Version 2 · 16 October 2026
Privacy notice
This notice covers this website, its "Get involved" form and its accounts. Polycentria runs all three.
What the site keeps in your browser
The site sets no cookies unless you sign in. Signing in sets one cookie, which keeps you signed in. It expires 7 days after you last use the site, or when you sign out.
It keeps your display settings in your browser's local storage: theme, contrast, motion, text size and whether the "On this page" panel shows. It also keeps a note that you've seen the storage notice. These stay on your device. "Clear my settings", in the Storage and cookies box, removes them.
If you choose Google sign-in partway through the form, the page keeps your unsent answers in this tab's session storage while you're at Google, and deletes them when you come back.
Page views
Vercel hosts this site. Like any web host, it receives your IP address when your browser asks for a page. We count page views with Vercel Web Analytics, which doesn't use cookies. For each view, Vercel records the page, the site you came from, your browser, operating system and device type, and your approximate location (country, region and city). Vercel says it discards visitor session data after 24 hours.
The Get involved form
Nothing you type leaves the page until you submit, and the form only sends once collection is open. When you submit, your answers go to Polycentria's database, which Neon hosts. Vercel runs the code that receives them. Only Polycentria reads them. We use them for the purpose you chose, as the form's consent step describes, and we keep a copy of that consent text with your answers. We keep them for 12 months, then delete them. If you become a collaborator, guest or partner, your agreement sets how long we keep them.
Accounts
An account is optional. You can create one with your email address and a password, or sign in with Google.
With a password, we keep your name, your email address and your password in a form that can't be turned back into the password. Before accepting a new password, our server checks it against Have I Been Pwned's list of leaked passwords. It sends only the first five characters of a one-way hash of the password, never the password.
With Google, Google tells us your name, your email address, whether Google has verified it, and an ID for your Google account. We don't receive your Google password, and we don't keep your profile picture or the sign-in tokens Google sends.
While you're signed in, we keep a session record so the site knows it's you. We don't store your IP address or browser details with it.
Your account stays until you delete it. Deleting it, under Account, also deletes everything you sent while signed in.
Limits on repeated requests
To stop abuse, the server counts recent requests from each IP address. It stores only a keyed one-way hash of the address, never the address itself, and deletes the counts after a day.
Seeing or deleting what you sent
If you sent it while signed in, open Account at the top of the page. Otherwise, or for anything else, email tiffany@polycentria.com. Questions about this notice go to the same address.
Who else handles your data
Vercel hosts the site and runs its server code. Neon hosts the database. Google handles sign-in only if you choose "Continue with Google". Have I Been Pwned receives the hash prefix described above when you set a password.
Other sites
Links to other sites, such as LinkedIn, take you to services with their own privacy terms.
Changes
If this notice changes, the version and date at the top change with it.