Privacy

• Your reads and results. The FASTQ files you upload, and anything you add to a run (a sample sheet, expected sizes, configurations, and design sequences you compare a sample against), together with the sequences, annotations and reports the pipeline produces from them. With an account, also the reference sets you save.
• An account, if you make one. Your email address and a hash of your password (never the password itself), or, if you sign in with GitHub, your GitHub account's ID and verified email address, plus the time and internet address of your last sign-in.
• Internet addresses, briefly. The server holds your internet address (for IPv6, its /64 network) for a short time to limit no-login runs to one at a time per address, to slow repeated failed sign-ins, to limit how many accounts one address can create (5 a day), and to rate-limit share-link lookups. These records expire on their own. For a no-login run, the address is kept with the run's raw reads and deleted with them.

Every step of the analysis runs on the server that hosts this site. Your reads and results are not sent to any other service.

One file makes a request elsewhere: the interactive plasmid map (.plasmid_map.html), yours or the example's, downloads rather than opening on this site. When you open the downloaded file, it loads its plotting library from the Bokeh project's servers (cdn.bokeh.org), so your browser contacts that site; the map's data stay in the file. Reports and every other page load nothing from other sites. Signing in with GitHub goes through GitHub's own sign-in page.

• With an account: raw reads are kept for 7 days after a run finishes, and results for 30 days.
• Without an account: raw reads are kept for 24 hours after a run finishes, and results for 7 days.
• An upload that is never submitted is deleted within 12 hours.
• A design you upload to compare a no-login sample against is kept with that run and deleted with it.
• Reference sets and configurations saved to an account are kept until you delete them, and the account until you ask for it to be removed.
• The annotation cache keeps pLannotate's output for each plasmid sequence, so the same plasmid is not annotated twice. An entry holds the annotated sequence and is deleted once it has gone unused for 30 days, whether or not the run it came from still exists. The cache is shared by everyone on this server: the same sequence always gives the same annotation, so no one sees your plasmid through it, but a sample that annotates unusually quickly shows that this exact sequence has been annotated here before.
• When its results period ends, a run and its files are deleted automatically. With an account, you can delete your own runs sooner from the console.

• Share links. Every run and every report has its own share link. The links are long and random, so they cannot be guessed, but anyone you pass one to can open what it points to, until the run is deleted.
• With an account, your runs are listed only in your own console; other people can see a run or report only through a share link you give them.
• Without an account, your run page is itself a share link: keep it private if the data is.
• The server's administrators can see every run, to operate and support the service.

If you sign in, one essential cookie keeps you signed in, for up to 30 days. Your browser also remembers that you dismissed the cookie notice. There are no analytics, advertising or other third-party trackers.

To ask about your data, or to have your account and runs removed sooner, email contact@plasvalidate.com (also on the contact page).