Privacy statement

What we collect, and why

If you register: your name, email, affiliation, country, and optionally your ORCID and phone number. We need these to identify you, to contact you about your submission, and to credit you correctly if you publish or review.

If you submit a paper: the manuscript and its files, your co-authors' names, affiliations and emails, and everything you tell us in the submission form — funding, conflicts, data availability.

If you review: your review, your recommendation, your comments to the editor, and a record of how long you took and whether you accepted or declined.

If you only read: nothing that identifies you. We do not require registration to read, we carry no advertising, and we use no third-party tracking.

Registration to read would make us not open access. A wall that takes your details instead of your money is still a wall, and the definition we publish under says content is available "without asking prior permission from the publisher or the author".

Advertising on a journal invites the question of whether an advertiser influences what gets published. At our size the revenue would be negligible and the question would not be.

Third-party tracking is the one that matters most here, and it is specific to research. What a person reads in a journal reveals what they are working on — a reader going carefully through papers on one contaminant, in one district, months before anything is published, is showing their unpublished research direction. A tracker would hand that to an advertising network. We are not willing to be the place that leaks it.

There is also a plain benefit: data we never collect cannot be breached, mishandled or demanded. It is the cheapest form of compliance there is.

Why we are allowed to hold it

Two different reasons, and the difference matters:

• Your consent — for things you chose: an account, email alerts, optional profile fields. You can

withdraw consent for these at any time and we will delete them.

• A stated, legitimate purpose — for the published record. Once an article is published, its

authorship, affiliations and metadata are part of a permanent scholarly record that other people cite and rely on. We cannot delete a published paper or remove an author's name from it, and we say so before you submit rather than after.

What we do with it

We use it to run the journal: to route your paper, to find reviewers, to make and communicate decisions, to publish, and to deposit metadata with Crossref and indexing services so your work can be found. Published metadata — your name, affiliation, ORCID, the title and abstract — is public by design; that is what publishing is.

We never sell your data. We never share it with any other Avloryn company. Avloryn Publications and Avloryn Labs run on separate systems with no data flowing in either direction, and that is a structural arrangement, not a promise (see our editorial independence statement).

Reviewers — the part we take most seriously

If you review for us, your identity is not disclosed to the author, and your confidential comments to the editor are never shown to them. We will not reveal that you reviewed a particular paper. A request from anyone — including an author exercising a data right — does not override a reviewer's anonymity.

Where it is held

On our own servers, and in encrypted backups held with a separate provider. Unpublished manuscripts and reviewer identities are the most confidential data we hold, and backups are encrypted before they leave our machines.

How long we keep things

• Published articles and their metadata — permanently. That is the point of them.
• Unpublished manuscripts (declined, or withdrawn) — kept for two years, then deleted.
• Review records — kept while the account exists, so reviewers can evidence their contribution.
• Accounts — until you ask us to close them.

Your rights

You may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete consent-based data, and complain if you are unhappy with how we have handled it. Write to the address on our contact page. We reply within 7 days and resolve within 30.

Two limits, stated plainly: we cannot delete a published article, and we cannot disclose anything that would identify a reviewer.

If something goes wrong

If personal data we hold is exposed, we will report it to the Data Protection Board and notify the people affected within 72 hours of becoming aware.

Contact

Data protection queries go to the contact on our contact page. That is a named person, not a form.