centram.org
What this site knows about you.
The lists of what is collected and what is not were written by reading this site’s code, and the fields that cannot be settled yet are left visibly blank rather than filled with something plausible.
This draft was written by reading what this site’s code actually does. It needs review by a lawyer before publication. The fields marked TO FILL cannot be completed until the operating entity is settled, and this document must not be published while they are blank.
01What this document covers
This document describes visiting the website centram.org and
submitting its forms. That is its whole subject.
It does not describe the node software you run on your own machine. That is a different system, run by you rather than by anyone here, and it has its own policy on the documentation page. What the node collects, and what it has stopped collecting, is recorded there and in the project’s commit history — not here.
02Who operates this site
This site is operated by TO FILL: legal entity or individual name, located at TO FILL: address. The person responsible for personal data is TO FILL.
The formal operating entity is not yet established. These fields are deliberately left blank until it is.
03What is collected
Checked against the code, 2026-09-01.
| Data | When | Purpose | Stored where |
|---|---|---|---|
| Email address | When you sign up for updates | Sending updates | The operator’s database |
| Application form contents (name, email, location, affiliation, areas of interest, free text) |
The form is closed; nothing new is collected. Records submitted before it closed still exist. | Reviewing and replying to the application | The operator’s database |
| IP address | On form submission and on admin login attempts | Rate limiting only | Not written to the database; held in memory during the request only |
| Server logs (path, time, IP address) |
Every request | Diagnosing faults and abuse | The hosting provider’s infrastructure |
04What is not collected
Each line below was checked against the code before being stated.
- There is no analytics of any kind. No Google Analytics, no tracking pixels, no heatmaps, no A/B testing service.
-
This site loads nothing from anyone else’s server.
No web fonts, no CDN scripts, no remote stylesheets, no remote images.
Every file a page needs comes from
centram.orgitself, so opening a page here does not disclose your address to anyone but the hosting provider. An earlier version of this policy listed Google Fonts as a recipient; section 10 says what changed. - No advertising, no advertising trackers, and nothing collected here is sold.
- No cookie is set for ordinary visitors (see section 06).
- There is no visitor account system, so no visitor password is ever held.
05Who else sees it
| Recipient | What they receive | Why |
|---|---|---|
| Resend | Recipient address and message body | Delivering email |
| Hosting provider | Every request, and the database contents | Running the site |
Those two are the entire list. Nothing else is disclosed to anyone, except where disclosure is required by law.
06Cookies and browser storage
No cookie is set for ordinary visitors. Cookies are used only when the operator signs in to the admin panel.
Some values are kept in your browser’s localStorage.
They never leave your browser: they are not transmitted
to the server and the operator cannot see them.
-
centram-policy-consent— which version of this policy you accepted. Written when you accept it. -
centram-theme— a leftover from when the site had a light and a dark appearance. It has one appearance now and no switch, and no page writes or reads this key any more. -
centram-lang— a leftover from when the site was bilingual. No page writes or reads it any more either.
Clearing your browser’s site data removes all three.
07How long it is kept
- Newsletter address — until you unsubscribe. Deleted promptly on request.
- Application records — applications that do not go forward are deleted within
12 months. - Server logs — kept for whatever period the hosting provider retains them. The operator does not extend that.
08Your rights
Write to the address in section 11 and you can:
- see what is held about you;
- have mistakes corrected;
- have it deleted;
- have its use stopped;
- receive a copy in a machine-readable form.
After verifying your identity, a reply is sent within TO FILL: response deadline.
09Security
Traffic is protected with TLS. The admin panel requires a password, a
passphrase and a time-based one-time code; passwords are stored only as
scrypt-derived values. Creating the admin account requires a
bootstrap token supplied as an environment variable.
No one can guarantee complete security. This is a pre-release research project and it has not had an external security audit.
Report a vulnerability to TO FILL: security contact.
10Changes
When this document changes, the version at the top is updated and the consent screen is shown again on your next visit. What you agreed to is never silently replaced with something else.
Changed in version 2026-09-01: Google Fonts was removed from the list of recipients in section 05, because the two pages that loaded a font from it were withdrawn and no page loads one now. The browser-storage list in section 06 was corrected: the theme and language entries are described as dead leftovers rather than working preferences, because the site no longer has a theme switch or a second language and no page reads or writes either key.
11Contact
Questions about personal data go to TO FILL: privacy contact address.
Governing law and jurisdiction: TO FILL.
Related, and a different subject: the privacy policy for the node software.