Account Deletion and Data Export Policy ======================================= Tillyard. Version 1.2. In effect from October 21, 2026. Fingerprint of this text (SHA-256): 08341f62ff8575d574064e683e2370680bc04a73680ded3e72efa0782bbad3e9 This version: https://tillyard.org/policies/account-deletion-and-data-export-policy/v/1.2 - You can take a copy of what your account holds about you, as one file that your browser puts together. Some things are left out, such as notes other people wrote to you and who reported you. Section 3.6 lists them. Nothing is emailed, and no copy is kept on our servers. - You can close your account yourself at any time, from Account, "Leave". We do not ask why, and it costs nothing. - Closing starts a 14-day closing period. You are hidden at once and nothing new can reach you. Nothing is erased until the 14 days are over, and until then you can change your mind by signing in. - After that the erasure runs, and it usually finishes in a day or less. Your name, email address, college, profile, settings, sign-in details, connections, drafts, shop history and the text of the notes you wrote are erased. - Some things are left as a blank so that other people's records still make sense: your seat in a conversation reads "a former member", a paper you wrote alone becomes a withdrawn page with no byline and no text, and your Record links read "no longer listed" with no name. - A few things are kept, each for a stated reason: case files that involve you, the dated record of what you agreed to, and a keyed hash of your email address, so that leaving and coming back does not undo a block or a removal, each for a stated period; and the staff action log, which holds identifiers only and is kept for as long as Tillyard operates. - A closing hold can stop the erasure from starting while an urgent report, a child-safety or age matter, or a legal matter involving the account is open. The same things can make an export wait. - Backups keep older copies for a limited time, and we cannot reach copies that other people or other websites made. - Erasure cannot be undone. Download your data first if you want it. If this summary and the full text below ever differ, the full text governs. 1. What this document covers ============================ 1.1 What this document covers, and who is speaking -------------------------------------------------- Tillyard is an Ohio nonprofit corporation. "We" and "us" mean Tillyard. This document covers: - how to take a copy of your data, and what is and is not in it (section 3); - how to delete single things without closing your account (section 4); - how to close your account, and everything that follows: the closing period, holds, the erasure itself, what is erased, what is left as a blank, what is kept and for how long (sections 5 to 11); - what happens to particular things: papers, shared projects, confirmations and messages already sent (section 12); - coming back, accounts that we close, and requests from people who cannot use the tools or who are not members (sections 14 to 17). 1.2 How this fits with other documents -------------------------------------- - The Privacy Notice says what we hold and summarizes your choices (its sections 16 and 17). On the steps of exporting and closing, this document is the more specific one and governs. Section 37.5 of the Terms of Use sets the order among all our documents, including the sections of those terms that prevail over every other document. - The Data Retention Schedule lists every kind of record with its period. On how long something is kept, the Data Retention Schedule governs. Periods are repeated here so that you do not have to look them up. - The Terms of Use (section 34) say what ending the agreement means, and (section 7.4) when the licence you gave us ends. - The Author Agreement and Licence and the Editorial Policy of Tillyard Research govern a published paper. The Projects and Collaboration Terms govern a shared project. The Record and Verification Policy governs what a Record page says. - The Reporting, Enforcement and Appeals Policy governs suspension and removal. - The Cookie and Storage Statement covers what is kept in your own browser. 1.3 Words used here ------------------- Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word. - Your account is your membership and everything stored against it on our servers. - An export is a copy of the information tied to your account, as a file. - To close an account is to ask for it to be erased. The closing period is the 14 days between asking and erasure. - To erase something is to delete it from the live database so that it cannot be shown or read. - Something left as a blank stays in place with your identity removed, for example a seat that reads "a former member". - A tombstone is a public page that stays at its address after the thing it showed has gone. It says only that something was once listed there. It carries no name. - A keyed hash is a scrambled form of a value, made with a secret key, that lets us tell whether two values are the same without storing the value. - A closing hold stops an erasure from starting, or keeps particular records beyond their normal time, for one of the reasons in section 6. It is not the hold in Definitions, which hides an item, and it is not the same thing as a legal hold, which is one of the reasons a closing hold can apply. - The staff action log is our append-only record of what staff and standing rules did. It holds identifiers and reason keys, never names, email addresses or member text, and it cannot be edited or pruned. - Standing means whether an account was in good order when it closed: clear, noted (other members had blocked it or a report about it was open), or removed by staff. 2. Before you close: other things you can do ============================================ Closing is permanent. If what you want is narrower, one of these may be enough, and each takes effect at once. Before you close: other things you can do. Columns: if you want, you can. If you want | You can --------------------- Nothing about you to be public | Account, "Privacy", "Switch off everything public". This takes down your public page, your directory listing and search-engine indexing in one step. Members-only settings are not touched One Record item to stop being shared | Set it to "Only me", or put it away. Its link then reads "no longer listed" A paper to come down | Ask for it to be withdrawn, under the Author Agreement and Licence A note you sent to be gone | Take it back. It disappears for everyone in the conversation A person to stop reaching you | Block them. They are not told Email to stop | Unsubscribe from optional email. The Email and Communications Policy explains which email cannot be stopped while you have an account A permission to end | Account, "History", lists every permission you gave, with a "Withdraw" button beside each one that can be withdrawn A copy of your work, without leaving | Start an export (section 3) Your Record links to keep working after you graduate | Keep the account. Losing your college address does not close it. If the yearly check of that address lapses, parts of the site pause, and your Record, your tools and your data stay as they are (section 15.3) To leave, and have a paper stay published | That is not possible at present. A paper you wrote alone stays published only while its author has an account (section 12.1). You can keep the account, switch off everything else and stop optional email None of these affects your standing. 