Privacy Notice ============== Tillyard. Version 1.5. In effect from October 22, 2026. Fingerprint of this text (SHA-256): 75bbaffb5fe1ebab568ea3de72d5b7a7e5d3c250362ad299a8af382e34f0907e This version: https://tillyard.org/policies/privacy-notice/v/1.5 - Tillyard is an Ohio nonprofit corporation, with a president who runs it day to day. It is not a school or an employer, and your college has no access to your account. - We collect little: your name, college email address, school, what you choose to write or publish, and the working records needed to keep the place safe and running. We never store your date of birth, an identity document, biometrics, card numbers or your precise location. - Nothing about you is public until you switch it on. Each item on The Record has its own sharing setting, and the public page, the directory and search-engine listing are three separate switches that all start off. A paper you publish in Tillyard Research is public by its nature, and you are told so before you submit. - Table chat and private messages are screened by automated safety tools and logged. Some of those tools are run by outside companies, which receive the text and nothing about who wrote it. Nothing is end-to-end encrypted. Staff can read a note, and up to ten either side of it, only when someone in the conversation reports it or screening flags it; section 7.6 lists the few other cases for table chat and for the law. - There is no advertising here, no analytics script, and no advertising or cross-site cookie. We do not sell personal information or share it for advertising. One other party can collect technical signals on our pages: Cloudflare, which runs the bot check on some forms (section 10). - A few companies work for us: a hosting and network provider and text-safety classifiers. An email delivery provider and Stripe join only when the site starts sending email and can accept donations (section 9.1). - Tillyard is not open to students yet and cannot yet accept donations. If you leave an email address on the early list, we keep it encrypted, write to you once when you can join or donate, and then delete it (section 3.13). To come off the list sooner, write to privacy@tillyard.org. The site itself sends no email yet. Each receives only what its task needs. - You can see, download, correct and delete your information from your account, and withdraw any permission you gave. The download is a copy of what is tied to your account; a few things are left out, such as notes other people wrote to you. We offer these choices to everyone, whichever state they live in, within the limits explained in section 17. - Accounts are for people aged 18 or over at US colleges. People under 18 can use our public forms, and we then hold what they send us to deal with that request. Information is processed in the United States. - Questions and complaints go to privacy@tillyard.org or Tillyard, 10602 York Rd SW, Etna, Ohio 43062. If this summary and the full text below ever differ, the full text governs. 1. Who is responsible ===================== 1.1 The company --------------- Tillyard is an Ohio nonprofit corporation. In this notice "we" and "us" mean Tillyard. We decide why and how the information described here is used, so we are the party responsible for it. Tillyard is a website where college students can work alongside each other, publish papers, keep a checkable record of what they have done and build a résumé. Tillyard is not affiliated with or endorsed by any college or university. 1.2 Who runs it --------------- The president runs Tillyard day to day. Staff means the owner and anyone the company engages under a paid contract to help run the site. Members are never given staff powers over other members, and no member can see the staff console. 1.3 Your college is not involved -------------------------------- Your college does not run Tillyard, did not give us any information about you, and cannot see what you do here. We receive no student records from any college. The only link is the college email address you chose to sign up with. Your college does control that mailbox, which matters for security (section 13.4). 1.4 The president's other business ---------------------------------- The president also runs an unrelated business of their own under another name. Information collected at Tillyard is used for Tillyard. We do not use it to market that business, and we do not combine it with its customer records. 1.5 How to reach us about privacy --------------------------------- - Email: privacy@tillyard.org - Post: Tillyard, Privacy, 10602 York Rd SW, Etna, Ohio 43062 - General help: support@tillyard.org - Security reports: security@tillyard.org 2. Who and what this notice covers ================================== 2.1 People ---------- This notice covers personal information about: - Members: people with an account. - Visitors: anyone who opens a public page without signing in, including someone checking a record link or code printed on a résumé. - Tippers and payers: anyone who leaves a tip, or arranges a larger tip or sponsorship in writing. - Outside confirmers: people outside Tillyard who confirm something a member did, such as a contact at an organization the member volunteered for. - People named by members: co-authors, collaborators and organization officers, people thanked, quoted or described in a paper or project, contacts a member lists in their applications tracker, and anyone mentioned in chat or a note. - People who write to us or use a public form: removal requests, dispute and correction requests, copyright notices and counter-notices, larger-support inquiries, accessibility feedback, security reports, press questions and ordinary email. - People on a waiting list: for a school that is not open yet, while sign-ups are paused, or before Tillyard opens to students or can accept donations (the early list). - Sponsors: a company that sponsors a project, or a donor who pays for a grant round, and has a sponsor account to see what it supports. 2.2 What it does not cover -------------------------- - Other websites and services we link to or that you choose to use alongside Tillyard: Stripe's payment pages, LinkedIn, a video-call link a table's opener pastes in, your own mail program, a publisher's site behind a DOI. Their own notices apply. - What another person does with something you showed them. A member who can see your name at a table can write it down. A visitor who opens your public page can copy it (section 6.9). - Staff members' own contract and payroll records. 2.3 Other documents ------------------- This notice is the general statement. Where a more specific document covers the same point, the more specific one governs: - the Cookie and Storage Statement for cookies and anything kept in your browser; - the Data Retention Schedule for exactly how long each kind of record is kept; - the Messaging and Monitoring Notice for screening and logging of rooms and messages; - the Intimate-Image Removal Policy, the Copyright Policy, the Child Safety Policy and the Disputes and Corrections Policy for information sent through those processes; - section 7 of the Service and Volunteering Terms for people who confirm something through a link; - the Law Enforcement and Legal Requests Policy for demands from courts and authorities; - the Author Agreement and Licence for what happens to a paper you publish. The Terms of Use are the contract between you and the company, and section 37.5 of those terms sets the order among all of these documents. On how personal information is handled, this notice is the more specific document. 2.4 Words used here ------------------- Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word. - Personal information means information that identifies a person or could reasonably be linked to one. A scrambled copy of an identifier still counts. - Public means visible to anyone on the web without signing in. - Signed-in members means people with an active account. Something "members can see" is not public, though it is seen by people you may not know. - A keyed hash is a one-way scramble made with a secret key that only our servers hold. It lets us recognise the same value again without storing the value. A keyed hash of an email address or an IP address is still personal information, and we treat it that way. - Screening means the automated safety check that member-written text goes through (section 7.4). - A hold hides an item from everyone except its author while a person looks at it. A hold deletes nothing, adds no strike and is not a finding that a rule was broken. - A case is the file staff keep when something is reported, flagged, disputed or appealed. - To erase is to delete a record. To blank is to empty the personal fields of a record while leaving the row in place so other records still make sense. A tombstone is the nameless marker left where a public page used to be, so old links say "no longer listed" and do not fail. - The staff action log is our append-only record of what staff and automated rules did. It holds identifiers and reasons, never names or member text. 3. What we collect, why, who sees it and how long we keep it ============================================================ 3.1 How to read these tables ---------------------------- Information reaches us in five ways: you give it to us; another member or an outside person gives it to us; our systems create it as you use the site; your browser sends it automatically; or a provider tells us something (for example, the bot check tells us that a form was filled in by a person and not a script). Each table has four columns. The first says what the information is and, after the word "From", where it comes from. The second says why we use it and, after the word "Basis", why we are entitled to. The third says who can see it, and the fourth how long we keep it. The basis says why we are entitled to use the information, in practical terms: - Contract: needed to give you what you signed up for under the Terms of Use. - Consent: you switched it on or agreed to it, and you can withdraw. - Safety and security: needed to keep members safe, the site secure and the cost of running it under control. - Legal duty: a law requires it. - Records: so that we can show later what was agreed or decided. The Who can see it column describes ordinary use. Section 7.6 says when staff can read what members wrote to each other. The How long column is a summary; the Data Retention Schedule gives every period and governs. 3.2 Joining and signing in -------------------------- Joining and signing in. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Your name. From: You, at sign-up. You can change it within limits. | To show who you are to members you meet, on The Record and on anything you publish. Basis: Contract. | Members you share a room, table, thread or project with; anyone, on pages you make public and papers you publish; staff | Until you change it or your account is erased. A former name is blanked 12 months after the change Your college email address. From: You. | To confirm you control a mailbox at a listed US college; to send sign-in codes, recovery, account and safety email. Basis: Contract. | You and staff. It is never shown to other members or on any public page | Until you change it or your account is erased Your school. From: Worked out from your email domain. | Shown beside your name; used to draw readers and swap partners from other schools. Basis: Contract. | Members you meet; the public where you chose | Until your account is erased Your date of birth. From: You, once, at sign-up. | To check that you are 18 or over. Basis: Legal duty; safety and security. | Nobody. Our server evaluates it and discards it in the same step | Not stored The fact that the 18+ check was done, and when. Your answer to the status question (undergraduate, graduate or recent graduate) From: Created at sign-up; you. | To show the check happened; to confirm you are eligible. Basis: Legal duty; records. | You and staff | While your account is open Each agreement and permission: what you agreed to, the version of the wording you saw, when, and when you withdrew. From: Created when you agree or withdraw. | To know what you allowed and to be able to show it. Basis: Records; legal duty. | You, under History, and staff | While your account is open, then 24 months after it is erased. Each agreement to a document is also written, as an identifier, the documents and versions, a fingerprint of the wording and the time, to the staff action log, which is kept for as long as Tillyard operates (3.10) Passkeys. From: Your device creates the passkey. We receive its public key, an identifier, a label, the kind of device, whether the passkey is synced between your devices, a use counter and when it was last used. | Everyday sign-in; to notice a copied passkey. Basis: Contract. | You see labels and dates. Your fingerprint, face or device PIN never leaves your device and never reaches us | Until you remove the passkey or your account is erased One-time codes. From: We create them and email them to you. | To prove you control the mailbox at sign-up, recovery, the yearly email check and an address change. Basis: Contract; safety and security. | Only you, in the email. We keep a scrambled copy, not the code | Minutes. Spent and expired codes are cleared no more than a day later Sessions and signed-in devices: a scrambled session token, when it was created and last used, how you signed in, a device label drawn from your browser type, and a keyed hash of the IP address the session was opened from. From: Created at sign-in; your browser. | To keep you signed in, show your device list and let you sign a device out. The hash is also used to notice when two accounts appear to share a network (3.11) Basis: Contract; safety and security. | You and staff. The hash is never shown | Until you sign out or sign the device out. Otherwise 60 days without use or 180 days in all, whichever comes first The last day you used the site, and your daily write counters. From: Created as you use the site. | To decide whether to send the weekly letter, to know when unused Workbench copies lapse, and to apply daily limits. Never shown to other members: there is no "last seen". Basis: Contract; safety and security. | You and staff | The last day, while your account is open. Counters, until the day ends Account events: a new device, a passkey added or removed, a name or address change, the yearly email check. From: Created as they happen. | So you can see what happened on your account; to spot a takeover. Basis: Safety and security; records. | You, under History, and staff | While your account is open 3.3 Profile, settings and connections ------------------------------------- Profile, settings and connections. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Interests, up to eight from a fixed list. From: You. | To suggest tables and people. Basis: Consent. | Used for suggestions; shown to others only as your per-field settings allow | Until you change them Public profile text: headline, about, graduation year, LinkedIn address, and which fields a stranger may see. From: You. | To build your public page, if you switch one on. Basis: Consent. | Only the audience you chose for each field | Until you change it Reading and display settings, time zone. From: You. | To show the site the way you asked. Basis: Consent. | You | Until you change them Notification settings and the weekly letter. From: You. | To send only what you asked for. Basis: Consent. | You | Until you change them Connections, blocks and mutes. From: You and other members. | To decide who may write to whom and to keep blocked people away from you. Basis: Contract; safety and security. | You see your own lists. A blocked member is not told, and nobody can look up who has blocked them. Staff see them when handling a case | Until removed or your account is erased. A block someone placed on you is remembered after you leave (section 16.4) Nods and introductions: who nodded to whom or introduced whom, when, and where they met. From: You and other members. | To connect two members only when both choose it. Basis: Contract. | The two people. Staff when handling a case | An unanswered nod lapses (currently after 14 days). The record is kept 180 days after it lapses or is answered Notices in the app. From: Created by the system. | To tell you about things that concern you. Basis: Contract. | You | 90 days Table invitations: if you take a seat at a scheduled table through a member's invitation link, the link between you and that member. From: Created when the link is used. | To seat you, and to count that the invitation was used. Basis: Contract. | You, the member who invited you, staff | 90 days after the table The code on the join link or printed sheet you came through. A code names a place or a kind of page, never a person. From: Created when you join. | To count how many people who joined through a code went on to take part. Basis: Contract. | Staff, as totals | The link between you and the code, up to 30 days. Daily totals for the code, 24 months We ask for no photo. Members appear as initials in a tinted circle. 3.4 The Shop ------------ Nothing in the Shop is public. Two bare counts (pots brewed this week, people coming tonight) appear on the front page with no names. The study rooms open with less than the first rows of this table describe. The last five rows (a room you opened, your visits and study time, your total study time, your settings and card, and handshakes) are what the rooms keep today. The coffee ring, stamp counts, "coming tonight", thanks, house questions, favors and the Morning Edition apply only if and when those parts open. The Shop. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Your order ticket: name, school, drink and your one line on what you are working on. From: You. | It is your presence card in the room. Basis: Contract. | Members in the same room, or only people at your table, depending on your presence setting. People you blocked, or who blocked you, never | The visit record is kept 30 days unless you keep the receipt Presence: that you are in a room and at which table. From: Created by the room. | To seat you and show the table who is there. Basis: Contract. | The room or your table, as above. Your connections may see that you are in, if you allow it | Minutes after you leave Table chat, and any outside call link a table's opener sets. From: You. | Conversation at the table; safety. Basis: Contract; consent to logging, given by a tick on your first order in the Shop and shown again in the room. The Terms of Use you accepted at sign-up bring the Messaging and Monitoring Notice in. | The people at your table. Automated screening. Staff as section 7.6 allows | 14 days, then deleted. Lines copied into a case stay with the case Visit times, pots finished, stamps, postmarks (schools of people you finished a pot with), the mug. From: Created by the room. | Your receipt and stamp card. Basis: Contract. | You. Your mug on the shelf, "in now" and your usual evenings only if you opted in to each | Unkept visits 30 days. Stamp and postmark counts until your account is erased Coffee ring: first name, school, your line and the part of the day. From: You, by a tick on each order. | A trace for whoever sits there next. Basis: Consent. | Any signed-in member, for 24 hours, apart from blocks | 24 hours "Coming tonight" (RSVP), with your name if you tick the box. From: You. | The sign on the door. Basis: Consent. | Signed-in members | 7 days after that evening Who shared your table; trade-card ticks; Fifteens. From: Created by the room; you. | Your receipt, thanks, trading cards, and the rule against repeated pairings. Basis: Contract. | You. A tablemate is named on your receipt only if they allow it. A trade-card tick is revealed only if both people tick | 30 days Thanks you give and receive (a fixed reason, no free text) From: You and other members. | A small tally. Basis: Contract. | The receiver sees a reason only after three different people gave it, and never who | 180 days House-question answers. From: You. | The chalkboard. Basis: Contract. | Members who have answered | 120 days, or until you rub yours out Favors offered and asked for. From: You. | The favor board. Basis: Contract. | Signed-in members | An open offer lapses after 14 days. An accepted favor that is never finished lapses after 21 days. A finished one is kept 12 months A mention by name in the Morning Edition. From: Created from the day's activity, only if you allowed your name. | The daily one-page paper. Basis: Consent. | Signed-in members | 30 days A study room you opened: its name, what it is for, its topics, who may come in and its hours. From: You. | To list the room in the lobby and decide who may go in. Basis: Contract. | Signed-in members, as the entry rule you chose allows. Staff | Until you close the room or erase your account. A room nobody visits for 14 days closes by itself Your visits to study rooms: when you arrived and left, the table, who sat alongside you, and your study time. From: Created by the room. | To show you how long you studied. Basis: Contract. | You only | 30 days after the visit ends Your total study time: one number that grows by the length of each visit when it ends. From: Created by the room. | To show you the total beside your last 7 days. Added to everyone else's with no names, it makes the one house total shown on the front page of the Shop and on the home page. Basis: Contract. | You only. The house total carries no name, and it is shown only once enough members have a total that it cannot describe one person | Until you erase your account. The house total holds no name and stays Your study room settings and the card you show people you shake hands with: sound and view choices, whether connections may see which room you are in, whether they may see roughly when you were last in a room (both off unless you switch them on), a headline and a LinkedIn address. From: You. | To remember your choices and to show a card after a handshake. Basis: Contract. | You. People you shook hands with see the card, and the room or the time when you switch those on. Staff | Until you change them or erase your account Handshakes you offered or accepted. From: You. | To apply the limits on offers. A connection that was made is kept with your other connections. Basis: Contract. | You and staff | 30 days 3.5 Notes --------- Notes. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Private notes and messages in group threads. From: You and the people you write to. | To deliver them; to screen them for safety before delivery. Basis: Contract; consent, given by a tick the first time you open Notes. The Terms of Use you accepted at sign-up bring the Messaging and Monitoring Notice in. | The people in the conversation. Automated screening. Staff as section 7.6 allows | Up to 12 months from sending. The text is removed at once if you take the message back or your account is erased. A copy of a message you edited or took back is kept 14 days in case it is reported. A note held by screening and never delivered is kept 14 days after it is decided or lapses Conversations and threads: who is in them, thread names, read marks, your mute and pin choices, invitations and reactions. From: You and other members. | To run the conversation. Basis: Contract. | The people in it | Until nobody is left in the conversation. A closed thread, 30 days. Reactions, with the note Your private memos about a connection, follow-up dates, your away line and Notes settings. From: You. | Your own notes to yourself, and your settings. Basis: Contract. | You | Until you change them, the connection ends or your account is erased You can only write to members you are connected with. Nobody receives a message from a stranger. 3.6 Tillyard Research -------------------- Tillyard Research. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Drafts, sources and your declarations (any AI help; whether the work was made for a class, a lab or an employer; notes on people and data in it) From: You. | Writing and submitting. Basis: Contract. | You and any co-author you invite. After you submit, student readers who chose to read it see the text without your name, and the editor sees everything | A draft untouched for 12 months is deleted after a warning. Declined or withdrawn submissions are kept 24 months Draft history, with counts of how much you typed and deleted and how long the editor was open; and a record of every paste: when it happened, how long it was, and the pasted words, up to 2,000 characters of each. From: Created by the desk, after you agree at first use. | So you can compare and restore versions; so readers and the editor can see which passages were pasted in and judge where words came from. Basis: Consent. | You, the students who read the paper (pasted passages are highlighted, with no name) and the editor once you submit. We never record which keys you pressed | Thinned when the paper is decided, deleted 90 days later. The published version stays while the paper is published Fingerprints of a sent paper's text, and a report of the checks (matches with other papers, signals from how the text was made). From: Made by Tillyard when you send a paper. | To find copied text and to give readers and the editor something to weigh before anyone acts. Basis: Contract. | Staff see which other paper a passage matches. Readers and you see the findings without any other paper's name unless it is published | With the paper Figures: pictures you add to a paper, with the caption and description you write. From: You. | To illustrate the paper. Basis: Contract. | You, the readers and staff until the paper is published; everyone once it is | Deleted with the draft, the withdrawn paper or your account. A published paper's figures stay while it is published Readings: scores, reasons and source checks. From: Student readers who chose to read the paper. | Feedback for the author; a brief for the editor. Basis: Contract. | The author sees the reading without the reader's identity. The editor sees it all. A reader sees their own | 24 months after the decision. An offer to read that was declined or lapsed, 30 days Reading-pool membership, your fields and a practice read. From: You. | To offer you papers you may accept or decline. Basis: Consent. | You and staff | Until you leave the pool or your account is erased Decisions, the editor's questions and your answers, an appeal. From: The editor and you. | The record of the decision. Basis: Records. | You and staff. The reason a paper was declined is never published | 24 months, or while the paper is published A published paper: title, abstract, text, your name and college as the byline, the declarations shown on the page, and any correction or withdrawal notice. From: You, under the Author Agreement and Licence. | Publication. Basis: Contract (the licence you grant) | Anyone. Search engines may list it | Until it is withdrawn. A tombstone then keeps the title, issue number and notice DOI look-ups. From: You paste a DOI; Crossref's public index returns the reference details. | To check that a source exists. Basis: Contract. | Crossref receives the DOI and nothing about you | The public details are cached for 6 months Research grants, your proposal: the question, method, timeline, budget, where you will publish, any conflict you declare, and the team you list. From: You, and teammates who ask to join (what they write to you, and whether they agree to be named). | To read, score and decide the proposal, and to run the project if it receives a grant. Basis: Contract. | You, your team, and staff. Reviewers see who applied, so that a conflict can be spotted. A proposal you list, or that receives a grant, is public (the budget, the milestones and the question; your name only if you ticked the box) | A draft 12 months after the last change. A declined proposal 12 months after the decision. One that received a grant is kept seven years after the grant ends Reviewers' scores and comments, and the decision with its reasons. From: Reviewers and the people deciding, who may be trustees (a trustee steps aside from any proposal where there is a conflict, and that is recorded). | The record of how a proposal was read and decided. Basis: Records. | You see the comments and the reasons, without the reviewer's name. Staff see everything | As long as the proposal The grant agreement: the printed name you type, the signature you draw (kept as a short list of points, not a picture), the time, your account and a fingerprint of the exact text; and your answer on whether the grant may count as income. From: You, and the owner's countersignature. | The signed agreement. Basis: Contract. | You and staff. Your name appears on the project's public page only if you ticked the box | Seven years after the grant ends. Not erased when you delete your account Spending, receipts, reports and payments for a project with a grant: amounts, dates and what each was for; a photo or a PDF if you attach a receipt; progress and final reports; the payments staff marked as sent. From: You and staff. We never ask for a tax number or a bank account through the site. | To keep the grant's money in order and to show what it did. Basis: Contract and Records. | You and staff. A receipt is seen only by you and the owner. The amounts, the spending per line and the reports staff accept are public, without your receipts or what each item was for | Seven years after the grant ends, receipts first. Not erased when you delete your account The list of people connected to Tillyard (trustees, officers, staff and their families), who cannot apply for a grant or receive grant money. An email address is kept only as a coded fingerprint. From: Staff. | To keep grants away from people connected to the organization. Basis: Legitimate interest. | Staff | While the person is on the list, and 12 months after Sponsored projects, your team: its name and short note, who is on it, whether you chose to be named, and the requests to join and invitations you send or get. From: You and the people you team up with. | To run a team on a project a sponsor hosts. Basis: Contract. | Signed-in students while the project is open; staff. Your name is on a finding or beside a win only if you ticked the box | A team that never published, 12 months after the project ends. A team that published stays with its findings. A request or invitation, 12 months after it is answered Findings you send to a sponsored project, and your team lead's agreement to license them under CC BY 4.0. From: You and your team. | To publish what teams found, and to let the sponsor pick prize winners from it. Basis: Contract (the licence). | Anyone, once the project's rule makes them public; the sponsor reads them to judge, and sees team names, never a student's name or address | Published findings stay under the licence. A draft or withdrawn finding, 12 months after the project ends A sponsor's contact: a name, an email address kept sealed, and the line winners are told. Your choice to put the home page banner for a project away. From: The sponsor, through staff; you. | To send the sponsor a private link to pick winners; to respect your choice. Basis: Contract; your choice. | Staff (the address is masked). Your choice, only you | A sponsor's contact, 12 months after the project ends. A banner choice, 30 days after 3.7 Pursuits, scheduled tables, booths, organizations and service ----------------------------------------------------------------- Pursuits, scheduled tables, booths, organizations and service. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Round entries, and scores and reasons given under that round's official rules. From: You and the other entrants. | To run the round. Basis: Contract. | As the round's official rules say. Scorers do not see your name | Entered text, 24 months after results, then blanked with counts kept. Scores and reasons, 24 months after results. A draft never entered, 180 days without changes, after a notice. Names put down for a round, deleted at results Portfolio pieces, and what readers typed after opening them. From: You; student readers who chose to look. | To record the piece and say who looked at it. Basis: Contract. | You and staff. The reader sees the piece without your name. The public, where you share the item | While the Record item is active. Otherwise 24 months after the last change. A draft, 180 days. A declined or expired offer to look, 30 days Your own dated logs. From: You. | Your own record of what you did. Basis: Contract. | You, and whoever you share the item with | Until you delete them or your account is erased Scheduled tables you host: title, note and times. Seats, standby places, invitation links and questions. From: You and the members who take seats. | To list and hold the table. Basis: Contract. | Signed-in members see the table. Its title, time and length also appear, without your name, on your college's page and on an invitation or printed sheet you make. The host does not see who answered feedback | A table that was called off or did not meet, 90 days. A table that met stays as a count for the people who sat at it. Seats, links and questions, 90 days after the table Attendance at a scheduled table, and answers to the three feedback questions. From: Created by the table's log; you. | A host's record is counted from attendance, not self-report. Basis: Contract. | Hosts see who sat at their table and, after enough answers, feedback totals. Staff | 400 days. After that only term counts and totals remain. A host's term counts are kept while the host has an account A request for the Table Host title, with the brief the editor saw and the decision. From: You; created by the system. | To decide the request. Basis: Contract; records. | You and staff | 2 years after the decision Printed sheets and their codes; the log of looks at public posts under the disclosure rule. From: You; staff. | To count scans as totals; to show a look was done. Basis: Contract; records. | You and staff | A code, 400 days after it ends. The log of looks (member, outcome and month, with no post text), 3 years Projects and booths: the project's text and counts; seats and the team agreement version each person accepted; plans, claims and results; the ledger of sessions, done lines and notes; Help Wanted cards and answers. From: You and your teammates. | To record who did what, as the team confirms it. Basis: Contract. | The team. Signed-in members, where the project is listed to members. The public, once every recorded person has agreed | While anyone holds a Record item that rests on the project. Otherwise 12 months after it is closed or put away. An ended invitation or request, 30 days. A cancelled or empty session, 90 days. A card, 90 days after it comes down. An answer to a card, 30 days after it ends Your answers in "Who did what", credit questions and words between collaborators. From: You and your teammates. | To confirm credit and settle a question about it. Basis: Contract. | Blind answers: staff only, in the cases the Projects and Collaboration Terms list. A credit question: the team. Words: the person they are about, and others if that person shows them | Blind answers, 24 months after the project is recorded. A credit question, 24 months after it closes. Words, until removed or withdrawn, or with the project A student organization's entry, its roster and roll, officer roles and who confirmed them, the meeting ledger, notices and handover sheets, and disputes. From: You and other officers and members of the roster. | To record the entry and the roles. Basis: Contract. | Signed-in members see the entry. Roster names are seen by the roster, and by staff when needed. The public sees a role only where its holder shares the item | The entry, while it exists; a closed entry's text, 24 months. A roster row, until you leave or the entry closes. A role, while its holder has an account; a removed claim, 90 days. The meeting ledger, 24 months. A notice, 30 days after it expires. A dispute, 24 months after the decision Public-good service: what you did, the statements you ticked, and an outside confirmer's name, role and email domain. From: You; the outside confirmer. | To record the service and who confirmed it. Basis: Contract. | You and staff. The public, where you share the item | A confirmed entry, until you remove it or your account is erased. A draft, or an entry sent back or lapsed, 180 days untouched, after a notice. The confirmer's details are in 3.13 The readers' pool for links, and help-table tallies. From: You. | To offer and compare readings of a link; to count a help table. Basis: Consent; contract. | You and staff. An entry's owner sees a reader's one sentence without the reader's name | Pool membership, until you leave. Your sentence, 24 months. Compared values and tallies, for the life of the item. Scrambled markers of the members who were helped, 12 months after the term Pursuits you keep on your page. From: You. | To list them under "My pursuits". Basis: Contract. | You | Until you take one off or erase your account An application to join a learning team for a term, your place on the team and its plan, your weekly notes, the hours you write down, the signed agreement and learning plan, and a volunteer lead's answer. From: You; the program director. | To run the term, to record the agreement, and to give you hours you can show a school that may give credit. Basis: Contract. | You, your team lead where you share a weekly note, and staff. The program director reads applications. Nobody checks the hours | A declined application, 90 days. The rest, 12 months after the term ends, except the signed agreement, kept for as long as it could matter; your typed name is erased if you erase your account Your founding number, the invitations you made to a table, and the page for your college. From: Created by Tillyard; you. | To number early members in the order they acted, to let you invite someone to one table, and to count members at a college. Basis: Contract; legitimate interests. | A college's member count and founding numbers are public. An invitation shows the table, and your name only if you chose that. Staff | A founding number, while your account lives, then the number alone. An invitation, until you end it or the table has met, and no more than 90 days after. A college page, while the college has members Every submission form asks whether the work was made for a class, a lab or an employer, because someone else may then own it. We keep your answer with the item. 3.8 The Record -------------- The Record. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Record items in three tiers: approved by the editor or staff; recorded (confirmed by the system, by members or by an outside party); and self-reported. From: The areas above; you, for self-reported items. | A page per item that someone reading your résumé can check. Basis: Contract; consent for each step of sharing. | By your setting for each item: only you; anyone with the link or code; or also on your public page | The life of the item. After your account is erased, a nameless marker for 36 months The link, ten-character code and QR code for an item. From: Created by the system. | So the item can be checked from paper. Basis: Contract. | Whoever you give them to | With the item Your public page and its settings. From: You. | A page you can link to. Basis: Consent. | Anyone, while it is on | Until you switch it off or your account is erased Your directory entry: name, school and the fields you show. From: You opt in. | So people can find you by name. Basis: Consent. | Signed-in members. Signed-out visitors only if signed-out search is opened (section 6.5) | Only while you are listed Open counts for each item. From: Counted from page requests. | "Who has looked", shown to you. Basis: Contract. | You and staff. We keep daily totals and nothing about who opened the page | 400 days The titles ledger (our software calls it the credentials ledger) and the perks ledger, and the editor's signed statement behind a title. From: Staff decisions; your participation. | To keep titles and hospitality perks separate and traceable. Basis: Records. | You and staff | While your account is open. The signed statement behind a title, while the title stands and 3 years after it is withdrawn or retired. If the account is erased, the editor's sentence is blanked at once and a row with no name remains as a count 3.9 The Workbench ----------------- The Workbench. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Résumés, letters, stories, a pitch, practice results and your applications tracker. From: You, in your browser. | The tools. Basis: Not held by us. | Nobody but you. This stays in your browser unless you switch on account copies | On your device, until you clear it A résumé file you import (PDF or Word) From: You. | It is read inside your browser to fill the builder. Basis: Not held by us. | Nobody. The file never leaves your device | Not stored anywhere Account copies of your documents, your tracker, or both. From: You switch them on. | So you can reach your work from another device. Basis: Consent. | You. Staff can see that copies exist and how large they are. Staff open a copy only when the law requires it or when you raise a problem with it. Copies are checked against a word list on our own servers and are not sent to an outside classifier | Until you delete them, switch copies off or close your account, or after 24 months without a sign-in Résumé swap: an anonymised copy of your résumé, what you want looked at, your field, and the notes you and your partner write. From: You and your swap partner. | To trade feedback with one member at another school. Basis: Consent. | One swap partner at a time. Automated screening. Staff if it is reported | The copy, 30 days after your entry closes. Notes, 12 months Your tracker may hold other people's names, such as a contact at an organization. If you keep an account copy, those names are stored with it. 3.9a The Almanac ---------------- The Almanac. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Guides and entries you saved, read or put away; reminders you asked for; a signal that a link did not open; your chosen fields and your notice switch. From: You. | Your shelf and your reminders; to tell us that a link in a guide has stopped working. Basis: Contract. | You. Staff see totals only | Until you remove them or your account is erased. Marks on an entry we have retired, 30 days after it is retired The details you type into a letter or email template: your name, school, year and field. From: You, in your browser. | To fill the template. Basis: Not held by us. | Nobody but you. They are kept only in your browser and are never sent to us. "Forget these", signing out and closing your account clear them | On your device, until cleared 3.10 Safety, reports and cases ------------------------------ Safety, reports and cases. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ A report you make: the category, what you wrote, and who or what you reported. From: You. | To look into it. Basis: Safety and security. | Staff. The person you reported is not told who reported them. A court could order us to disclose it | With the case Reports about you, holds on your items, case notes, outcomes, strikes and appeals. From: Other members, visitors, automated screening, staff. | To decide what to do and to record what was decided. Basis: Safety and security; records. | Staff. You are told the outcome and the rule involved, not who reported | 12 months after a case closes with no action. 24 months after a case that ended in a notice, a mute, a suspension or a withdrawn item. 36 months after a case in which an account was removed. A strike counts for 12 months The evidence packet: the reported item, the messages around it, times, the room or thread, account ages, earlier report counts, screening results, and a keyed hash of the connection's IP address with the browser type. From: Captured automatically when a report is made. | So that a decision rests on what was actually there, even if it is later edited or deleted. Basis: Safety and security. | Staff | With the case. The hashed IP address and browser type are removed after 90 days The screening verdict and its reasons. From: Our word list; the text-safety providers. | To hold harmful text until a person has looked. Basis: Safety and security. | Staff | With the item or the case it relates to, for as long as that is kept Text waiting to be re-checked because a safety service was unavailable: the text and the writer's identifier. From: Created when a check could not be completed. | To check it as soon as the service returns. Basis: Safety and security. | Nobody; software only | Until it is checked, normally minutes, and never more than one day A one-way fingerprint of a link or text removed under an upheld removal request. From: Created when the request is upheld. | To find exact copies in stored text, including Messages and threads, and to hold any later message that contains it. Basis: Safety and security; legal duty. | Staff see only the matches | With the removal request, 5 years Safety signals: a burst of messages, repeated word-filter hits, following someone from table to table, repeated attempts to move a stranger off the site. From: Created by the room. | To open a case for a person to look at. Basis: Safety and security. | Staff | With the case; otherwise 30 days The staff action log: who acted, on which identifier, under which reason key, and when. It includes each staff view of a member's page, each use of the view-as tool, and an entry for each agreement to a document. From: Created whenever staff or an automated rule acts, and when you agree to a document. | So decisions can be checked later, and so that what was agreed can be shown. Basis: Records. | Staff | For as long as Tillyard operates. It holds identifiers and reason keys, never names, email addresses or member text. Once an account is erased, nothing in the live database connects its identifier in the log to a name or an address The record of an age re-check, where one was asked for. It holds no date of birth. From: Created when we ask. | To show the check was done. Basis: Safety and security; legal duty. | Staff | 36 months Staff notes about a member: facts written down so that one case can be read in the light of another. From: Staff. | Continuity between cases. Basis: Safety and security. | Staff. Staff notes are not in your export, because they may name other people; ask at privacy@tillyard.org and the owner will send them with other people's details removed | 24 months from the day the note was written, and never past the erasure of the account If staff removed an account: a keyed hash of the name and college. From: Created at removal. | To notice a removed person's return. It can only raise a flag for a person to look at. Basis: Safety and security. | Staff | 24 months 3.11 Technical information -------------------------- Technical information. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Your IP address. From: Your connection. | To deliver pages, limit abuse and count attempts; and to notice when two accounts appear to share a network before one is offered the other's work to read or score. Basis: Safety and security. | Our network provider processes it on every request. Our own database keeps only a keyed hash (for IPv6, of the network prefix) | In rate counters, until the counting window ends and never more than 30 days. With a session, until the session ends (3.2). In a report or an evidence packet, 90 days. On a public-form submission, 30 days Your browser type (user agent) From: Your browser. | To label your devices, to leave known crawlers out of counts, and as evidence in a case. Basis: Safety and security. | You, in your device list; staff | With the session; 90 days in evidence Request logs: time, address requested, response code, timing and network details. From: Created by our hosting provider. | To find faults and stop attacks. Basis: Safety and security. | Staff and the provider. Our own code is written not to log names, email addresses or member text | A few days, set by the provider; never more than 7 Rate and budget counters. From: Created by the system. | To keep any one person or script from overloading the site or running up costs. Basis: Safety and security. | Staff | Until the window ends Bot-check signals. From: Collected in your browser by Cloudflare Turnstile on forms that send email or accept input from people who are not signed in. | To tell people from scripts. Basis: Safety and security. | Cloudflare. We receive a pass or fail | We keep the result for that request only Cookies and browser storage. From: Set by the site. | Sign-in, safety and your display settings. Basis: Contract; consent. | See the Cookie and Storage Statement | See the Cookie and Storage Statement Our hosting provider also shows us totals for the site as a whole, such as the number of requests and the error rate. These are counts taken from its network, not from a script in your browser, and they describe traffic, not people. 3.12 Email ---------- Email. What we hold and where it comes from, why we use it, who can see it and how long we keep it. What it is, and where it comes from | Why we use it, and on what basis | Who can see it | How long we keep it ------------------------------------------------------------------------------ Daily counts of the email we send in each class (essential, notice, optional), with nothing about who received it. From: Created when we send. | To stay inside sending limits. Basis: Safety and security. | Staff | Kept as totals. Our email provider keeps its own delivery records under its own rules (Data Retention Schedule, row J2) Your email permissions and unsubscribes. From: You. | To send optional email only if you asked, and to stop when you say stop. Basis: Consent; legal duty. | You and staff | With your consent record 3.13 People who are not members ------------------------------- People who are not members. Who they are, what we hold and why, who can see it and how long we keep it. Who | What we hold, and why | Who can see it | How long we keep it ------------------------------------------------------------------ Visitors | Nothing that names you. Our own code sets no cookie when you read a public page; our network provider may add a short-lived security cookie (Cookie and Storage Statement, section 4). Your IP address is processed as in 3.11. Opening a record page adds one to that page's daily total. A link or code typed into the "check a record" box is not stored or logged. Why: To serve the page and count opens. | Nobody sees who you are | As in 3.11 People who tip | Nothing on our site. Stripe collects your name, email address and card details on its own pages. In our Stripe account we can see your name, email address, the amount, the date and the limited payment details Stripe shows a business, such as card brand and last four digits. We never see your full card number. Why: To receive the tip, issue a refund and keep tax records. | The owner, in Stripe. We publish no list of people who tip and do not match them to member accounts | Stripe keeps its records under its own rules. Our business records are kept 7 years People asking about a larger payment or a sponsorship | Your name, email address, organization if any, and your message. If something is agreed: the written agreement and the invoice. Why: To reply and, if agreed, to arrange payment in writing. | Staff. The name, organization and message go through the same automated screening as other text (section 7.4) | The inquiry, 12 months after it is closed. Agreements and invoices, 7 years Outside confirmers | Your name and your role as you typed them, the statements you ticked, the hours you confirmed or corrected, and your work email address. A member named you, gave us your address and may have added a short note; we emailed you once, with at most one reminder, and you need no account. The address is kept sealed only until the reminder is sent or the request ends, 30 days at most, and then emptied; after that we keep a keyed hash of it and not the address. The Record then says the item was "confirmed from an @organization.org address by" your name and role. From a personal address it says so and says that Tillyard did not check your role. Why: To record who confirmed the item, in the exact words of what happened. Section 7 of the Service and Volunteering Terms is the detailed statement. | Your name, role and email domain are public wherever the member shares the item. Your full address is never shown | Your name, role and domain, for the life of the item, or 90 days if the link lapsed or you declined. A keyed hash of your address, 24 months after you answered, so you can withdraw or dispute it. A "never email me again" request, until you lift it People named by members | Whatever the member wrote: your name in a byline, an acknowledgement, a contribution line, a tracker entry, a chat line. Why: To show or deliver what the member wrote, and to moderate it. | Whoever can see the item it appears in | With that item People who send an intimate-image removal request | What the Intimate-Image Removal Policy lists: your name and signature, a contact address, your statement and where the material is. Why: To act on the request and to show what we did. | Staff who handle safety. Not the person who posted the material | 5 years after the ticket closes. You can ask us to delete your contact details once it is closed People who use the dispute and correction form | Your email address, the kind of dispute, what you wrote, and a ticket number. Why: To handle it and let you check its status with the ticket and your email address. | Staff. The member concerned is told what is disputed, not more about you than the dispute needs | 24 months after it closes. The hashed IP address and browser type sent with the form, 30 days People who send a copyright notice or counter-notice | What the Copyright Policy lists: name, address, telephone number, email address, signature and your statements. Why: To act on it as the law sets out. | Staff. We give the member whose material is affected a copy of the notice, including your name and your statements; we may leave out your street address, telephone number and email address. The law requires us to give a counter-notice to the person who complained | 3 years after it closes People who email us, send accessibility feedback or report a security problem | Your address and what you wrote. Why: To answer. | Staff, in the company's mailbox | 24 months after the last message People on a waiting list | Your college email address and a keyed hash of it. Why: To tell you once when you can join. | Staff | Until that one email is sent, and never more than 12 months. The hash stays only if you asked not to be written to again People who use a demo link | A random id for the browser, which demo link it was, whether it is a phone, tablet or computer, the answer you tapped to "who is looking around?" if you tapped one, and which pages of the demo you opened and what you tried there, with times. No name, email address or network address. The demo copy of the site (demo.tillyard.org) holds invented students only, and the guest account it gives you is invented too. Why: To see who a demo is useful for and which parts of Tillyard people try. | The owner | 12 months after your last visit People who ask for a new demo link | Your name, email address, who you said you are, an organization if you gave one, and your message. Why: To send you a new link and reply. | The owner | 12 months after the request is answered People on the early list | Your email address, kept encrypted, a keyed hash of it, its domain and the date. Before we open, a college address waits to be told when you can join; any address can wait to be told when donations open. Why: To tell you once. | The owner | The address: until that one email is sent, and never more than 12 months. The keyed hash, domain and date: 12 months after that. If you ask to be taken off, the address is deleted and the hash stays so it is not listed again Sponsors | The organization's name, the contact's email address, the password or passkey they sign in with, which sponsored projects and grant rounds the account is linked to, its API keys (kept only as a keyed hash and their last four characters) and the gifts started through it. Why: To show a sponsor what it supports and how it is going, and to take the gifts it starts. A sponsor sees team names, counts, published findings, and a grantee's name only where the grantee chose to show it: never a student's private work, address or contact details. | Staff, and the sponsor itself | The account, while the sponsorship lasts. Links and keys go with the account. Gift records, 7 years People who give through a sponsor's page or the payments API | The amount, the fee the giver chose to cover, what the gift is for (Tillyard's general use or a grant round), the name the giver typed, Stripe's reference for the checkout and whether it was paid. Your card details and email address go to Stripe on Stripe's own page and never reach us. Why: To match Stripe's notice that the gift was paid and record it in the nonprofit's books. | Staff, and the sponsor whose page or key started it | 7 years People who ask us to add a college | Your email address, the college's name, the city and state you typed, and a note if you wrote one. If we add the college we write to you once more, with a link to join. Nothing about your network is kept with the request. Why: To decide whether the college belongs on the list and to tell you when it does. | Staff | Until the request is answered, and never more than 60 days. If the college is added, your address stays only until that one email has gone, 14 days at most. A request that is turned down, or is for a college already on the list, is deleted at once What you write in a report, a dispute, a second-look request or a removal request is not sent to any outside classifier; only staff read it. The name, organization and message on the larger-payment inquiry form, and the name and role an outside confirmer types, are checked by the same automated screening as other text (section 7.4). An item that was reported may itself be screened once more to see whether the report is borne out, except in child-safety and under-18 matters. If you are named on a page here and did not agree to it, or it is wrong, use the dispute and correction form linked from every public page, or write to privacy@tillyard.org. You do not need an account. When a request to remove a name comes from an email address at the named organization that we have confirmed by code, the name is hidden at once while a person reviews it. 4. What we never collect ======================== We do not ask for, and have built no place to store: - your date of birth beyond the moment of the age check, or your age in years; - a government identity document, a student ID number, a Social Security number, or a photo of your face; - biometrics of any kind, including selfie or voice checks. A passkey may use your fingerprint or face on your own device, and that stays on your device; - payment card or bank details. Tips go through Stripe's own pages; - your precise location. We store a time zone if you set one. Our network provider sees your IP address, from which a rough area can be worked out; we do not store that; - your contacts, address book or calendar; - advertising identifiers, or any identifier that follows you from site to site; - photos, files, audio or video, apart from the figures an author adds to a paper for Tillyard Research and the receipts a grantee attaches to the spending of a research grant (see the table in section 3.6). Everything else on the site is text; - anything from LinkedIn or any other account. If you add a LinkedIn address, you paste it in and we store the address alone; - records from your college; - questions about race, ethnicity, religion, health, disability, sexual orientation, immigration status, union membership or political views. You may write about any of those in your own words in a paper, a note or a profile. We do not ask you to, we do not sort or label members by it, and we do not use it to draw conclusions about you. 5. How the 18+ check works ========================== Tillyard is for adults. No free check can prove anyone's age, so we screen in layers and act when we learn more. 1. A neutral date-of-birth question. The sign-up form asks for your date of birth rather than a tick in a box. The date is sent to our server, compared with today's date, and discarded in the same step. We store only that the check was done and when. 2. A status question. You say whether you are an undergraduate, a graduate student or a recent graduate. High-school students taking college classes are not eligible, even with a college email address. 