Technical privacy notice

How your research contribution is collected, stored, and protected

The portal is designed around a simple boundary: your raw chat export stays in your browser. Only the messages you select as your own are sent for privacy processing.

01 · Collection

Local-first processing

Raw exports stay on your device

A Web Worker reads the WhatsApp _chat.txt or Instagram messages/inbox JSON files in your browser. The portal has no endpoint for uploading the raw ZIP, TXT, JSON, attachments, or file paths.

You choose one author

You identify exactly one author label as your own. Only text from that label—and only included Instagram conversations—is prepared for submission. Other authors' messages are excluded.

Time is reduced to an age label

Your birth month and year stay in browser memory. They are combined with each local timestamp to derive an approximate integer ageAtMessage. Birth values and exact message timestamps are not sent. The estimate can differ by one year in your birth month.

02 · Processing

What reaches the server

The submitted message payload contains a source label, schema version, selected text, and each message's ageAtMessage. It also contains a one-way conversation fingerprint derived locally from a fixed message anchor. The backend keys that fingerprint before storage so a later full export can replace the same conversation without storing its title, participant names, thread path, or exact timestamps. Your current age, sex, email, and a consent-version marker are also used for the study workflow.

Encrypted staging

Selected text is staged as AES-256-GCM envelope-encrypted ciphertext in a separate database schema while privacy processing runs. Staging rows have a configurable 24-hour default expiry. Source, schema version, current age, sex, consent version, counts, dates, a keyed conversation fingerprint, and an internal contact ID remain relational metadata during staging.

Automated redaction

The backend replaces email addresses, URLs, and phone-like values, then runs Romanian and English spaCy named-entity recognition to redact detected people, locations, organizations, and other named entities. This reduces identification risk, but automated redaction can miss context and does not guarantee that free text is anonymous.

03 · Storage

Separate records, different protections

Receipt contact

Your email is encrypted with authenticated Fernet encryption in a ReceiptContact record. A separate keyed digest supports exact account lookup without storing a searchable plaintext email. Verification and retraction tokens are stored as hashes.

Research contribution

Cleaned examples, demographic labels, and the random sender pseudonym are stored inside an AES-256-GCM envelope-encrypted DatasetContribution. Each contribution gets a new Data Encryption Key (DEK), which is wrapped under the dataset Key Encryption Key (KEK).

Separate tables reduce accidental disclosure, but active records are connected by an internal contact ID. The research data is therefore pseudonymized—not claimed to be irreversibly anonymous—and must remain access-controlled.

04 · Retraction

Your private removal link

After all batches are accepted, the portal emails a receipt containing a private retraction link and the study's exact UTC deadline. Through that date, the link starts deletion of your encrypted contributions and staged data, and destroys the stored email ciphertext, lookup digest, and active tokens.

Minimal message-free accountability records remain: random internal IDs, consent/withdrawal evidence, status/count fields, and request/completion timestamps. Each primary deletion receives a backup-evidence deadline; provider expiry or purge evidence and downstream research-data handling remain operational responsibilities under the approved schedule shown below.

05 · Browser storage

Essential storage only; no tracking

This application includes no advertising or third-party analytics. Participant upload authorization stays in the upload page's memory. A strictly necessary, short-lived security cookie is set only when an authorized administrator completes password and emailed-code verification. Dismissing the privacy banner writes only privacy_notice_acknowledged to sessionStorage, which is scoped to the tab and removed when the tab closes.

Your rights and the final study notice

The retraction link is one technical rights mechanism. It does not replace any access, correction, erasure, restriction, portability, objection, consent-withdrawal, or complaint rights that apply to the study. The controller must explain how to exercise those rights in the approved participant materials.

Loading the authoritative study notice…

Legal reference: GDPR Article 13.