3. Taking a copy of your data ============================= 3.1 What an export is --------------------- An export is a copy of everything tied to your account, in one file. Each part of the site hands over its own share, and your browser puts the shares together. The file is made on your device. We do not email it and we do not keep a copy. 3.2 How to start one -------------------- 1. Go to Account, "Your data", and choose "Start an export". 2. Confirm that it is you. If you signed in more than a few minutes ago, you are asked to sign in again, normally with your passkey. 3. A page we call the slip lists one part for each area of the site. 4. Choose "Save as one file". Your browser fetches each part in turn and saves a single file. Progress is shown and announced as it goes. If scripts are switched off in your browser, each part on the slip is an ordinary download link, and you can save them one by one. 3.3 What to expect ------------------ - The export stays open for 30 minutes. After that the slip closes. If you did not finish, start another. - If one part fails, the slip says which, and offers "Try that part again". - Nothing is emailed. The file never travels by email. A short email may be sent to say that an export was asked for, so that you would know if it was not you. That email contains none of your data. - No copy stays with us. We keep a line in a log saying that an export was started, when, and how many parts it had. The Data Retention Schedule gives the period for that line. 3.4 The file ------------ - The file is named tillyard-export.json. - It is in JSON, an open text format that any text editor can open and that other software can read. It is complete, and it is not pretty. A version laid out for reading is not offered at present. - At the top it states its format, a format version, when it was made and whose it is. Then come the parts, one for each area of the site. - It ends with an inventory: for every kind of record, what it is for and how long it is kept. The copy explains itself. 3.5 What is in it ----------------- The export is arranged by area of the site. Each heading below is one area, and the list under it is what the export includes for that area. Account ------- - Your name, college email address and college. - When you joined. - When your college address was last checked. - The time the 18+ check was done (never a date of birth, which is not stored). - The account's status. - Your settings and interests. - Every permission you gave, with the version of the wording and the times. - The members you blocked or muted, with dates. - Your connections, with the reason and date. - Your notices from the last 90 days. - Your signed-in devices and passkeys by label and date, with no key material. - Your name and address changes. - Your earlier exports. - Any request to close. Agreements ---------- - Each document you agreed to or were shown: its title, version, date, address and the fingerprint of the exact text. The Record ---------- - Your items. - Your titles. - Your perks. - Each page's link and code. - Self-reported items. - Linked skills. - Daily counts of how often each page was opened, with nothing about who opened it. - Your public-page and directory settings. Tillyard Research ---------------- - Your submissions with their text, the versions that were kept, sources, typing and pasting counts with active time and the number of saves made without scripts, declarations, decisions and letters. - Your answers to the editor and any request for a second look. - Readings you received, without the reader's identity. - Readings you wrote. - Your reading-pool entry. - Your published papers and their notices. Notes ----- - Your conversations (who or what they were with, when you joined, whether muted). - Every note you wrote that still exists. - Reactions you gave. - Nods sent and received. - Introductions. - Your private memos and reminder dates. - Your Notes settings. The Shop -------- - Your preferences. - Evenings you said you were coming. - Visits and kept receipts. - Stamps and postmarks. - Your answers to the house question. - Your favors, with the other person's public name. - Thanks you gave. - A tally of thanks you received. - Your own lines of table chat that are still inside the 14-day log. Pursuits -------- - Tracks you kept. - Entries with their text, declarations and standing. - Scores you received, without the scorer's identity, and scores you wrote. - Portfolio pieces with their text and link history. - Looks you received, without identity, and looks you wrote. - Your logs. Scheduled tables ---------------- - Tables and series you hosted. - Your seats. - Your own attendance. - Feedback you gave. - Questions you asked. - Invitation links you made and their counts. - Requests for a title and their outcomes. - A tally of feedback you received. Projects -------- - Your seats. - Plans, claims and results. - Your done lines and notes. - Milestones you made. - Cards you posted. - Words you wrote and words about you that you chose to show. - Your own confirmations of teammates. - Disputes you opened or that were about you. - The full text of projects you lead. Organizations ------------- - Entries you registered or seconded. - Your roster rows and roles, with dates, states and counts of confirmations. - Confirmations you gave. - Notices and handover notes you wrote. - Disputes you filed. Service ------- - Your service entries and the state of each confirmation. The Workbench ------------- - Every document you chose to keep a copy of in your account, with its text. - Your résumé-swap entries. - Notes written for you in a swap, as text. - Notes you wrote. Safety ------ - Reports you made, with your own words and their state. - Decisions about your account, with the guideline and the dates. - Your requests for a second look. - Your removal requests and tickets. - Any strike that is still counting, with its end date. - Your answers in an age re-check. Home, growth and support ------------------------ - How you arranged your home page. - Your founding number if you have one. - Invitation codes you made and their totals. - Any larger-tip or