting to be added to its totals, and a copy of each key's hash, permissions and expiry date: with Cloudflare, in the data centre where the counter runs.
• Service logs: with Cloudflare.
• What Google Analytics records: with Google.
• Backups: with PlanetScale, in Cloudflare storage that we ask Cloudflare to keep in the Oceania region, and in Amazon S3 in Sydney.

Cloudflare handles each request in a data centre near you, which may be outside Australia. Cloudflare, GitHub, Google and PlanetScale may handle or store information outside Australia.

How long we keep it

• Account details and API keys: until you close your account. Closing it revokes your keys and deletes them, your sessions, the messages you sent through the feedback form and the email address on any invitation we sent you. These stay, and refer to you by random ids rather than your name or email address: your organisation's record (its random code, region code and plan), your usage totals, the record of changes to your keys, which also keeps the names you gave them, a record of each message you sent through the feedback form (when, and what it was about, without its text), and the usage counter's copy of each revoked key's hash, permissions and expiry date, which stops the key from ever working again.
• Invitations: we keep the email address on an invitation until you close your account. If you never create an account, the invitation and its address have no fixed deletion date yet.
• Sessions: signing out deletes the session record. A session you stop using expires, and a clean-up that runs automatically throughout the day then deletes its record.
• Sign-in links: a link is deleted once it is used. An unused link expires after 15 minutes, and the same clean-up then deletes it, with the email address it was asked for.
• Sign-in and feedback counts in our database: a count that has had no new request for 60 minutes can no longer affect a limit, and the clean-up then deletes it.
• Service logs: Cloudflare deletes them after 7 days.
• Google Analytics: Google deletes the record of each visit after 2 months. The totals in its reports, which do not single out a browser, have no end date.
• Usage: the record of each request is deleted once it has been added to your organisation's totals. We keep the totals for as long as we run the service. They refer to your organisation, keys and user account by random ids, not by your name or email address.
• Email addresses that bounce, or whose owners report our email as spam: Amazon keeps them on a list of addresses we do not email, until we remove them.
• Messages you send us: for as long as we need them to deal with what you asked and to run the alpha, or until you close your account, for messages from the feedback form.
• Backups: we keep backups of the database so that we can recover from mistakes and outages. Our encrypted nightly copies are deleted after 30 days, and PlanetScale deletes its own backups on the schedule set in our account, but the weekly copies in Amazon S3 have no end date yet. Until a backup is deleted, it can still hold information that has been deleted from the live service.

Your choices

You can ask us what personal information we hold about you, ask us to correct it, or ask us to close your account, by writing to ops@opendatarouter.com. During the alpha we handle these requests by email. You can stop using the alpha at any time.

Changes to this notice

We will replace this notice before the pilot. Some pages of this website and our emails already call the service a pilot; until we publish the pilot revision, this alpha notice is the one that applies. If we change how we handle your information before then, we will email you before the change takes effect.

Contact

Questions, requests or complaints about privacy: ops@opendatarouter.com.