Data collected

What	Why
Google account email	Allow-list check to grant or deny access
Google display name	Shown in the account section
Email address (email sign-in)	Sending you a one-time sign-in link, and the allow-list check
Session cookie (doulos_sess)	Keeps you signed in
What you create: highlights, notes, studies, appearance settings	Saved to your account so your own work persists and follows you across devices
A study you choose to publish: a frozen copy of that document, and whether it is private or public	Serving it at its own link. Nothing is published unless you press publish, and unpublishing deletes the copy
When you were last active (one timestamp)	So the site owner can see whether an account granted access is actually being used
While you are signing in: a one-way hash of the network address the attempt came from	Capping repeated sign-in attempts. Never the address itself, not linked to your account, and gone within the hour

The work you create — the passages and words you mark, your notes, your studies, and your appearance settings — is stored server-side against your account so it persists across reloads and devices.

Publishing a study is the one thing here that can be seen by anyone else, and only if you ask for it. When you publish, a copy of that document as it stands is stored and served at an unguessable link. A private page opens only for you, signed in. A public page opens for anyone holding the link — it is unlisted, it is not indexed by search engines, and it is linked from nowhere on this site, but a link you share can be shared onward by whoever you give it to. Unpublishing deletes the stored copy and the link stops working for good; publishing again creates a new link.

Separately, the time you were last active is recorded against your account: a single timestamp, overwritten each time, accurate to a couple of minutes. It exists so the owner of a private, invitation-only site can tell an account that is in use from one that has never been used. It is not a history, and it records only when — never what. Beyond your own saved work, what you read, search for, or look up is not stored server-side.

Retention

• If you stop using it, your account is deleted after 180 days with no signed-in request, and everything stored against it goes with it. Nothing is kept just in case. The clock runs from your last authenticated request, not your last sign-in, so simply reading with a live session keeps it current. Your address stays on the invitation list so you can come back — ask if you would rather it went too.
• Session cookie expires on sign-out or after 30 days of inactivity.
• Email sign-in links are single-use and expire after 15 minutes. Only a hash of the token is held in server memory — never written to the database — so the link exists in your inbox and nowhere else.
• Server logs (to the host journal, not a database) record a truncated SHA-256 hash of your email on login — not reversible — plus a per-request access line: a random request id (returned as X-Request-Id, not tied to your identity), method, path, status and timing. A request that takes longer than a second also records its query string — the parameters of what you asked for, such as a book, chapter or word — so a slow page can be diagnosed at all; values for parameters whose names look like credentials (tokens, codes, e-mail, session or API keys) are replaced with [redacted] before the line is written. Paths and parameters reveal what you fetched in transit but are not retained per account.
• The last-active timestamp is overwritten, not appended: only the most recent value exists, so there is no record of previous visits to retain or to request.
• The sign-in attempt counter holds a truncated SHA-256 of the network address an attempt came from — never the address itself — with a count and the time the current 15-minute window opened. It caps sign-in attempts, is not linked to any account, and is deleted once the window has passed. It is the one thing here kept about a request rather than about an account.

Third-party sharing

Your data is not sold or rented. It is shared with a third party only where a service you asked for cannot work otherwise: Google as an identity provider when you sign in with Google, and Resend to deliver the message when you ask for an email sign-in link. If you always sign in with Google, your address is never sent to Resend.

Deletion

Access is by personal invitation while this is a private beta, so you already have a direct line: reply to the invitation you were sent and ask for your account to be removed. Everything held against it — highlights, notes, studies, appearance and the last-active timestamp — goes with it. The database enforces that rather than leaving it to be remembered: every table holding your data is tied to the account row by a foreign key that deletes with it. The sign-in attempt counter is the one table not tied to an account — it holds nothing that could be linked back to you, and it expires on its own.

← Back