sponsorship inquiry sent from your account's address, without the staff note. 3.6 What is not in it, and why ------------------------------ - Notes that other people wrote to you. Those are their words. You can read them in Notes for as long as the conversation is kept. - Who read your paper, scored your entry or confirmed a line of yours in a blind step. The reading is in the file. The reader's identity is not. - Other people's confirmations about you that they did not choose to show you. - Who reported you, and what they wrote. Protecting the person who reports is what makes reporting safe. - Evidence gathered for a case, staff notes, and the reasons recorded by staff. A decision about you, and the guideline it was made under, is in the file. - Other readers' private notes to the editor. - Screening scores attached to things you wrote. - The staff action log. - Work kept only in your browser, such as Workbench documents that you never chose to copy to your account. We do not have it. Section 3.10 says how to save it. - Tips. The site stores nothing about tips or tippers. Stripe holds those records. - Email you sent to our addresses. That is in the company's mailbox, not in your account. You can ask for it at privacy@tillyard.org. - Anything already erased, or past its period in the Data Retention Schedule. If you believe we hold something about you that is not in the file, write to privacy@tillyard.org. The Privacy Notice, section 17, says how such a request is handled, including what we may decline to hand over where it would expose another person. 3.7 Limits ---------- - You can start two exports in any seven days. - There is a ceiling on how many exports can be started across the whole site in a day. - On a busy day exports may be paused so that sign-in and safety tools keep running. The page says so: "Exports are paused for today so sign-in and safety tools keep running." Try again after 00:00 UTC. - Staff can switch exports off for a short time if something is wrong with them. These limits are there because an export is one of the costliest things the site does, and because a tool that hands over everything in one step is exactly what someone who had got into your account would reach for. 3.8 Who can export, and the 24-hour wait ---------------------------------------- - Any member can export, including a member who is suspended, a member who has been removed, a member whose account is in its closing period, and a member who has not yet agreed to a new version of the terms. - If you signed in with an emailed code and no passkey, the export waits 24 hours before it opens. We tell you in the app and by email that it was asked for. This is deliberate. Whoever controls your college mailbox can receive a code, and the wait gives you time to notice and stop an export you did not ask for. 3.9 When an export can be held ------------------------------ In a small number of serious matters, an export may wait: where the account is the subject of a case about child safety or about a member who may be under 18, or where a legal hold covers the account. A member whose account is paused in such a case is among those whose export waits, even though that member has not been suspended or removed. An export also cannot be started while the whole site is in read-only mode; it can be started again when the site reopens. The reason is that the law may require us to preserve material exactly as it is and may limit what we can hand to anyone. We may be unable to say more while the matter is open. 3.10 Work kept only in your browser ----------------------------------- The Workbench keeps your résumé documents in your own browser unless you choose to copy them to your account. Those documents are not on our servers and so are not in an export. - To save them, use The Workbench's own backup, which writes one file from that browser. - To remove them, use "Clear Workbench data from this browser" under Account, "Your data". Closing your account does not reach into your browser, so the closing page offers the same button. 3.11 Looking after the file --------------------------- The export contains your notes, your drafts and your settings. Treat it as you would any private document. Do not leave it in the downloads folder of a shared computer, and think before you send it to anyone. 3.12 If you cannot use the export tool -------------------------------------- Write to support@tillyard.org from the address on your account. Once we have confirmed that it is you (section 16.2), the owner can prepare the same parts from the staff console. That step is recorded in the staff action log with the reason. We then agree with you how to get the file to you. 3.13 What an export cannot do ----------------------------- - An export cannot be loaded back in. There is no way to restore an account, or to create one, from an export file. - We do not send your data straight to another service. You have the file, and you can take it anywhere. - An export is your own copy. It is not a page of The Record, and nobody should treat a file as proof of anything listed on The Record. The public page at its own address is what a reader can check. 4. Deleting single things ========================= You do not have to close your account to delete something. You can delete these yourself, at any time: - a note you sent. Taking it back removes it for everyone in the conversation; - a draft paper, with its saved versions; - a self-reported item on your Record; - an answer to the house question; - a receipt you kept; - copies of Workbench documents in your account, and everything The Workbench keeps in your browser; - your interests and profile text. Two things to know: - When you take back a note, we keep a private copy for 14 days in case the note is reported, and then erase it. - If something of yours has been reported, a copy made for the case stays with the case, even if you delete the original. Some things you cannot delete yourself because other people rely on them, such as a reading you wrote of someone else's paper, or a published paper with co-authors. Section 12 covers those. 5. Closing your account ======================= 5.1 Who can close, and when --------------------------- Any member can close their account at any time. That includes a member who is suspended or removed, and a member who has not agreed to a new version of the terms. We do not ask for a reason. Closing costs nothing, and asking to close is never held against you. 5.2 How ------- 1. Go to Account, "Leave". 2. The page shows a letter listing what is erased, what is left as a blank, and what is kept and why. It is a short form of sections 8 to 10 below. 3. Tick the one box, which reads "I understand that after [the date] this can't be undone." 4. Press "Close my account". If you signed in more than a few minutes ago, you are asked to confirm that it is you. There is a link on that page to download your data first. 