Privacy policy

Peptide Atlas is published by the operator named in the “Who runs this site” section near the end of this page. If that section is not shown yet, the operator’s details are still being added; until then, you can reach us through the contact form.

• You can read the whole site without an account, and we do not offer accounts.
• We do not use analytics, advertising, tracking pixels, or social media widgets, and we do not set cookies for readers. See the cookie policy.
• We keep personal information only when you send it to us through the contact form. Search words are not saved.
• We do not sell personal information, and we do not share it for targeted advertising.

When you use the contact form, we store:

• the topic you choose;
• your email address;
• your message;
• the content ID of a page (PA-####), if you enter one;
• the address of the page on this site you were reading before you opened the form, if any (the form sends this automatically). We keep only the page’s own address: search words and anything else after a “?” or “#” are removed before your message is stored.

To prevent abuse, we store a coded version of your IP address with your message: a keyed hash that changes every day. It lets us notice repeated abuse from one connection on the same day without keeping the address in readable form. We do not store your IP address itself in our database.

When you search the site, your search words are used only to find matching pages. We do not save them, and they are not linked to you. That includes the contact form: if you open it from a search results page, your search words are not stored with your message.

Rate limits. To stop automated abuse, the contact form and site search count requests per connection, keyed by the same daily-changing hash. These counters expire automatically within an hour.

When you visit any page, our hosting provider handles the technical information every web request carries — such as IP address, browser type, the page address requested, and the time — to deliver the page and protect the service. This appears in the provider’s standard request logs. Because a search is part of the page address, it can appear in those logs too.

We use what you send us only to read and answer your message, to fix errors you report, to handle privacy requests, and to keep the form and search free of spam and abuse. We do not add you to a mailing list — the site has no newsletter — and we do not use your message for advertising or profiling.

We do not ask for health information, and we do not answer personal medical questions. Please leave medical records, diagnoses, and other sensitive health details out of your message. If you include them anyway, we use them only to handle your message, and you can ask us to delete it.

These providers run parts of the site and process data on our behalf to deliver their service:

• Vercel — hosting and the site’s server functions, in Vercel’s US East region.
• MongoDB Atlas, on Amazon Web Services (us-east-1) — the database where contact messages are stored.
• Vercel Blob — storage for the site’s images. It holds site content, not reader information.

We do not use an email service today: messages are stored in the database and read by staff in the site’s admin, and they are not forwarded by email. If we add email notifications later, they will tell staff only that a message arrived, its topic and any content ID you entered — not your message or your email address — and this page will name the provider first.

Fonts are served from our own domain, and images are delivered through the site’s own image service, so reading a page does not send requests to Google or other third-party content providers. When you follow a link to another website, your browser tells that site only that you came from our domain, not which page you were reading.

The site and its database run in the United States. If you write to us from another country, your message is stored and processed in the United States.

• Contact messages are kept while we handle them, and afterwards only as long as needed to keep a record of the correction or request. A fixed retention period has not been set yet; the operator will add it to this page. You can ask us to delete your message at any time.
• The coded IP value is stored with your message and deleted with it. Our internal audit log notes that a contact message was created — its record number and the names of the fields filled in, not their contents and not the coded value; that note is kept for as long as the operator retains the log. Because the key changes every day, the value cannot be matched to the same connection on later days.
• Search words are not saved.
• Rate-limit counters for the contact form and search expire automatically within an hour.
• Hosting request logs are kept by our hosting provider for the period its service sets.

You can ask us to:

• tell you what information we hold about you, and give you a copy;
• correct information that is wrong;
• delete your information;
• once optional analytics exist, stop any optional measurement (see below).

To make a request, use the contact form and choose Privacy request. Write from the email address you used before, so we can find your messages; we may need to confirm that the address is yours before we act. We will reply by email. Depending on where you live, the law may give you further rights — you can name them in your request.

We plan to add optional, first-party analytics to understand which pages are read and useful. It is not live. When it launches:

• it will stay off until you choose Accept optional analytics on a consent banner, which will also offer Reject optional analytics and Customize;
• you will be able to withdraw your consent at any time on the privacy choices page;
• a Global Privacy Control signal from your browser will be treated as a rejection;
• message text, email addresses, full IP addresses, and search queries will not be part of analytics.

This policy and the cookie policy will be updated, with a new version and date, before optional analytics starts.

This site is written for adults. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has sent us information, contact us and we will delete it.

Connections to the site use HTTPS. Stored messages can be read only by signed-in staff whose role includes handling requests. No system is perfectly secure, so we keep what we store to a minimum.

When this policy changes, we update the version number and effective date at the top of the page and describe the change in the update log at the end.