3. A statement you tick. The box reads: "I am 18 or older, I am in the United States, and I am a student or recent graduate of the college whose email I used. I agree to the Terms of Use and the Community Guidelines, and I have read the Privacy Notice." A false answer is a reason to remove the account. 4. A list of US college email domains. Schools for younger students are left off. 5. If the check is not met. The sign-up stops with a neutral message and no account is created. So that the form cannot simply be tried again, we set a short-lived cookie in that browser, and we may keep a keyed hash of the email address that was used for up to 30 days. We do not keep the date that was entered. This has a limit: after those 30 days nothing stops the same address being tried again with a different date, and we act when we learn of it. 6. A "may be under 18" report. Any member can raise it. The account may be paused at once while a person looks, and the member may be asked to answer the age question again. The account is closed if the member answers that they are under 18 or a high-school student, or does not answer in the time shown (section 20). We do not use identity-document checks, selfie checks or any outside age-verification service. 6. What is public, and how you control it ========================================= 6.1 Every account starts with nothing public -------------------------------------------- When you join, no page about you exists on the open web. The privacy page in your account lists every switch that affects who can see you, in one table, with its current state in words and a link to where it is changed. 6.2 Each item on The Record has its own setting ----------------------------------------------- - Only me. Nobody else can open it. A link or code you already gave out shows "no longer listed". - Anyone with the link. Whoever you give the link or code to can open it. It is not on your public page and search engines are asked not to list it. - On my public page. It is also shown on your public page, when that page is on. A record of readings you have done for Tillyard Research starts as "only me" whatever your default is. A self-reported item never gets a link or a code of its own. 6.3 What a record page shows ---------------------------- An active record page shows your name, what was done, when (never finer than a day), who confirmed it in exact words, its status, and a fixed statement of what the page does and does not say. A page that is no longer listed or has been withdrawn shows no name, title, school or reason. A suspension is never shown on a public page. 6.4 Your public page -------------------- A public page exists only if you switch it on. It shows your initials and name, the profile fields you chose to show a stranger, the line about your college email ("Verified .edu email, checked" with a month and year), the month you joined, and the Record items you set to "on my public page". Accounts less than seven days old can prepare a public page but cannot switch it on. You can replace the page's address if someone you would rather avoid has it. 6.5 The directory ----------------- The directory lists only members who chose to be listed, so not finding someone tells you nothing about them. Being listed needs your public page to be on and a separate permission. Searches need at least three letters of a name, return a few results at a time in no ranked order, and are not logged. At opening, only signed-in members can search. Signed-out search is built but switched off; if it is opened later, a signed-out visitor will have to pass a bot check and will be limited to a small number of searches. 6.6 Search engines ------------------ Record pages and public pages carry a "do not index" instruction unless you give a third, separate permission. If you give it, your public page is added to a list we publish for search engines. If you withdraw it, we remove the page from that list and restore the instruction at once. Search engines act on their own schedule, which may take days or weeks, and we cannot hurry them. 6.7 Papers in Tillyard Research ------------------------------ A published paper is public and carries your name and college. Search engines may list it. That is the point of publishing, and the Author Agreement and Licence says so before you submit. You can end the licence by withdrawing the paper; the page then becomes a tombstone that keeps the title, the issue number and a notice, with no byline. If a paper has more than one author and one of them closes their account, the paper stays and that author's byline reads "a former member". 6.8 What members can see that the public cannot ----------------------------------------------- Signed-in members you meet can see your name, school and initials. In the Shop they can see your order ticket and, where you opted in, your coffee ring, your name on the sign, your mug on the shelf and whether you are in. None of that is visible to the public or to search engines. Activity is never shown with a time finer than a day, and there is no "last seen" for other members to look at. We do keep, for our own use, the last day you used the site (section 3.2). 6.9 Once something is public, copies can exist ---------------------------------------------- We limit bulk copying with rate limits, bot checks, hard-to-guess addresses and by never offering a "browse everyone" page. We cannot prevent it. Anyone who can open a public page can save it, a search engine can cache it, and an archive can keep it. Switching a page off stops us from showing it; it does not recall copies other people made. Think about that before you switch on the public page, the directory or search-engine listing, particularly if there is someone you do not want to be found by. 6.10 One switch for everything public ------------------------------------- "Switch off everything public" in your account withdraws the public page, the directory listing and search-engine listing in one action. It takes effect on the next request. Per-item links you set to "anyone with the link" are changed item by item on The Record, and published papers are withdrawn through Tillyard Research. 6.11 Your name in our own publicity ----------------------------------- We do not use a member's name or words in advertising, on social media or in press material without that person's separate written consent each time. Showing your own published paper or public page on the site, as you set it, is not publicity for this purpose. 7. Rooms and notes: screening, logging and who can read what ============================================================ The Messaging and Monitoring Notice is the detailed statement and governs. This section is the summary. 7.1 Not end-to-end encrypted ---------------------------- Nothing you type at a table, in a thread or in a private note is end-to-end encrypted. It travels over an encrypted connection and is stored on our hosting provider's systems, where the company is technically able to read it. Do not put anything here that must stay secret from the company. 7.2 Table chat -------------- Table chat is delivered straight away after a simple word filter. A line that trips the filter is not sent, and you are told so. Each delivered line is logged in the room. While the Shop is open, logged lines are sent to automated classifiers shortly afterwards. A line they hold is withdrawn from the table, its author sees that it was withdrawn, and a case is opened for a person to look at. Chat is switched off for a room if that check stops running. The log is kept for 14 days and then deleted. 7.3 Other text in the Shop -------------------------- Your one-line status, a table's label and a house-question answer are screened before anyone else sees them. 7.4 What screening is --------------------- Screening has two layers: 1. a word list that runs on our own servers, every time; 2. automated classifiers, when they are switched on and within their daily allowance. At the effective date these are a moderation service run by an outside provider and a safety model run by our hosting provider (section 9.1 names them). The classifiers receive the text being checked. We do not attach your email address, your account identifier or your IP address to it. The text itself can of course contain personal details if someone wrote them in, and a name you choose is itself checked. The result comes back as ok, flag or hold. A hold keeps the text visible only to its author and opens a case. Screening is a safety net. It misses things, and it sometimes holds things that are fine. We make no claim about its accuracy. 7.5 Private notes and threads ----------------------------- A note is screened before it is delivered. If it is held, the other person does not receive it and a case is opened. Notes are stored so that both sides can read the conversation later, for up to 12 months. You can delete your own messages. Deleting one removes it from the conversation for everyone in it. It does not remove a copy that was already saved into a case, or a copy the other person made. 7.6 When staff read member text ------------------------------- Staff do not read conversations to see what is being said. Section 6.2 of the Messaging and Monitoring Notice is the whole list and governs; this is the same list. Messages and threads. Staff can read a message, and up to ten messages either side of it, only when someone in the conversation reports it or automated screening flags or holds it. There is no staff screen for browsing or searching conversations. The owner can retrieve stored messages from the database only to answer legal process, to make an emergency disclosure or a child-safety report that the law allows or requires (section 15), or for the exact-match search for copies of removed material described in the Intimate-Image Removal Policy, and records each retrieval in the staff action log. Table chat. A member of staff may open a table's chat log only when: 1. someone reported it; 2. automated screening flagged or withdrew a line, or safety signals opened a case; 3. a case is already open, such as a dispute, an appeal or suspected fraud, and the log is likely to hold evidence that bears on it; 4. the law requires it, or an emergency calls for it (section 15); 5. you asked us to look at it; 6. a fault or a security incident cannot be dealt with any other way, and then as little as the problem requires. A reason is recorded before the log opens. The first time on any day that a member of staff opens a case's evidence, and each time one opens a table log or a member's page, an entry is written to the staff action log, which cannot be edited, including by the owner. Other member text. Text that is not a conversation, such as a draft, a profile or a Workbench account copy, reaches staff when it is reported, flagged, part of a case, or submitted to the editor, and otherwise as the row for it in section 3 says. Seeing the site as you see it. The owner can view the site as a particular member sees it, read-only, for up to ten minutes at a time. That view cannot open Messages, drafts, résumé copies or data pages, cannot join a room and cannot send or change anything. Each use needs a reason and is written to the staff action log. 7.7 What a report captures -------------------------- When a report is made, the system saves the reported item together with its surroundings so that later edits or deletions do not change the evidence: for table chat, the ten lines on either side at that table (for a two-person Fifteen, up to 200 lines), the table's topic and any call-link events; for a note, up to ten notes either side of it. It also saves the times, the room or thread, how old the accounts are, earlier report counts, screening results, and a keyed hash of the IP address with the browser type. 7.8 Your agreement, and withdrawing it -------------------------------------- The Terms of Use you accept when you join bring the Messaging and Monitoring Notice in by reference, and a few lines under the sign-up box say that rooms and messages are logged and screened. You are asked to agree directly, by a tick, the first time you order in the Shop (room logging) and the first time you open Notes (screening and the limited staff access to notes). A notice in each room repeats it. Section 12 of that notice gives the exact words of each screen. You can withdraw either permission under History in your account. Withdrawing closes that area for you until you agree again, because we do not run rooms or notes without the safety log. 7.9 No audio, no video, no recording ------------------------------------ Tillyard hosts no audio or video and records none. If a table's opener pastes a link to an outside call, that call happens on the other service. We cannot see it or log it, and our block and report controls do not reach it. 7.10 The desk in Tillyard Research --------------------------------- The first time you open the desk it tells you that it keeps your drafts, counts how much you type, delete and paste, and notes how long the editor is open. It also tells you that each time you paste, it keeps when you pasted, how long the passage was and the pasted words, up to 2,000 characters of each, and that pasted passages show highlighted to you, to the students who read your paper and to the editor. It asks you to agree, and asks again when that wording changes. It never records which keys you press. You can see all of it under History on the desk. It never decides anything by itself, and a person looks at anything Tillyard's checks flag before anyone acts. 8. Automated processing ======================= Several things here are done by software without a person deciding each time. We describe them so nothing is a surprise. - Screening. Described in section 7.4. It can hold an item. It cannot give a notice or a strike, apply the 24-hour mute, suspend or remove anyone. - Removed material. When a removal request is upheld, software can search stored text, including Messages and threads, for the exact link or text, and holds any later message that contains it. Staff see only the matches. - Reports. Reports are weighted by the reporter's account age and history and are capped per day, so a group cannot hide someone by reporting together. Enough weighted reports, or a report in an urgent category, can hide an item until a person reviews it. - Limits. Rate limits, daily caps and cost ceilings can refuse an action, such as a save or a message, until the window resets. New accounts have lower caps and cannot send links. When the site nears a daily ceiling it switches off optional features in a fixed order and keeps sign-in, reporting, the removal form and moderation running. - Matching. A paper is offered to members of the reading pool, drawn at random from other schools, who are not connected to the author and who may decline. Before one member is offered another's work to read or score, software compares keyed hashes of the network addresses the two accounts signed in from and drops the pairing if they match; a match can also raise a signal for a person to look at. Résumé-swap partners are paired from other schools. Your interests are used to suggest tables and people. A new room opens when the others fill up. - Eligibility. The email domain list, the age check and the yearly email check are applied by rule. If the yearly check lapses, the Shop, nods and new submissions pause until the address is checked again; your Record, tools and data are untouched. - Source checks. DOIs are looked up automatically, and a submission is compared with published papers and your own earlier submissions for identical sections. These inform the editor. They decide nothing. - Standing rules. For routine queues the owner can set a rule in place of deciding each case, such as adding a school when its domain is on a reference list. Anything decided by a standing rule is labelled as such in the staff action log. - Temporary safety measures. A "may be under 18" report pauses the account at once until a person has looked. Flooding the room connection can end that visit to the Shop for the evening. Three lines stopped by the word filter in one visit switch table chat off for you for the rest of that visit. An account may be paused by rule, without notice, when a corroborated child-safety report is made about it. - Care notices. A report that someone may hurt themselves can send that member a short private notice with support numbers. - Returning after removal. When someone joins, a keyed hash of their name and college is compared with those of accounts staff removed. A match only raises a flag for a person to look at; it never refuses, hides or pauses anything. What is never left to software: accepting a paper, granting or withdrawing a title, a notice or a strike, the 24-hour mute, a suspension, removing an account, an appeal, and a legal removal. A person, not software, decides every notice, 24-hour mute, suspension and removal for conduct. Software may hold an item, stop your table chat for one visit, or pause an account while a person looks, including a pause of up to 24 hours when activity looks like abuse; that pause ends by itself unless a person extends it, and it is not a finding. One closure happens by rule: an age re-check answered "under 18" or "high-school student", or left unanswered. We do not act on an AI-detector score. The closure by rule is not a finding about conduct: an account whose holder answers an age re-check by saying they are under 18 or a high-school student, or does not answer one in the time shown (currently 30 days), is closed as not eligible. We do not build advertising profiles, and we do not use what members write to train machine-learning models. If software has held something of yours or refused you something and you think it was wrong, use the appeal or dispute route shown with the notice, and a person will look. 9. Who we share information with ================================ 9.1 Companies that work for us ------------------------------ These providers handle information on our behalf, under their terms with us, to do the task named. The list is correct at the effective date above. Companies that work for us. Columns: role, provider, what it receives, notes. Role | Provider | What it receives | Notes ------------------------------------------ Hosting, database, live rooms, edge network and protection against attacks | Cloudflare | Everything the site stores, and every request to it, including IP addresses | Stored information is encrypted at rest by the provider Bot check on forms | Cloudflare Turnstile | Signals from your browser on the forms that use it: IP address, browser type and technical details of the connection | Cloudflare says these signals are used to detect bots and to improve that detection Email delivery | None yet: the site sends no email today. When it starts, Resend or Cloudflare | The recipient address and the content of each email we send | Our emails carry fixed wording, codes and links. No tracking pixel, no tracked links Text-safety classification | OpenAI's moderation service; a safety model on Cloudflare Workers AI | The text being checked (section 7.4), with no name, email address, account identifier or IP address attached | Used only when switched on and within a daily allowance. These are the named recipients of what members write; replacing or adding one is a change that matters (section 22) Payments | Stripe | Whatever the payer gives Stripe on Stripe's own pages | Stripe also acts on its own account under its own privacy policy. Our site sends Stripe nothing about you Gifts through a sponsor's page or the payments API | Stripe | The amount, what the gift is for, a reference number and the name the giver typed; the giver gives Stripe their card details on Stripe's own page | Never anything about a student. Off until the nonprofit can accept donations Reference look-up | Crossref | A DOI | Nothing about the member who asked Urgent alerts to the president's phone | A messaging or notification service (to be named here once chosen) | Counts of waiting items, due times, case and reference numbers, and check values from the staff action log | No names, email addresses or member text Backup copies | The place the weekly copy is kept (to be named here once the backup procedure is adopted) | A copy of the database | See section 13.1 for what we can and cannot yet say about how backups are protected The company's own mailbox | A mailbox provider | Email you send to our addresses | Each provider publishes its own statement of what it does with what it receives. The online version of this table links to each one. 9.2 Other members and the public, at your direction --------------------------------------------------- What you publish, share by link, say at a table or send in a note goes to the people that setting reaches. Section 6 explains each setting. 9.3 People involved in the same item ------------------------------------ - A co-author, teammate or fellow officer sees what the two of you are confirming about each other. - A reader sees a paper without the author's name. An author sees a reading without the reader's name. - A swap partner sees the anonymised copy of your résumé and your notes. - An outside confirmer sees the claim they are asked to confirm and the member's name. - If you dispute something, the member concerned is told what is disputed. - If you send a copyright notice, we may pass it to the member whose work is affected. If you send a counter-notice, the law requires us to pass it to the person who complained. 9.4 Authorities and legal process --------------------------------- See section 15. 9.5 A change of ownership ------------------------- If the company, this brand or its assets are sold, merged or reorganised, or the company is wound up, member information may pass to the successor as part of that. The successor would be bound by this notice for information collected under it. We aim to tell members before their information moves to a different company, so that anyone who wishes can close their account first. 9.6 With your consent --------------------- We may share information in another way if you ask us to or agree to it at the time. 9.7 Who we do not share with ---------------------------- - We do not sell personal information, and we have never done so. - We do not share it for advertising, including what California law calls cross-context behavioral advertising. - We do not give or sell lists, profiles or reports about members to employers, recruiters, colleges, data brokers or sponsors. An employer who wants to check a record uses the same public record page as anyone else, and sees only what the member chose to share. - Tips, larger payments and sponsorships buy no access to member information. 10. No advertising, no tracking, no analytics ============================================= - We show no advertising and have no advertising partners. - We load no third-party script, font, pixel or social widget. The one exception is the Cloudflare Turnstile bot check on the few forms that need it. - We use no analytics beacon, session replay or fingerprinting, and no advertising or cross-site cookie of our own. Our network provider may set a short-lived security cookie (Cookie and Storage Statement, section 4). - Our emails contain no tracking pixel, no click-tracking links and no remote images. - We do not collect information about your activity over time and across other websites. One other party can collect technical signals on our pages: Cloudflare, which runs the bot check on the forms that use it and says it uses those signals to detect bots across the sites it protects. No advertising or analytics company can. - Links out of the site are ordinary links. Links to Stripe are set so that your browser does not tell Stripe which page you came from. - Some printed posters and invitation links carry a label for where they were placed, so we can count totals. They carry no identifier for you. Because there is no cross-site tracking to switch off, the site behaves the same way whether or not your browser sends a "Do Not Track" or Global Privacy Control signal (section 18.5). The Cookie and Storage Statement lists the few first-party cookies and browser storage items the site does use. 11. Tips, larger payments and sponsorships ========================================== Tillyard cannot yet accept tips or gifts, and the donate page offers the early list instead (section 3.13). When tips open, the tip buttons will be ordinary links to payment pages hosted by Stripe. - On our site: nothing is collected or stored about a tip. No payment script runs on our pages, and nothing comes back to the site after payment that identifies you. - At Stripe: Stripe collects your payment details and email address and sends your receipt. Stripe handles that information under its own privacy policy. - What we can see: in the company's Stripe account, the owner can see your name, email address, the amount, the date and the limited payment details Stripe shows a business. We use that to issue refunds, answer you if you write, handle a bank dispute and keep tax records. - What we do not do: we publish no list of people who tip, we do not match them to member accounts, and tipping does not change anyone's standing here. - Refunds and chargebacks: if you ask for a refund or raise a chargeback with your bank, we record the date, amount and outcome against a ticket number in the staff console. We never record card details there. - Larger payments and sponsorships are arranged in writing through a short inquiry form that needs no account. Section 3.13 says what we keep. - Gifts through a sponsor's page or the payments API. A sponsor can start a gift from its own page, and a sponsor's own site or app can start one through our payments API. Either way the giver pays on Stripe's own checkout page and may add the card fee so the whole gift arrives. We keep the amount, what it is for and the name the giver typed, and Stripe tells us when it is paid (section 3.13). A gift goes to Tillyard's general use or a grant round and is used as the board decides; it is never set aside for a named student, and it buys no access to member information. A tip is a voluntary payment to Tillyard. We cannot yet say whether it is tax-deductible. The Tips and Larger Payments Terms govern refunds. 12. Email ========= - Essential email is sent whatever your settings: sign-in codes, security notices such as a new device or a changed passkey, and legal acknowledgements. - Notices tell you about a decision that concerns you: a paper, a title, a case, a dispute, a removal request. - Optional email is sent only if you asked for it: the weekly letter, reminders for tables you joined, "the shop is open". Each one has a one-step unsubscribe that works without signing in, and you can stop it under Notifications in your account. Unsubscribing takes effect in our system at once; the law allows up to 10 business days. - We do not send marketing email for other companies, and we do not rent or sell email addresses. - No member's own words appear in an email to anyone but that member. An email says "you have a new note" and links in. - Every email carries the company's legal name and postal address and says why you received it. - An outside confirmer who chooses "never email this address again" is added to a list we keep, as a keyed hash, so that we can honour it. 13. Security ============ 13.1 What we do to keep information secure ------------------------------------------ We describe these so you can judge them. We do not claim the site cannot be broken into; no honest site can. - You can sign in with a passkey, with a one-time code emailed to you, or with a password if you choose to add one. A password is optional. We keep it only as a salted hash that cannot be turned back into the password, and that cannot be attacked without a secret held outside the database. Emailed codes also prove you control your college mailbox at sign-up, recovery, the yearly check and an address change. Codes are single-use, expire within minutes, allow only a few attempts and are stored in scrambled form. - Your session lives in a cookie that scripts cannot read and that is sent only over an encrypted connection. We store a scrambled copy of the session token, not the token. - All traffic uses HTTPS. Stored information is encrypted at rest by our hosting provider. - Every request is checked against what that person is allowed to do, and the answer is "no" unless a rule says "yes". Addresses use random identifiers, never account numbers or email addresses. - Member text cannot contain HTML or scripts. Links in member text are shown as text. The only uploads are a figure in a paper and a receipt for a research grant: the server checks what each is from its bytes, it is stored under a random name, a figure is shown only to the people allowed to read the paper (the browser makes it smaller first), and a receipt only to the grantee and the owner. - IP addresses are kept in our database only as keyed hashes. - Forms that send email or accept input from people who are not signed in sit behind a bot check and rate limits. - The staff console opens only to a staff account after a strong sign-in with a password or a passkey. Staff actions are written to an append-only log in which each entry is chained to the one before, so a change would show. - We take a copy of the database about once a week and keep no copy longer than 12 weeks. - Staff can pause sign-ups, chat or publishing, or put the whole site into read-only mode, within seconds if something goes wrong. 13.2 What you can do -------------------- - Use a passkey on a device that is yours. - On a shared or library computer, tell the Workbench it is a shared computer so nothing is kept after the tab closes, and sign out when you finish. - Look at your device list from time to time and sign out anything you do not recognise. - Read the new-device and changed-passkey emails we send. If one is not you, act on it. 13.3 Reporting a weakness ------------------------- Write to security@tillyard.org. The site publishes a security contact file at /.well-known/security.txt. The Security and Vulnerability Disclosure Policy says how we handle reports. 