5.3 What happens at once ------------------------ - You are hidden. Your public page and your directory listing disappear. Every Record link of yours reads "no longer listed". Other members no longer see you in The Shop, in the directory or in lists of people. - Nothing new can reach you. Nobody can nod to you or write to you. - You are signed out on every other device, and any live connection you had open is closed. - We tell you. A notice appears in the app, and an email goes to your college address saying that the account is set to close and on what date. If it was not you, that email is your warning. 5.4 The 14-day closing period ----------------------------- For 14 days, nothing is erased. - What you see. If you sign in, you see one page: "Your account closes on" the date, with two buttons, "Keep my account" and "Download my data". The rest of the site is closed to you. - What others see. You are hidden, as in 5.3. Conversations you were in are still there for the other people. - Everything stays reportable. If someone needs to report something you wrote, they still can, and a report takes its copy of the evidence at once. - Cases continue. A report, a dispute or a request for a second look that involves you can still be finished. - Email. Optional email stops. You may still receive essential email, such as the message saying that the account is set to close. 5.5 Changing your mind ---------------------- Sign in at any time before the closing date and press "Keep my account". Your account goes back to exactly how it was: the same status, the same Record, the same connections and settings. Things that were public before are public again only if their own switches still say so. You can start closing an account twice in any 30 days. 5.6 Why there is a wait ----------------------- - To protect you. Someone with a few minutes at your laptop could press "Close my account". The wait, the email and the "Keep my account" button mean that a closure you did not intend can be undone. - To protect other people. Without a wait, a person could send something abusive and then erase the evidence. For 14 days nothing is erased and everything can still be reported. - To let you be sure. After erasure there is no way back. 5.7 If you need it done sooner ------------------------------ If waiting 14 days would put you at risk, write to support@tillyard.org from the address on your account and say so. The owner can start an erasure without the closing period. That is decided case by case, it is recorded in the staff action log, and it cannot be done while a hold applies (section 6). 6. When closing is put on hold ============================== 6.1 Why a closing hold can apply -------------------------------- When the 14 days are over, the erasure starts unless a closing hold applies. A closing hold can apply when: - an urgent report involving the account is still open, including a child-safety matter or a question about a member's age. This one is applied by the system and is then looked at by staff; - a legal reason requires records to be kept: a subpoena, warrant, court order or lawful preservation request that covers the account; a legal claim that has been made or is reasonably expected; or a law that requires preservation, as federal law does after a report to the National Center for Missing and Exploited Children; - the owner has placed a hold for another stated reason, recorded in the staff action log. 6.2 What a closing hold does, and does not do --------------------------------------------- - You stay hidden for as long as the closing hold lasts. A closing hold never makes you visible again. - The closing page says: "Closing is on hold while a report involving this account is looked at. You stay hidden meanwhile." - A closing hold has no fixed length, so we give no date. Open closing holds are meant to be looked at again at regular intervals so that none is forgotten. - A closing hold covers the records it names and no others, and it gives nobody new access to them. - When the reason for the closing hold ends, the erasure starts without your having to ask again. - We may be unable to say more about the reason where a court order or an investigation forbids it. The Data Retention Schedule, section 17, is the governing statement on legal holds. 7. The erasure ============== 7.1 When it starts ------------------ The erasure starts after the 14-day closing period, or when a hold is released, whichever is later. 7.2 How it runs --------------- - It runs in steps. Each area of the site erases its own share in turn: The Record, Tillyard Research, Notes, The Shop, and so on. Then the account's own settings go, your titles are retired and your perks deleted. Last, your name, email address and college are blanked, and your sign-in details, sessions, notices, connections and interests are deleted. - It usually finishes in a day or less. A large account, or a day on which the site is near its limits, can take longer. The run stops when the day's allowance for database work is short and picks up where it left off. - If a step fails, it is tried again. If it keeps failing, the president is alerted, and the alert carries a reference and no personal information. - When the run finishes nothing further is sent. The closing email you received at the start is the last one. 7.3 What remains of the account itself -------------------------------------- A blank row with an internal identifier stays in the database. It has no name, no email address and no college. It is there so that other people's records, such as a conversation you were in or a reading you wrote, still have something to point to. Nothing about it can be shown as you. A departure record, holding identifiers and dates, shows that the erasure ran. 8. What is erased ================= Everything not listed in sections 9 and 10 is erased. In particular: What is erased. Columns: area, erased. Area | Erased ------------- Who you are | Your name, college email address and college; your answer to the status question at sign-up; your interests, profile text and time zone; your reading and notification settings; former names Signing in | Your passkeys, sessions, device labels and any unused codes People | Your connections; nods you sent or received; the blocks and mutes you placed; introductions you made Notices | Your notices in the app, and the weekly-letter schedule The Record | Your public page and its settings; your directory entry; self-reported items; linked skills; counts of how often your pages were opened. Your titles are retired and your perks are deleted Tillyard Research | Drafts, saved versions, sources, your answers to the editor and any request for a second look; your reading-pool entry. A paper that was waiting in line is withdrawn Notes | The text of every note and thread message you wrote; your private memos and reminder dates; your reactions; your Notes settings The Shop | Your preferences; evenings you said you were coming; visits and receipts; stamps, postmarks and your mug; your answers to the house question; thanks you gave and received; who you shared a table with; open offers of a favor. Your lines of table chat still inside the 14-day log are blanked, name and text. Your name is taken out of any stored Morning Edition Pursuits | Drafts, tracks you kept, logs and their entries; your portfolio pieces, whose Record items are withdrawn Scheduled tables | Your seats, follows, questions, invitation links, the feedback you gave, and requests for a title. Tables you were due to host are called off, and the people holding seats are told Projects | Your done lines, notes and answers; words you wrote about teammates and words they wrote about you; a project you were the only person in Organizations | Your roster rows and roles; notices you posted The Workbench | Copies of your documents and your tracker held in your account; your résumé-swap entries Safety | Your link to reports you made, and the words of your reports once their cases are closed; your contact details on your own requests; reports you had withdrawn Home, growth and support | How you arranged your home page; how you first reached the join form; your waiting-list and interest sign-ups; any larger-tip or sponsorship inquiry sent from your account's address Erased means erased from the live database. Section 11 covers backups. 9. What is left as a blank ========================== Some things stay in place with your identity removed, because taking them out would damage someone else's record or break a link that other people rely on. 9.1 Your Record pages --------------------- - Each public Record page of yours is stripped down to its address, its code, its last status and the month. Name, title, college and every detail of the item are deleted. - For 36 months, the address answers as a tombstone: "This item is no longer listed", with no name and no reason. That is so a link on an old résumé does not simply break, and so that nobody can tell from the page why it changed. - After 36 months the address answers "nothing is listed here", the same as an address that never existed. - A withdrawn item stays withdrawn. If an item had been withdrawn before you left, its tombstone goes on reading "withdrawn" for the same 36 months. Closing an account does not turn a withdrawal into a quiet disappearance. 9.2 Published papers -------------------- Sections 12.1 and 12.2 cover papers. 9.3 Conversations ----------------- - A conversation you were in stays for the other people in it. Your seat reads "a former member", and a line records that a member left. - The text of your notes is removed. Where a note of yours was, the others see that a note was there and has been erased. - Notes the other people wrote stay theirs. 9.4 Things you did for other people ----------------------------------- These stay, without your identity, because they belong to the other person's record. Section 12 explains each one. - A reading you wrote of another member's paper. - A score or a look you gave in Pursuits. - A confirmation you gave a teammate in a project. - A confirmation you gave an officer of a student organization. - Notes you wrote for someone in a résumé swap. - A favor you finished for someone. - Your attendance at someone else's table, as part of a count. 10. What is kept, and why ========================= What is kept, and why. Columns: what is kept, why, for how long, row in the Data Retention Schedule. What is kept | Why | For how long | Row in the Data Retention Schedule ---------------------------------------------------------------------- A blank account row with an internal identifier | So that other people's records still make sense | While those records exist | A1 A departure record: identifiers and dates | To show that the erasure ran | 24 months | A21 The dated record of what you agreed to, with the version of each document | To show what was agreed, if it is ever questioned | 24 months after erasure | A10 A keyed hash of your email address | So that leaving and coming back does not undo a block or a removal (section 10.1) | 90 days, 24 months or 36 months, depending on standing | A22 A keyed hash of name and college, for an account that staff removed | To notice if a removed member comes back under another address (section 10.2) | 24 months | Safety records The staff action log | So that staff decisions can be checked later, and so that what was agreed can be shown. It holds identifiers and reason keys and never names, email addresses or member text, and it cannot be edited or pruned | For as long as Tillyard operates. Once your account is erased, nothing in the live database connects your identifier in the log to your name or address | H19 Case files that involve you: reports about you, decisions, strikes, the evidence copied at the time | Other members' safety, and our ability to answer a later complaint or recognize a returning account | 12 months after a case closed with no action; 24 months after a case that ended in a notice, a mute, a suspension or a withdrawn item; 36 months after a case in which an account was removed | H3, H4 Blocks that other members placed on you | So that those members stay protected if you come back | For as long as the keyed hash above is kept | A23 Tombstones for your Record pages, with no name | So that old links say "no longer listed" | 36 months | F3 Records of legal removal requests, copyright notices, disputes and legal requests that involve you | The law, and our ability to show what we did | The periods in section 10 of the schedule | H10 to H18 Anything under a legal hold or a legal duty to preserve | The law requires it | Until the hold is released or the duty ends | Section 17 Email you sent to our addresses | It is the company's correspondence | 24 months from the last message | J4 A do-not-email entry, if you made one | So that we go on honouring it | Until you lift it | J3 10.1 The keyed hash of your email address ----------------------------------------- When an account is erased we keep one thing derived from its email address: a keyed hash. It is not the address, and the address cannot be read back from it. It lets the site recognize the same address if it is used to join again. It is kept: - for 90 days, if the account was in good standing; - for 24 months, if other members had blocked the account or a report about it was open; - for 36 months, if staff had removed the account. What it is used for: - Blocks survive. If someone blocked you, leaving and re-joining does not remove their block. - Removals hold. A member who was removed cannot close the account and walk back in. - The wait before re-joining (section 14) can be applied. It is not used to contact you, to count you or for anything else, and it is not shared with anyone. When its time is up, the hash is deleted, and the site no longer has any way to connect that address with the old account. 10.2 A second hash for removed accounts --------------------------------------- When staff remove an account, the safety system also keeps a keyed hash made from the account's name and college, for 24 months. If a new account's name and college produce the same hash, the system opens a low-priority item for staff to look at. It never refuses, hides or pauses anyone by itself. Two different people can share a name and a college, and a person decides. 11. Backups =========== - We take a copy of the database about once a week and keep no copy longer than 12 weeks. The company that hosts the database also keeps rolling recovery copies for a period set by our plan, never more than 30 days. - Something you deleted, or an account that was erased, can therefore persist inside a backup until that backup is deleted. - Nothing in a backup is visible to members, visitors or search engines, and staff do not look inside backups in ordinary running. - We do not restore single records from a backup to undo a deletion. An erased account cannot be brought back from one. - If the whole database ever has to be restored from a backup, we aim to apply again the deletions, removals and holds made since that backup before the site reopens. The Data Retention Schedule, section 15, governs these periods. 12. What happens to particular things ===================================== 12.1 A published paper you wrote alone -------------------------------------- - The paper is withdrawn. Its text and your byline are removed. - Its page stays at the same address as a tombstone. It shows the title, the volume and number, and a notice that the paper was withdrawn at an author's request. It shows no name and no text. - The tombstone is kept so that a link or a citation elsewhere does not lead nowhere. - The Record item for the paper follows section 9.1. - The licence you gave us for the paper ends for the future, as the Author Agreement and Licence provides. If you would rather the title did not stay either, write to privacy@tillyard.org before you close your account. There is at present no way to close an account and leave a paper you wrote alone in place under your name. If that matters to you, section 2 describes how to keep the account and switch everything else off. 12.2 A published paper with co-authors -------------------------------------- - The paper stays published. It is also your co-authors' work, and it is on their Records. - Your name is taken off. Your byline reads "a former member". - Your co-authors' Record items go on saying what was true: that the paper was written by them and one other person. - The licence your co-authors gave us continues. If you want the paper itself withdrawn, that is a decision about a shared work. Raise it with your co-authors and with the editor before you close your account, under the Author Agreement and Licence and the Disputes and Corrections Policy. 12.3 A paper in draft, or waiting for a decision ------------------------------------------------ - A draft is deleted, with its saved versions and sources. - A paper that has been submitted and is waiting in line is withdrawn. Readers who had been offered it are no longer offered it. - A paper that was declined, and its record, are deleted. 12.4 Readings you wrote of other people's papers ------------------------------------------------ - The reading stays, because the author it was written for keeps their feedback, and because a published paper's page says how many students read it. - Your identity is removed from it at once. Readings were already blind to the author, and after erasure the reading is not linked to you for staff either. - It is deleted with the other readings of that paper, 24 months after the decision on the paper. 12.5 Projects and booths with teammates --------------------------------------- - Your seat is released and reads "a former member". - What you wrote is deleted: your done lines, your notes, your answers, and words you wrote about teammates. Words teammates wrote about you are deleted too. - The project continues for the people still in it. If you led it, it goes to the person who has held a seat longest. A project you were the only person in is deleted. - Teammates' Record items are corrected so that the names and counts on them are true without you. - A public project page goes members-only until the people who remain have each said they are willing for it to be public again. - What the team made is not ours and is not affected by your leaving the site. Who owns it, and what each of you may do with it, is settled by the team agreement you all accepted, under the Projects and Collaboration Terms. 12.6 Confirmations you gave to other people ------------------------------------------- When you confirmed something for someone else, that confirmation became part of their record, and it stays true that a member confirmed it. So: - A confirmation of a teammate's contribution stays, with no name attached, until its period in the Data Retention Schedule ends. The teammate's recorded confirmation still stands. - A confirmation of an officer's role in a student organization keeps its count, with your name gone. - A score you gave in a round, or a look at someone's portfolio piece, keeps its numbers and what you observed, without your identity. - An entry of yours in a round that has finished keeps an anonymous row with its text blanked, only so that the number of entries stated on other entrants' records stays true. In a round that is still open, your entry is withdrawn. - Notes you wrote in a résumé swap stay for the person you wrote them for, without your identity, for up to 12 months. - A favor you finished stays in the other person's history, without you in it. After erasure, the wording on the other person's page still says who confirmed in general terms, for example "confirmed by two teammates". It no longer names you. If you gave a confirmation that you now believe was wrong, withdraw or dispute it before you close your account, under the Disputes and Corrections Policy. After erasure you can still dispute it as a non-member through the same form. 12.7 Confirmations other people gave you ---------------------------------------- - A confirmation exists to support an item on your Record. When your items are erased, the confirmations attached to them go too, or stay only as nameless entries in the other person's own history. - The name, role and email domain of an outside confirmer shown on one of your items are removed when the item is. A tombstone carries no names. - An outside confirmer's own right to withdraw what they confirmed does not depend on your account. 12.8 Messages you already sent ------------------------------ Messages and threads - The text of every note and thread message you wrote is removed. The other people keep the conversation, with a mark where each of your notes was. - A note that was reported before you left has already been copied into the case, and the copy stays with the case. - During the 14-day closing period nothing is removed. If you want a particular note gone straight away, take it back before you close. Table chat - Table chat is kept for 14 days in any case. Your lines still inside that log are blanked: your name and the text. - A reported exchange was copied into its case at the time. The house question, thanks and other short things - Your answers, your thanks and your stamps are deleted. What we cannot undo - A message that someone read, copied, photographed or quoted before it was removed. Erasing it here does not reach their copy. - An email notice that was sent. Our email never contains what a member wrote, so there is none of your writing in other people's inboxes because of us. 12.9 Things you were running ---------------------------- - A thread you owned goes to another person in it. A booth's or an organization's thread stays with the booth or the organization. - A table you were due to host is called off, and the people holding seats are told. Tables you hosted in the past stay as counts for the people who sat at them, with the host blank and the title and note removed. - A student organization's entry you registered or were an officer of loses your roster row and your role. If that leaves it with fewer than two officers, it goes into a caretaking state under the Organizations Terms until others step forward. - Invitation links and codes you made stop working. Their totals are kept, without you. 12.10 Titles, perks and your founding number -------------------------------------------- - Your titles are retired, and the public pages for them follow section 9.1. - Your perks, such as stamps and your mug, are deleted. - If you held a founding number at your college, the number is retired. It is not given to anyone else. - None of these comes back if you later re-join (section 14). 12.11 Tips and larger payments ------------------------------ - The site holds nothing about tips, so closing your account changes nothing about a tip you left. The records are in Stripe. - A tip is not refunded because an account closed. The refund terms in the Tips and Larger Payments Terms apply in the same way after you leave. 12.12 Reports, disputes and second looks that are open ------------------------------------------------------ - A report you made stays open and can be decided without you. Once the case is closed, your link to it and your words in it are erased. - A report about you stays open. If it is in an urgent category, your erasure waits for it (section 6). - A request for a second look, or a dispute you raised, can be finished during the closing period. After erasure we may be unable to continue it, because there is no longer an account to answer to, and a request for a second look on a paper is deleted with the paper's record. If you want a matter continued after you leave, tell us in writing before the closing date and give us an address to reply to. 12.13 The licence you gave us ----------------------------- The permission you gave us to display your content ends when the content is erased, as section 7.4 of the Terms of Use provides. The limited things that continue are the ones this document lists: backups for a time, case and legal records, tombstones, and work shared with other people. 13. Copies we cannot reach ========================== Erasing your account removes your information from our live systems. It does not, and cannot, reach: - Search engines. A page that was indexed may linger in results for days or weeks. We cannot hurry them. - Web archives and other websites that copied a public page. - People. A screenshot, a saved page, a printed résumé with a Record link on it, or a quotation from your paper in someone else's work. - Other members' own exports made before you left, which may include your public name where you appeared in their records. - Your own browser. Workbench documents and your display settings stay on your device until you clear them (section 3.10). - Your own export file, and anything you downloaded or printed. - Your college's mail system, which holds whatever we emailed you. - Stripe, if you ever left a tip. If something about you appears on another website and you want help asking for it to be taken down, write to privacy@tillyard.org. We can tell you what we know about where it came from. 14. Coming back =============== - After a wait. You can join again with the same college address 14 days after the erasure, if the account was in good standing. - A removed account cannot re-join with that address while its hash is kept. - You start again. A new account has none of the old one's Record items, titles, perks, connections, notes or settings. Erased things are gone. An export file cannot be loaded back in. - Blocks and history still apply. While the keyed hash of your address is kept (section 10.1), joining again is linked to the old blank record, so a block that another member placed on you, any strike that is still counting, and your case history carry over. Your public identifier is new. - Old links do not come back to life. A tombstone stays a tombstone. 15. Accounts that we close ========================== 15.1 An account removed by staff -------------------------------- A member who has been removed can still sign in to a limited page, to download their data, withdraw permissions, stop email and close the account. If they do not close it, the account is erased automatically 12 months after the removal, with no closing period. What is kept afterwards is as in section 10, with the longer periods that apply to a removed account. 15.2 An account closed because its holder was under 18 ------------------------------------------------------ If we conclude that a member is under 18, the account is erased at once, with no closing period. No date of birth is kept, because none is ever stored. The case record follows the Data Retention Schedule, and the Child Safety Policy and the Eligibility and Verification Policy say more. 15.3 A lapsed college address ----------------------------- If your yearly check of your college address lapses, parts of the site pause. Nothing is erased, and your Record, tools and data stay as they are. You can still export and still close. 