Privacy Policy

Definitions

• Personal Data (or "Personal Information") means any information that relates to an identified or identifiable natural person. We use the terms interchangeably unless a specific law requires otherwise.
• Usage Data means data collected automatically through the operation of the Service, such as IP addresses, browser type, pages visited, and visit timestamps.
• Cookies are small data files stored on Your device by a website.
• You means the individual accessing or using the Service.
• Service refers to the tau website, accessible at tau.sigscape.org.

Information We Collect

Usage Data (Automatically Collected)

When You visit tau, Our hosting and DNS/security providers (Vercel, Inc. and Cloudflare, Inc.) automatically collect standard server log and network information, including:

• IP address and approximate region derived from it
• Browser type and version, and operating system
• Pages and files requested, with timestamps
• Referring URL, where one is sent by Your browser

This data is collected to ensure the reliable operation of the Service and to monitor for abuse. We do not operate any analytics service (such as Google Analytics) beyond what Vercel and Cloudflare collect as part of standard hosting and network infrastructure.

Personal Data

tau does not require You to create an account, provide an email address, or submit any personal information. There is no login, no registration, and no contact form. We do not collect names, email addresses, or other directly identifying information through use of the Service.

Genomic and Scientific Data

The Service is read-only. Every value and figure it displays is pre-computed from data released by the PCAWG project and is served as static content. The Service provides no facility to upload, submit, or process Your own data, so no user-submitted data of any kind — genomic or otherwise — reaches Our servers.

Cookies and Local Storage

tau uses one cookie and one local storage item of its own, both strictly functional and both concerned with the same thing: which theme You picked. Our network provider sets a small number of further cookies for security and bot protection. We use no advertising cookies, no remarketing cookies, and no third-party tracking cookies of Our own.

All items listed above are strictly necessary for the functionality they support — display preferences and security/bot protection. None are used for analytics, advertising, or tracking. Because they are essential to the operation of the Service, they fall within the "strictly necessary" exemption under Article 5(3) of the ePrivacy Directive and equivalent legislation. No consent banner is therefore displayed.

How We Use Information

The limited information We collect is used exclusively to:

• Operate, maintain, and secure the Service
• Diagnose faults and monitor for abuse or excessive automated load
• Understand aggregate usage patterns, such as which parts of the catalog are consulted

We do not use any collected information for advertising, marketing, profiling, automated decision-making, or any commercial purpose. We do not sell, rent, or trade Your information to any third party.

Client-Side Features

The per-sample viewer is a self-contained document that runs entirely in Your browser:

• Interactive plots Panning, zooming, selecting a chromosome or a copy-number state, and toggling tracks are all performed locally by the plotting library bundled into the viewer. No request is made to Our servers as You interact with a figure, and no record of what You looked at within it is sent anywhere.
• Plot export The viewer's camera control saves the current figure as an image file. It is generated in Your browser; nothing is uploaded.
• URL state The sample You are viewing is part of the page address, so browser navigation and link sharing work. The address contains a sample identifier from the public catalog and no personal data.

Third-Party Services

Cloudflare (DNS, Security, and CDN)

The tau.sigscape.org domain is managed through Cloudflare, Inc., which provides DNS resolution, TLS/SSL termination, DDoS protection, and bot management. When You access tau, Your request is routed through Cloudflare's global network before reaching Our hosting provider. Cloudflare collects End User log data — including IP addresses, HTTP request headers, and traffic metadata — to operate and secure its network, and may set the cookies described in the "Cookies and Local Storage" section above. Cloudflare processes this data as a data processor on Our behalf. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy and their cookie policy at cloudflare.com/cookie-policy.

Vercel (Hosting)

tau is hosted on Vercel, Inc. After passing through Cloudflare, requests are served by Vercel's infrastructure, which collects the standard server logs described above. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

Viewer File Storage

The per-sample viewer files are large and may be served from a separate object storage origin operated on Our behalf rather than from the application host. Where that is the case, that provider receives and logs the request for the file in the same way a hosting provider does, and processes it as a data processor on Our behalf.

Web Fonts

tau uses the Outfit typeface. It is downloaded at build time and self-hosted on Our infrastructure. No request is made from Your browser to Google's servers when You visit the Service.

External Links

The Service links to external resources such as sigscape.org, laboratory websites, GitHub, and data portals. We have no control over and assume no responsibility for the privacy practices of these external sites.

Data Retention

Server logs retained by Our hosting and DNS providers are subject to Vercel's and Cloudflare's respective data retention policies. We do not independently store, archive, or process server logs beyond what these providers retain in the ordinary course of providing their services.

