Data collected
Everything held about an account, and why.
| What | Why |
|---|---|
| Google account email | Allow-list check to grant or deny access |
| Google display name | Shown in the account section |
| Email address (email sign-in) | Sending you a one-time sign-in link, and the allow-list check |
Session cookie (doulos_sess) | Keeps you signed in |
| What you create: highlights, notes, annotation sets, documents, appearance settings | Saved to your account so your own work persists and follows you across devices |
| Files: your folders, where each file sits, your stars, your trash, when you last opened a file, the passages each file touches, and earlier versions of your documents | So Files can list, find and restore your work. Only you can see any of it. A document keeps its 3 newest versions and the last one of each of the past 7 days; the rest are deleted as you save. The trash keeps a file until you delete it for good |
| Your setup choices: which original-language tools you switched on, and what you said you would use the app for | So the app shows only the tools you chose. Your answers about use only shape what the setup suggests; nothing else reads them |
| A document you choose to publish: a frozen copy of it, and whether it is private or public | Serving it at its own link. Nothing is published unless you press publish, and unpublishing deletes the copy |
| An annotation set you choose to make public, and the name you publish it under | Serving its notes at their own link, to anyone holding it, and letting signed-in readers quote them into their own documents. Nothing is public unless you make it so; withdrawing takes the link down at once |
| The email addresses you share a private page with | So those people, signed in, can open that page and comment on it. Nothing is sent to them, and an address is deleted when you remove it or unpublish the page |
| A comment you post on a published page, and the name you choose to be shown by | Showing it with that page, to everyone who can open it — on a public page, anyone holding the link. Never your email address or your Google name |
| Which comments on a published page you have read | So the page can show what is new to you. Recorded when you open a thread or it is on screen; seen by nobody else, the page’s author included |
| When you were last active (one timestamp) | So the site owner can see whether an account granted access is actually being used |
| While you are signing in: a one-way hash of the network address the attempt came from | Capping repeated sign-in attempts. Never the address itself, not linked to your account, and gone within the hour |
| When a page fails in your browser: the error, the script it came from, the address of the page without its query string, and a one-way hash of your email | So a failure in your browser is visible to us at all instead of vanishing with the tab. It goes to the server log, not to your account, and only when something has broken |
The work you create — the passages and words you mark, your notes, your documents, and your appearance settings — is stored server-side against your account so it persists across reloads and devices.
Publishing a document is one of the three things here that can be seen by anyone else, and only if you ask for it. When you publish, a copy of that document as it stands is stored and served at an unguessable link. A private page opens only for you and for the people you add by email address, each of them signed in. A public page opens for anyone holding the link — it is unlisted, it is not indexed by search engines, and it is linked from nowhere on this site, but a link you share can be shared onward by whoever you give it to. Unpublishing deletes the stored copy and the link stops working for good; publishing again creates a new link.
Making an annotation set public is another, and only if you ask for it. The notes in that set — and only those — are served at an unguessable link, unlisted and not indexed, under the name you type when you make it public (never your email address or your Google name). Signed-in readers can quote a note from it into their own documents, where the quote stays as it was when they took it, credited to that name and dated, even if you later change or withdraw the set. Withdrawing takes the link down at once. The site owner can also withdraw a public set; you are told when that happens, and why.
Commenting on a published page is the third. Signed in, you can comment on any published page you can open. A comment is stored with the name you chose to comment under — asked for the first time you comment, changeable at any time, and never your email address or the name on your Google account — and both are shown to everyone who can open that page: on a public page, anyone holding the link. Signed in, the page also remembers which comments you have read, so it can show you what is new; that record is yours alone. You can edit or delete your own comments; the page’s author can resolve or delete any comment on their page. Unpublishing a page deletes every comment on it.
A note carries more than its text: the name you give it, the kind of note you say it is, the tags you put on it, the apparatus line you write against it, and any web links you attach — plus the annotation sets you group notes into, each with the name, the edition and book it is about, and the viewpoint you state for it. That is all your own writing, held the same way and under the same promises as the note itself, and it goes when your account does.
Files you attach to a note are held the same way. An image, a PDF, a document, a spreadsheet, a video — whatever you attach is stored against your account, in the same database as the rest of your work, which means it is in the same nightly backup and it is deleted with your account. Nobody but you can fetch it: every request for one is checked against your account by the database itself, not merely by the application. We do not open your files, index their contents, or send them anywhere; the only thing the server reads is the first few thousand bytes, to work out what kind of file it is so your browser is told the truth about it. There is a limit — 50 MB for one file and 500 MB in total — and the page shows you how much of it you have used.
Files. Everything you make is listed in one place, and to do that we keep, against your account: the folders you make and which file sits in which, the files you star, the files you put in the trash and when, when you last opened each file, an index of the Bible passages each file touches — worked out from the passages in it, so that you can find a file by a verse — and which of your documents quote notes from your own annotation sets. Version history: while you work on a document a copy of it is kept at most once every ten minutes; we keep the three newest and the last copy of each of the past seven days, and delete the others as you save. Restoring an old version keeps the one it replaced, so a restore can be undone. Nobody but you can see any of this — the database itself checks every request against your account. A file stays in the trash until you delete it for good, which deletes its versions too; all of it goes with your account.
Separately, the time you were last active is recorded against your account: a single timestamp, overwritten each time, accurate to a couple of minutes. It exists so the owner of a private, invitation-only site can tell an account that is in use from one that has never been used. It is not a history, and it records only when — never what. Beyond your own saved work, what you read, search for, or look up is not stored server-side.
Kept in your browser
Every key and cache this site keeps on your device.
Some things are kept in your browser’s own storage rather than, or as well as, on our server — so a page opens quickly, works offline, and remembers how you like it. They never leave your device except as part of the requests you make. Two different stores are involved: named slots your browser keeps for this site, and the offline cache, which holds whole replies from our server rather than keys. All of them:
| Key or cache | What it holds | When a different account signs in here |
|---|---|---|
ov_workspace_v1 | Your open tabs and panels — including the notes and highlight colours on them | Removed |
ov_lastpassage_v1 | The passage you were last reading | Removed |
ov_recents_v1 | Passages you opened recently | Removed |
ov_studies_v1, ov_studies_lib_v1, ov_study_… | A copy of your projects, so they open at once and offline | Removed |
doulos:v1:… | Corpus answers you looked up, kept for 30 minutes so a page opens faster | Removed |
ov_account_v1 | A one-way tag of the account that last used this browser — not your address | Replaced |
ov_appearance_v1, ov_display_v1 | Appearance: theme, type size, colours (the second is an older form, read once) | Kept — a device setting |
ov_locale_v1 | The language of the interface | Kept |
ov_tools_v1 | Which original-language tools you switched on | Kept |
ov_signup_pending_v1 | While you sign in: the highlight you chose before you had an account — a verse reference and a colour — so it can be kept once you are in. Used once, then deleted; ignored after an hour | Kept until used (an hour at most) |
ov_translations_v2, ov_translations_v1 | Which translations you show (the second is an older form, removed once read) | Kept |
ov_apparatus_prefs_v1, ov_interlinear_v1, ov_lex_prefs_v1, doulos:lex-refs | Settings for the apparatus, the interlinear, and the lexicon | Kept |
ov_modern_english_v1 | Whether older English translations are shown in modern English or as printed | Kept |
ov_align_hint_v1, ovd.coachmark.… | Which tips you have already seen | Kept |
doulos:lastChunkReload | Tab only: when the page last reloaded itself after an update, so it cannot loop | Gone when the tab closes |
ov_refvariant_v1 | A retired setting, removed when found | — |
doulos-v3 | The offline cache. Two different things share it: the app itself (the page and its code, the same bytes for every reader) and the corpus answers it fetched for you — which passages, which witnesses, which lexicon and apparatus entries, kept as the whole reply, not just a note that you asked. We set no size limit on it; your browser empties it when it wants the space | The corpus answers removed; the app itself kept |
doulos-catalog-v1 | One entry: the catalogue of witnesses and what each may be used for. The same list for every reader, refreshed on a timer rather than by anything you did | Kept — it records nothing about you |
On a shared browser. Signing out does not empty this storage — a document edit reaches our server a moment after you make it, and offline the copy here is the only one, so clearing it at sign-out could lose work. Instead, the page records a one-way tag of the account it was opened for (not your address), and when a different account signs in, your work and reading trail above are removed before anything reads them. Your settings stay: they belong to the device. If you share a browser and were offline, edits that had not yet reached us are removed along with the rest when someone else signs in.
The offline cache is emptied of your reading too. Until 2026-09-22 it was not: signing a different account in cleared the named slots above and left the cached replies — the passages and entries themselves — where they were. A different account signing in now removes every cached reply from our server, and keeps the copy of the app, which is the same for everyone and is what lets the site open with no connection.
Written to the server’s log
Every field the server writes to its log.
Requests and failures are written to the host’s journal — plain lines on disk, rotated by the host, not a database and not part of your account. This is every field that appears in them. Nothing else about you is written there.
| Field | What it holds |
|---|---|
reqId | A random id for one request, handed back to you in the X-Request-Id header. Not derived from you and not stored against your account — it exists so the lines about one request can be read together |
method, path, status, ms, aborted | The request line: what you asked for, how the server answered, how many milliseconds it took, and — only when it happened — that the request was cut off before it finished. A failure line elsewhere reuses status for the answer an outside service gave us, and path for the location of a file on our own disk |
query | Only on a request that took longer than a second: its query string — the parameters of what you asked for, such as a book, chapter or word — so a slow page can be diagnosed at all. Values for parameters whose names look like credentials are replaced with [redacted] first |
source, url | When a page fails in your browser, your browser sends us the failure: the error text (up to 500 characters), the script it came from, and the address of the page you were on with its query string removed. Nothing is sent unless something broke, and at most ten per page |
user, email | A truncated one-way SHA-256 hash of an email address — the first 8 hex characters, never the address and not reversible: on a browser-failure line, whose session it was, and on a change to the allow-list the owner keeps, which address was added or removed |
witness, corpus | Which manuscript or corpus a lookup was for, on the lines that record one failing. The same thing the access line above already says, written where the failure is |
id, sent, held, slug | The id of one of your own projects and two revision numbers, when a save is refused because the server already holds a newer copy; and the link name of a project you published, when its stored copy cannot be rendered. Never the project’s contents |
book, chapter, verse, lemma, prep, gcase, verb, total, phases, bytes | Only when one request took long enough to be worth diagnosing: which passage or which word was asked for, how long each internal stage took, and how many bytes the answer came to. A route with several internal paths cannot say which one was slow without naming what it was looking up. This is the same thing the query line above already records for slow requests, written where the timing is — and like that line it is about the request, never about who made it |
Beside these, a line carries the text of whatever failed — an error message, the reply an outside service gave us, the name of a model file — and the name of the rate limiter that was counting. Those describe the software, not you.
Retention
How long each thing is kept.
- If you stop using it, your account is deleted after 180 days with no signed-in request, and everything stored against it goes with it. Nothing is kept just in case. The clock runs from your last authenticated request, not your last sign-in, so simply reading with a live session keeps it current. Your address stays on the invitation list so you can come back — ask if you would rather it went too.
- Session cookie expires on sign-out or after 30 days of inactivity.
- Email sign-in links are single-use and expire after 15 minutes. Only a hash of the token is held in server memory — never written to the database — so the link exists in your inbox and nowhere else.
- Server logs go to the host journal, not a database. Every field in them is listed under “Written to the server’s log” above, rather than described here — a sentence that names some of a set reads as if it named all of it, and this one did for as long as the browser-failure line went unmentioned. Sign-in lines carry a truncated SHA-256 hash of your email, not reversible and never the address. Paths and parameters reveal what you fetched in transit but are not retained per account.
- The last-active timestamp is overwritten, not appended: only the most recent value exists, so there is no record of previous visits to retain or to request.
- Earlier versions of a document: the three newest and the last of each of the past seven days; older ones are deleted when you next save. A file in the trash stays until you delete it for good.
- The sign-in attempt counter holds a truncated SHA-256 of the network address an attempt came from — never the address itself — with a count and the time the current 15-minute window opened. It caps sign-in attempts, is not linked to any account, and is deleted once the window has passed. It is the one thing here kept about a request rather than about an account.
Third-party sharing
Who else handles your data.
Your data is not sold or rented. It is shared with a third party only where a service you asked for cannot work otherwise: Google as an identity provider when you sign in with Google, and Resend to deliver the message when you ask for an email sign-in link. If you always sign in with Google, your address is never sent to Resend.
Deletion
How to have your account deleted, and what goes with it.
Access is by personal invitation while this is a private beta, so you already have a direct line: reply to the invitation you were sent and ask for your account to be removed. Everything held against it — highlights, notes, documents, your files, folders and their versions, the pages you published and the addresses you shared them with, the comments you posted and the name you post them under, appearance and the last-active timestamp — goes with it. The database enforces that rather than leaving it to be remembered: every table holding your data is tied to the account row by a foreign key that deletes with it. The sign-in attempt counter is the one table not tied to an account — it holds nothing that could be linked back to you, and it expires on its own.