15.4 Accounts that go quiet --------------------------- We do not at present erase an account for being unused. Two things are tidied after a long silence, each after a warning: account copies of Workbench documents after 24 months without a sign-in, and a draft paper after 12 months untouched. The Privacy Notice, section 16.6, says more. 15.5 If the site closes ----------------------- If Tillyard, or a part of it, closes for good, we aim to give members notice and time to download their data first, where we reasonably can. An export cannot be started while the site is in read-only mode, so the time to download is the time before that mode is switched on. A sudden closure is possible. The Terms of Use, section 26.7, govern. Keep your own copies of your work. 16. If you cannot do this yourself ================================== 16.1 Asking by email -------------------- If a barrier, a technical problem or the loss of your device stops you using the tools, write to support@tillyard.org from the address on your account. Say whether you want an export, a closure or both. 16.2 How we make sure it is you ------------------------------- - For a request by email, we send a code to the address on the account and ask you to confirm it. - We do not ask for identity documents, and please do not send any. - A request made this way takes the same course as one made in your account: an export is prepared for you, and a closure has the same 14-day closing period, the same notice and the same right to change your mind. 16.3 If you have lost both your passkey and your college mailbox ---------------------------------------------------------------- This is the hard case. Without a passkey and without the mailbox, we may have no reliable way to tell you from someone pretending to be you, and we do not hand over or erase an account on a person's word alone. Write to support@tillyard.org and tell us what you can. Where we cannot confirm that the account is yours, we can still act on things that do not depend on it: for example, anyone can ask through the dispute form for a public page that names them to be looked at. The way to avoid this is to move your account to a new college address before the old one closes, and to keep a passkey on a device you still have. 16.4 Someone acting for you --------------------------- If another person makes a request for you, we ask for your signed permission or for evidence of their legal authority, and we may confirm with you directly. 16.5 A member who has died, or who can no longer manage their affairs --------------------------------------------------------------------- A person with legal authority over a member's affairs may write to privacy@tillyard.org to ask that the account be closed. We ask for evidence of the death or the incapacity, and of that authority. We close the account. We do not give anyone access to the account or to the contents of its private notes. Where a published paper or a Record page is concerned, we aim to follow what the family asks, within the limits of this document. 17. People who are not members ============================== You may never have had an account and still have information here: because you confirmed something for a member, were named on a page, sent a request, or left an address on a waiting list. - If you confirmed something, the receipt we emailed you links to a page where you can withdraw the confirmation or hide your name in one step. - If a page names you, you can ask for your name to be removed through the dispute form. - If you left an address on a waiting list, the one email we send has a "take me off" link, and the address is deleted from the list after that email in any case. - If you left an address on the early list, write to privacy@tillyard.org to come off it. We delete it then, and in any case after the one email or 12 months. - If you never want email from us again, every email we send to a non-member has a link for that. - For anything else, write to privacy@tillyard.org. You can ask what we hold that names you and ask us to correct or remove it. We confirm the email address involved by writing to it. The Privacy Notice, sections 3.13 and 17.2, and the Disputes and Corrections Policy govern. 18. The timeline at a glance ============================ The timeline at a glance. Columns: when, what happens. When | What happens ------------------- You start an export | The slip opens. If you signed in by code alone, it opens 24 hours later 30 minutes after it opens | The export closes You press "Close my account" | You are hidden and signed out elsewhere. A notice and an email confirm the closing date During the next 14 days | Nothing is erased. Sign in to keep the account or download your data After 14 days | The erasure starts, unless a hold applies. It usually finishes in a day or less When the erasure finishes | A last email confirms it. Your Record links answer as nameless tombstones 14 days after erasure | An account that was in good standing can join again 90 days after erasure | The keyed hash of the email address is deleted, for an account in good standing Up to 12 weeks after erasure | The last backup copy that still held your information is deleted 24 months after erasure | The departure record and the record of what you agreed to are deleted. The keyed hash is deleted, for an account that had been blocked or reported 36 months after erasure | The Record tombstones are deleted. The keyed hash is deleted, for an account that staff had removed Clean-up runs in batches at least once a day, so a record whose time is up is removed on a following run, usually in a day or two. 19. Your rights =============== Some states give their residents rights to see, correct and delete their information. Those laws mostly apply to much larger companies than this one. We offer export and deletion to every member, wherever they live, as our own practice, and where a law does apply to us and gives you more, you have that too. The Privacy Notice, sections 17 to 19, sets out those rights, what we may decline, and what you can do if we say no. Using any choice in this document never costs you your standing or your access to any tool. Closing your account has the natural consequences described here, and we tell you about them first. 20. Changes to this document ============================ The version number and effective date are at the top, and earlier versions stay available. If we change what is kept after an account is erased, or for how long, the change applies to accounts that close after it takes effect, unless the change keeps less. 21. Contact =========== - Help with an export or with closing your account: support@tillyard.org - A request about your information, a request from someone who is not a member, or a request after a member's death: privacy@tillyard.org - A barrier that stops you using these tools: accessibility@tillyard.org - If you think someone else is trying to export or close your account: security@tillyard.org - Post: Tillyard, 10602 York Rd SW, Etna, Ohio 43062