The sigscape-theme cookie expires after 1 year. The theme local storage item persists until You clear Your browser data. The __cf_bm cookie expires after 30 minutes of inactivity. None of these are stored on Our servers at any point.

International Data Transfers

tau is operated from the United States. If You access the Service from outside the United States, Your Usage Data may be processed by Cloudflare at edge locations worldwide and by Vercel in the United States, where data protection laws may differ from those of Your jurisdiction. Where required by applicable law (including the GDPR), We rely on Vercel's and Cloudflare's data processing agreements and standard contractual clauses to safeguard international transfers.

Security

All connections to tau are encrypted via HTTPS/TLS, terminated at Cloudflare's edge and re-encrypted to Vercel's origin servers. The Service holds no credentials, no session tokens, and no user-submitted data, so there is no account to compromise. We use commercially reasonable measures to protect the Service, but no method of electronic transmission or storage is completely secure, and We cannot guarantee absolute security.

Children's Privacy

tau is a scientific research tool and is not directed at children under 16 years of age. We do not knowingly collect Personal Data from children under 16. If You believe a child has provided Us with Personal Data, please contact Us so that We can take appropriate action.

Your Rights Under the General Data Protection Regulation (GDPR)

If You are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, You have rights under the GDPR and equivalent local legislation.

Legal Basis for Processing

To the extent We process any Personal Data (primarily IP addresses in server logs via Vercel and Cloudflare), Our legal basis is:

• Legitimate interests (Article 6(1)(f) GDPR): We process server log data for the legitimate purposes of operating, securing, and improving an academic research resource. This processing is minimal, does not involve profiling, and does not override Your fundamental rights and freedoms.

For cookies: all cookies used by the Service and its infrastructure providers (Cloudflare) fall within the "strictly necessary" exemption under Article 5(3) of the ePrivacy Directive, as they are required for the Service to function — a display preference and bot protection. No consent is therefore required for their use.

Your GDPR Rights

You have the right to:

• Access any Personal Data We hold about You.
• Rectification of inaccurate data.
• Erasure of Your Personal Data, under certain conditions.
• Restrict processing of Your Personal Data, under certain conditions.
• Data portability — request transfer of Your data in a structured, machine-readable format.
• Object to processing of Your Personal Data based on legitimate interests.
• Not be subject to automated decision-making , including profiling, that produces legal effects. tau does not engage in automated decision-making or profiling of any kind.

To exercise any of these rights, contact Us at the address below. We will respond within one month, extendable by two further months for complex requests. If You believe Our processing of Your data violates the GDPR, You have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of Your habitual residence, place of work, or place of the alleged infringement.

Your Rights Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

If You are a California resident, the CCPA (as amended by the CPRA) provides You with specific rights regarding Personal Information.

Categories of Personal Information Collected

In the preceding twelve (12) months, the only category of Personal Information We may have collected is:

• Internet or similar network activity IP addresses, browser/device identifiers, and browsing activity on the Service, collected automatically through server logs by Vercel and Cloudflare.

We do not collect sensitive Personal Information as defined under the CPRA.

Sale and Sharing of Personal Information

We do not sell Your Personal Information. We do not "share" Your Personal Information for cross-context behavioural advertising as defined under the CPRA. We have not sold or shared Personal Information in the preceding twelve (12) months.

Your CCPA/CPRA Rights

• Right to know what Personal Information We collect, use, and disclose.
• Right to delete Personal Information We have collected from You, subject to certain exceptions.
• Right to correct inaccurate Personal Information.
• Right to opt-out of sale or sharing We do not sell or share Personal Information; should this ever change, We will provide a "Do Not Sell or Share My Personal Information" link.
• Right to non-discrimination We will not discriminate against You for exercising Your rights.

To exercise these rights, contact Us at the address below. We will verify Your identity and respond within 45 days, extendable by an additional 45 days where reasonably necessary.

California Online Privacy Protection Act (CalOPPA) Compliance

In compliance with CalOPPA:

• Users can visit the Service anonymously — no account or identifying information is required.
• A link to this Privacy Policy is carried in the footer of every page.
• Changes to this Privacy Policy are posted on this page with an updated date.

Do Not Track Signals

tau does not operate any analytics or tracking service and does not track users across third-party websites. We honour Do Not Track (DNT) browser signals in the sense that We have no tracking infrastructure to disable. Our infrastructure providers (Vercel, Cloudflare) may process standard server/network logs regardless of DNT settings as part of providing their services; consult their respective privacy policies for details.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage You to review this page periodically. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

Contact Us

If You have questions about this Privacy Policy or wish to exercise any of Your data protection rights, please contact: