How e2er.org handles personal data
e2er.org keeps what sign-in, credit and the review of contributions need, stores it in the European Union, and never receives your research data, your papers or your keys for AI providers: those stay on your machine.
As of 2026-10-05.
Controller
The person named in the Impressum, c/o Impressumservice Dein-Impressum, Stettiner Straße 41, 35410 Hungen, Germany. Email: hello@e2er.com.
What is kept, why, and for how long
| Data | Purpose | Kept |
|---|---|---|
| Email address, name, ORCID iD, GitHub login | Your account, sign-in, credit on your work | Until you delete the account |
| Password (only as a salted scrypt hash), two-step secret and recovery codes, the sign-in key that GitHub or ORCID hands over | Sign-in | Until you change them, remove that sign-in method or delete the account |
| Sessions and command-line tokens (tokens only as a SHA-256 hash); the browser name of a session, no IP address | Staying signed in; the list of devices on your account page | A session ends 30 days after its last use and a token 90 days after its last use. Signing out or ending a session deletes it. Ended sessions and withdrawn or expired tokens stay in the database, without effect, until you delete the account |
| Your IP address, together with the request it made to the account service (sign-in, sign-up, session checks and similar) | Limiting how often such requests can be made | Deleted once the longest limit window (one hour) has passed, the next time a limit is checked |
| Failed sign-in attempts per address (as a hash) | Locking password sign-in after 10 failures | Deleted by the next successful sign-in, a password reset or the deletion of the account; after 15 minutes the count starts again |
| Your researcher profile: your name, your GitHub login or ORCID iD when you sign in with them, the date you joined, and what you publish or contribute. Never your email address | Letting other researchers find you: the People page, the site search, the sitemap and your profile page at e2er.org/<your GitHub login> | Made with the account and shown by default. "Show my profile on e2er.org" on the account page hides it: a hidden profile has no page and is not listed, searched or in the sitemap, while your published work still names you. The public export of e2er.org names a profile only once work credits it, and a hidden one by name only. Until you delete the account; an empty profile then disappears |
| What you publish or contribute: study descriptions, templates, specialists, skills, connectors, evaluations, comments, proposals, failure reports | The public list of research and the credit that follows your work | Public and citable; when you delete your account your name is replaced by "Former member" |
| Requests you send to the authors of a study, with your message | Letting the authors see and answer the request | Until you delete the account; the notification and the email the authors received about it go with it |
| Notifications on e2er.org | Telling you about decisions, comments, requests and reports | Until you delete the account |
| Messages addressed to you by email (security notices, requests to authors), with subject and text | e2er.org sends no email at the moment; these messages are stored in the database and not delivered | Until you delete the account |
| Records of maintainer and admin actions (audit log) | Accountability for decisions | Kept without a time limit; when you delete your account, the link to it is removed from these records |
| Notices about content (Digital Services Act), with the contact you give | Handling the notice and showing that it was handled | Kept without a time limit |
| Reviewer workspaces (no name, no email address) | Journal reviewers trying the platform | Until the access code expires or is withdrawn |
| Attempts to enter a reviewer access code, counted per network address and per code (both as one-way hashes, never the address or the code) | Limiting guessing: at most 10 attempts an hour | Deleted after an hour, the next time a code is entered |
Backups
The database can be restored to any minute of the last 7 days (Cloudflare D1). In addition, the whole database is copied every night, encrypted, to storage operated by the controller: each nightly copy is kept 30 days, and the first copy of each month 12 months. Data you delete therefore stays in these copies until they expire.
Legal bases
Your account and what you do with it rest on the agreement to provide the service (Art. 6(1)(b) GDPR). Security measures such as the sign-in lock and the audit log rest on the legitimate interest in a safe service (Art. 6(1)(f) GDPR). Handling notices about illegal content follows the Digital Services Act (Art. 6(1)(c) GDPR).
Who else processes data
e2er.org runs on Cloudflare: the pages and the database (created with EU jurisdiction, so data is stored and processed in the European Union). Cloudflare processes connection data (IP address, time) to deliver the pages and keeps the site's request logs for 3 days; see the Cloudflare privacy policy. Cloudflare acts as processor under its Data Processing Addendum, which is part of the Cloudflare terms of service.
If you sign in with GitHub or ORCID, you choose that service; it tells e2er.org who you are. When you choose a password, its first five hash characters are checked against the Have I Been Pwned list of breached passwords; the password itself never leaves e2er.org.
e2er.org uses no analytics or page-view counters and loads no scripts from other sites.
Cookies
e2er.org sets one cookie for your session when you sign in, and one for a reviewer workspace when you enter an access code. Both are needed for the service; there is no advertising and no tracking across sites. The site remembers your choice of light or dark theme in your browser.
Your rights
You may see, correct, export and delete your data. The account page downloads everything e2er.org keeps about you and deletes the account; your published work stays citable under "Former member". You may also object to processing, ask for it to be restricted, and complain to a data protection authority, for instance the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit). For anything else, write to hello@e2er.com.