13.4 Your college mailbox is part of your security -------------------------------------------------- A code sent to your college address can recover your account. Your college controls that mailbox, and some colleges forward, reassign or close addresses after students leave. Anyone who controls the mailbox can receive a code. To limit the damage, a session signed in by code alone is restricted: it cannot start a data export for 24 hours, sensitive changes need a passkey or a waiting period, and we notify the account in the app and by email. If you are about to lose your college address, move your account to a new one first under "Sign-in and school email". 14. If there is a security incident =================================== If we learn that personal information has been accessed or taken by someone who should not have it, we investigate, contain it and work out who is affected. - Notice the law requires. Where a state's breach-notification law applies, we will notify the affected people, and any regulator or agency that law names, in the way and within the time that law requires. Ohio's limit is 45 days from discovery; some states set theirs at 30 days. - Notice beyond that. Whether or not a law requires it, where we believe an incident creates a real risk to you or your account, we aim to tell you, by email and by a notice in the app, and to say what happened, what information was involved and what we suggest you do. - Law enforcement. We may delay a notice if a law enforcement agency tells us that notice would harm an investigation. 15. Legal requests, emergencies and referrals ============================================= The Law Enforcement and Legal Requests Policy is the detailed statement and governs. This section is the summary. 15.1 Requests from courts and government ---------------------------------------- We respond to valid legal process. Before we hand anything over, we check that the request is properly issued, is addressed to us, and asks for no more than the law allows. Federal law limits what a service like ours may disclose: - The contents of a note, a thread or table chat go to a government body only with a search warrant or another order the law accepts for content, with the consent of someone who was part of the conversation, or in an emergency of the kind described below. - Account records that are not content, such as a name, email address and sign-in times, may be required by a subpoena or court order. - In a civil case, we generally cannot hand over the contents of someone's messages in answer to a subpoena. The party who wants them should ask the account holder, who can export the messages they wrote. Where the law allows and it is practical, we aim to tell the member concerned before disclosing their information, so they can object. We may not do so where a law or court order forbids it, in an emergency, or where notice would defeat the purpose of protecting someone. We may keep information past its normal deletion date when we receive a lawful preservation request, and for as long as that request requires. 15.2 Emergencies ---------------- If we believe in good faith that an emergency involving danger of death or serious physical injury to someone requires disclosure without delay, we may give the relevant information to a law enforcement agency or other government emergency service without waiting for legal process. 15.3 Child safety reports ------------------------- If we become aware of apparent child sexual exploitation, federal law requires us to report it to the National Center for Missing and Exploited Children and to preserve what we reported for one year. We do so. The Child Safety Policy is the detailed statement. 15.4 Referrals -------------- Serious misconduct such as threats, stalking, fraud or impersonation may lead to permanent removal and, where appropriate and lawful, referral to law enforcement or your institution. "Your institution" means your college. We do not report members to their colleges as a matter of routine. Section 19.9 of the Terms of Use says what a referral may contain: a member's name, college and a factual description of what happened and what we decided, to which the member consents there. It never includes the contents of anyone's messages on that footing; contents leave the company only in the cases listed in section 17.9 of the Terms of Use. 15.5 Running the service and protecting the company's own rights or property ---------------------------------------------------------------------------- We may use information we hold to run the service, to enforce the Terms of Use and to investigate fraud or abuse. We may disclose information outside the company as necessarily incident to providing the service or to protecting the company's own rights or property, for example in confidence to our lawyers or our insurer, or to establish or defend a legal claim. This is not a general power to disclose the contents of messages in order to protect other members or the public: where a person's safety is at stake, section 15.2 is the case that applies, and the full list of when message contents can leave the company is in section 17.9 of the Terms of Use. 15.6 People who ask about someone else's account ------------------------------------------------ We do not discuss a member's account with a parent, a partner, a college or an employer without that member's consent or valid legal process. If a member has died, a person with legal authority over their affairs may write to privacy@tillyard.org to ask that the account be closed; we ask for evidence of that authority and do not give access to the account's contents. 16. How long we keep things, and closing your account ===================================================== 16.1 How we decide how long to keep things ------------------------------------------ We keep information for as long as it is needed for the purpose it was collected for, and then delete it, blank it or reduce it to a count. Short-lived things are short-lived by design: a coffee ring lasts 24 hours, table chat 14 days, an unkept visit 30 days. The tables in section 3 are meant to repeat the Data Retention Schedule line for line. That schedule lists every kind of record with its period and governs. The page "What we hold, and for how long" at tillyard.org/policies/data-inventory is built from the list the software itself uses when it exports or erases an account. Clean-up runs in batches, at least once a day. A record whose time is up is removed on a following run, usually in a day or two, and later if that day's work limits are reached. 16.2 Things you can delete yourself, now ---------------------------------------- Your own notes; a draft; a self-reported Record item; a house-question answer; a kept receipt; account copies of Workbench documents; everything the Workbench keeps in your browser; your interests and profile text. 16.3 Closing your account ------------------------- 1. You confirm with a fresh sign-in. At once you are hidden everywhere, signed out on other devices, and nothing new can reach you. 2. For 14 days you can change your mind. Signing in shows only the closing date, "Keep my account" and "Download my data". Nothing is erased during those days, and everything remains reportable. 3. After 14 days the erasure run starts. It usually finishes in a day or less. It can be put on hold while an urgent report involving the account is open, or under a legal hold. Erased: your name, email address, school, profile, interests, settings, passkeys, sessions, notices, connections, the blocks you placed, your own view of your notes and threads, drafts, shop history, stamps and keepsakes, self-reported items, directory entry, open counts and account copies of Workbench documents. Your lines of table chat that are still inside the 14-day log are blanked, name and text. Left as a blank: your seat in a conversation shows only that a member left, and a reading you wrote of someone else's paper reads "a former member". The text of the notes and thread messages you sent is removed when your account is erased. The other people's own messages stay. A paper you wrote alone is withdrawn and its page says so. Your record links read "no longer listed" and show no name. A finished favor stays in the other person's history without you in it. Kept, and why: - the staff action log, which holds identifiers and reason keys and never names, email addresses or text, for as long as Tillyard operates, so that decisions can be checked. It cannot be edited or pruned. It includes the entry made each time you agreed to a document. Once your account is erased, nothing in the live database connects your identifier in the log to your name or address; - a record that the erasure ran, with identifiers and dates, for 24 months; - case files that involve you, for the periods in section 3.10 (12, 24 or 36 months), because other members' safety and the company's ability to answer a later complaint depend on them; - if staff removed the account, a keyed hash of its name and college, for 24 months; - what other members' records rest on, without your identity: a reading, a look or a score you gave, your blind answers about a project, and your confirmation of an officer's role; - the dated record of what you agreed to, for 24 months; - the fact and date of any privacy request, removal request, copyright notice or dispute you sent us, for the periods in the Data Retention Schedule, with your contact details erased where that schedule says so; - the bare record of an age re-check, with no birth date in it, for 36 months; - any refund or chargeback entry in the payments log, for 7 years; - a blanked row for any title the editor signed for you, kept as a count with no name and no sentence; - a keyed hash of your email address, as described in 16.4; - anything under a legal hold, or that a law requires us to preserve; - nameless markers for your record pages, for 36 months, so that a link on an old résumé says "no longer listed" and does not fail. The letter you tick when you close your account lists the same things. 16.4 Why a scrambled copy of your email address outlives your account --------------------------------------------------------------------- Without it, a person who was blocked or removed could close their account and come straight back. So when an account is erased we keep a keyed hash of its email address, never the address: - for 90 days, if the account was in good standing; - for 24 months, if other members had blocked the account or a report about it was open; - for 36 months, if staff had removed the account. During that time, joining again with the same address brings back the same blank record, so blocks and case history still apply. An account in good standing can re-join after a 14-day wait. A removed account cannot. This has a limit. It recognises one email address, for the period shown. After that period, or at once with a second college address, a removed person could try to join again. The keyed hash of name and college in section 3.10 can raise a flag for a person to look at, for 24 months. We cannot prevent a person from returning under a different address, and we act when we learn of it. Where our documents say an account is "removed permanently" or that a person "may not join again", that is a rule for the person removed; it is not a promise to other members that the person cannot come back. 16.5 Accounts removed by staff ------------------------------ A removed member can still sign in to download their data, withdraw permissions and close the account. If they do not, the account's data is erased automatically 12 months after removal. 16.6 Accounts that go quiet --------------------------- If your yearly email check lapses, the Shop, nods and new submissions pause, and your Record, tools and data stay as they are. We do not currently delete accounts for being inactive. Account copies of Workbench documents are deleted after 24 months without a sign-in, and a draft paper after 12 months untouched, each after a warning. 16.7 Backups ------------ Backups hold older copies of the database. We take a copy about once a week and keep no copy longer than 12 weeks. Our hosting provider also keeps recovery copies for a period set by our plan, never more than 30 days. Information you deleted can therefore persist in a backup for that long. Table chat is held in each room's own storage and is not in the weekly copy. Nothing in a backup is shown on the site, and we do not restore individual records from backups to undo a deletion. If we ever have to restore the whole database, we aim to re-apply the deletions and removals made since that backup before the site reopens. 17. Your choices and rights =========================== 17.1 Offered to everyone ------------------------ Some US states give their residents privacy rights by law, but those laws mostly apply to much larger companies than this one. We offer the following to every member, wherever they live, as a matter of our own practice. Where a law does apply to us and gives you more, you have that too. Offered to everyone. Columns: what you can do, how. What you can do | How --------------------- See what we hold | The privacy page lists every switch that affects who can see you. History lists every permission and account event. "Your data" builds a copy of what is tied to your account. The Account Deletion and Data Export Policy, section 3.6, lists what it leaves out Take a copy | "Start an export" under Your data. Your browser assembles one JSON file from every part of the site. Nothing is emailed and no copy is kept on our servers. The export stays open for 30 minutes. You can start two in any 7 days Correct it | Edit your profile, settings and items directly. A name can be changed twice a year; a complete change on an account that holds a title waits for a staff check. For anything you cannot edit, use the dispute and correction form Delete it | Delete individual items (section 16.2), or close your account (section 16.3) Withdraw a permission | History in your account, one at a time, or "Switch off everything public" for the public ones Stop optional email | The unsubscribe link in the email, or Notifications in your account Limit who can reach you | Choose who may nod to you; block or mute anyone Ask a person to look again | Appeal a moderation decision once, or dispute a record, through the routes in the Reporting, Enforcement and Appeals Policy and the Disputes and Corrections Policy Ask us anything else about your information | Write to privacy@tillyard.org A paused, suspended or removed member can still download their data, withdraw permissions, stop email and close their account, except while a child-safety or age matter or a legal hold covers the account (section 6 of the Account Deletion and Data Export Policy). In those cases the export and the closing wait. An export also cannot be started while the whole site is in read-only mode. 17.2 If you are not a member ---------------------------- Write to privacy@tillyard.org or use the dispute and correction form. You can ask what we hold that names you, ask us to correct or remove it, withdraw a confirmation you gave, ask us never to email an address again, or ask to be taken off a waiting list. Before we act, we confirm that the email address involved is yours by writing to it. 17.3 Making sure it is you -------------------------- Requests made inside your account need a recent sign-in, and the most sensitive ones need a passkey. For a request by email we confirm it is you by sending a code to the address on the account. We do not ask for identity documents. If someone acts for you, we ask for your signed permission, or evidence of their legal authority, and may confirm with you directly. 17.4 Timing ----------- Most choices take effect at once because you make them yourself. For a request by email, the state laws written for larger companies generally allow 45 days, and we aim to answer within that time and to say so if we need longer. 17.5 What we may decline, and what we may keep ---------------------------------------------- We may decline a request, or keep some information after a deletion request, where: - we cannot confirm the request comes from the person concerned or someone entitled to act for them; - the information is in the staff action log, a case file, a consent record or the keyed hash described in 16.4, for the periods stated; - a law requires us to keep it, or it is under a legal hold or a preservation request; - it is needed to establish or defend a legal claim, or to investigate fraud, abuse or a security incident; - deleting or disclosing it would expose another person's information, such as who reported something or who read a paper; - it is someone else's content that mentions you. That is handled through the dispute and correction form; - it is part of a paper published with co-authors, or of a published correction or withdrawal notice; - the request is one of a repeated or clearly abusive series. We cannot change a score a reader gave or rewrite a decision that was made, though a correction can be recorded beside it. If we decline, we say so and say why, unless the law prevents us. 17.6 If we say no ----------------- Reply to our answer, or write to privacy@tillyard.org with "Privacy appeal" in the subject line, and say what you think we got wrong. A person will look at it again and reply in writing. In a company run by one person, that may be the same person who made the first decision. If you are still not satisfied, you can complain to your state's attorney general or to the Federal Trade Commission (section 23). 17.7 No penalty for using these choices --------------------------------------- Using any choice or right in this notice never costs you your standing, your Record or access to any tool. Some choices have natural consequences that we tell you about first: withdrawing the Notes permission closes Notes for you, and closing your account ends your Record. 18. California ============== 18.1 What California's online privacy law asks every site to state ------------------------------------------------------------------ - The categories of personal information we collect, and the categories of others we share it with, are in sections 3 and 9. - You can review and change your information as described in section 17. - We tell you about changes to this notice as described in section 22. - The effective date is at the top. - We do not collect information about your activity over time and across other websites. One other party can collect technical signals on our pages: Cloudflare, which runs the bot check on the forms that use it and says it uses those signals to detect bots across the sites it protects. No advertising or analytics company can. See also 18.5 and the Turnstile row in section 9.1. 18.2 The California Consumer Privacy Act ---------------------------------------- That Act applies to businesses above certain sizes: annual revenue above roughly 26.6 million dollars, or handling the personal information of 100,000 or more California residents or households, or earning half or more of their revenue from selling or sharing personal information. We are far below each of those, so the Act does not currently apply to us. If that changes, we update this notice. We still give California residents the information the Act would require at the point of collection, in 18.3, and we offer everyone the choices in section 17. 18.3 Notice at collection ------------------------- Notice at collection. Columns: category, as California law names it, what we collect in that category, sold, or shared for advertising. Category, as California law names it | What we collect in that category | Sold, or shared for advertising ------------------------------------------------------------------------------ Identifiers | Name, college email address, account identifiers, session identifiers, IP address (kept by us as a keyed hash) | No Customer-record information | Name; the school and graduation year you give; an electronic signature on a removal request or copyright notice | No Characteristics protected by law | That you are 18 or over, with no birth date | No Commercial information | None on our site. Stripe holds tip records; we keep a ticketed log of refunds and bank disputes | No Biometric information | None | Not applicable Internet or other network activity | Sign-in and device records, request logs, rate counters, bot-check results, open counts that are not tied to any visitor | No Geolocation | None that is precise. A time zone if you set one | No Audio, visual or similar information | None | Not applicable Professional or employment-related information | Résumé and tracker content, only if you keep account copies. Roles and projects recorded on The Record | No Education information from school records | None. We receive nothing from your college | Not applicable Inferences | No profiles. A small number of safety signals (section 3.10) and suggestions drawn from interests you picked | No Sensitive personal information | The contents of private notes and threads, which we carry and screen but are not the intended reader of | No. Used only to provide the service and keep it safe, never to infer characteristics about you Why we collect it: to run your account and the areas of the site you use; to show what you chose to publish; to keep members safe and the site secure; to meet legal duties; and to keep records of what was agreed and decided. Section 3 gives the purpose for each item. How long we keep it: section 16 and the Data Retention Schedule. Selling and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising. We have not done either in the past 12 months, including for anyone under 18, and membership is limited to adults. 18.4 "Shine the Light" ---------------------- California residents may ask a business whether it has disclosed their personal information to others for those others' direct marketing. We do not disclose personal information to anyone for their direct marketing. You may still write to privacy@tillyard.org or Tillyard, 10602 York Rd SW, Etna, Ohio 43062 to ask. 18.5 "Do Not Track" and Global Privacy Control ---------------------------------------------- Some browsers can send a "Do Not Track" or Global Privacy Control signal. We do not track you across sites, sell your information or share it for advertising, so today there is nothing for the signal to switch off, and the site behaves the same with or without it. The site is built to treat the signal properly if that changes. Cookies and similar tools fall into three groups: needed to run the site (always on), analytics, and advertising. Analytics and advertising stay off until you allow them, in the cookie banner or under "Your privacy choices" in the footer of every page, and we use neither today. A Global Privacy Control signal is treated as a no to advertising whatever else you choose, and the choices panel says so. Pages you see while signed in load neither group. Section 3.3 of the Cookie and Storage Statement has the details. 18.6 Removing your own posts ---------------------------- California gives people under 18 a right to remove what they have posted. Membership here is limited to adults, but every member can delete their own posts and items as described in section 16.2. 19. Other states ================ 19.1 State privacy laws in general ---------------------------------- Many states now have consumer privacy laws: among them Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Most apply only to companies that handle the information of tens of thousands of residents or earn substantial revenue from selling it. We are below those sizes. Ohio, where the company is based, has no such law. Whatever your state, we offer you by our own choice the rights those laws typically give: to confirm what we hold and get a copy, to correct it, to delete it, to take it with you in a portable form, to withdraw consent, and to have a refusal looked at again. Section 17 says how. Those laws also give a right to opt out of three things: the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of the three, so there is nothing to opt out of. 19.2 If we refuse and you want to take it further ------------------------------------------------- After the second look described in 17.6, you can contact your state's attorney general. Where your state's law applies to us, that is the route it provides. 19.3 Nevada ----------- Nevada residents may ask a website operator not to sell certain information about them. We do not sell it and have no plan to. You can still send a request to privacy@tillyard.org. We will respond to a request we can confirm is yours within 60 days, as Nevada law requires. 19.4 Information some states treat as sensitive ----------------------------------------------- Some state laws apply to any company, whatever its size, that handles information they class as sensitive, and they require consent for it. We offer no field that asks for information of that kind. We do not ask members about their own health. A safety report, such as one in the "worried about someone" category, may describe someone's wellbeing; we use it only to respond to that report. If you or someone else mentions health in free text, we use it only to deliver that text. 19.5 Texas ---------- Texas exempts small businesses from most of its privacy law but forbids them to sell sensitive personal information without consent. We sell no personal information of any kind. 19.6 Biometric laws ------------------- Illinois, Texas and Washington restrict the collection of biometric identifiers. We collect none. When you use a passkey, any fingerprint or face check happens on your own device and we receive only a cryptographic confirmation. 19.7 States where we are not yet open ------------------------------------- Schools in Tennessee and Mississippi are not on our list at opening. A sign-up from a college in those states is declined politely, and you may leave your email address to be told when that changes (section 3.13). 20. Children and anyone under 18 ================================ - Accounts are for people aged 18 or over. The site is not directed to children, and we do not knowingly allow anyone under 18 to hold an account. - People under 18 can use our public forms, for example to ask us to remove an intimate image or to dispute something that names them, and we then hold what they send us to deal with that request. A tip paid by someone under 18 is refunded whenever we are asked. - A person who enters a birth date under 18 at sign-up gives us that date for the moment it takes to check it. We do not keep the date. We may keep a keyed hash of the email address for up to 30 days so the form cannot simply be tried again. - If a birth date under 18 is entered at sign-up, the sign-up stops and no account is created (section 5). - If we learn, or have good reason to believe, that a member is under 18, we pause the account at once. If it is confirmed, we remove the account and erase its data without the usual 14-day wait. We keep the case record, with no birth date in it, anything the law requires us to preserve, and the limited records that outlive any closed account (section 16.3). The Child Safety Policy is the detailed statement. - If we learn that we hold personal information from a child under 13, we delete it as soon as we reasonably can, subject to the same legal duties to preserve. - A parent or guardian who believes their child has an account here should write to privacy@tillyard.org. We ask for enough to find the account and do not disclose its contents. 21. People outside the United States ==================================== Tillyard is offered only to students and recent graduates of colleges in the United States. Sign-up accepts only email domains on a list of US colleges, and nothing here is marketed to people in other countries. - The site is run from the United States, and its information is processed there. Our hosting provider's network is worldwide, so a request made from another country is first handled by its equipment near you. - If you use the site while travelling or studying abroad, your information is sent to and processed in the United States, whose privacy laws may differ from those where you are. - We do not aim the service at people in the European Union, the United Kingdom or any other country, and have not set it up to meet their privacy laws. If you live outside the United States or are not a student or recent graduate of a US college, please do not join. If we learn an account does not meet the eligibility rules, we may close it. - If you are outside the United States and are not a member. If you use a public form, confirm something for a member or leave a tip, we handle what you give us only for that purpose, in the United States, and you can ask us to delete it at privacy@tillyard.org. An outside confirmer's name and role are shown publicly only where the member shares the item, and you can withdraw the confirmation or hide your name from the receipt page or by writing to us. Section 3.13 lists what we hold in each case. 22. Changes to this document ============================ - The version number and effective date are at the top. Earlier versions stay available, each at its own address. - For a change that matters, such as a new kind of information, a new purpose, a new or replacement provider that receives what members write, or a longer retention period, we tell members in the app and by email before it takes effect, in the way the Terms of Use set out for important changes. - If a change would let us use information we already hold in a materially different way from what we said when we collected it, we will ask for your agreement before applying it to that information. - Corrections of wording, a provider replaced by an equivalent one that does not receive what members write, and changes that give you more protection may take effect when published. A new or replacement provider that receives member text is always a change that matters. - If you do not agree with a change, you can close your account before it takes effect. 23. Contact and complaints ========================== Write to us first; most things can be put right quickly. - Privacy questions, requests and appeals: privacy@tillyard.org - Post: Tillyard, Privacy, 10602 York Rd SW, Etna, Ohio 43062 - General help: support@tillyard.org - Security: security@tillyard.org - Accessibility, including this notice in another format: accessibility@tillyard.org If you are not satisfied with our answer, you can complain to the attorney general of your state, to the Ohio Attorney General's consumer protection section, or to the Federal Trade Commission at reportfraud.ftc.gov. You do not have to come to us first, though we would like the chance to fix it.