Privacy & cookies
Short enough to actually read.
Everything ResearchVitae stores, sets and sends, on one page. If a promise elsewhere on this site wouldn’t survive here, it doesn’t ship.
Two cookies, both for sign-in
This site sets exactly two cookies, both for staying signed in — one of them a ten-minute cookie used only during the ORCID sign-in handshake. Visitors browsing this site, and readers of every published page, get none.
| Cookie | What it does | When |
|---|---|---|
| op | Keeps you signed in to the editor. | Set at sign-in; lasts 30 days. |
| op_oauth_state | The handshake cookie, set during the ORCID sign-in process. Protects against forged logins. | Lasts 10 minutes. |
There are no analytics cookies, no advertising cookies, and no fingerprinting, here or on any published page. If you arrive via a colleague’s referral link, the referral is remembered in your browser’s localStorage, not a cookie; it’s read and deleted when you sign up.
We never send email, and we never collect your address. Sign-up doesn’t ask for one. If your ORCID record contains an email address, we never use it for mail; it’s rendered on your page only if your record makes it public and you choose to show it.
The newsletter is optional, hosted by Buttondown, and exists only if you subscribe to it. It’s the one way to hear about new features.
Third parties
Zero third-party requests, on this site and on every published page. Fonts are self-hosted. Nothing is loaded from a CDN, an analytics service, or a social network.
The one outside service your browser ever sees is ORCID itself: at sign-in, with your permission, revocable at orcid.org. Our server also syncs your record from ORCID, and when something breaks on our server the error report (the failing request and technical details, never who you are) goes to Sentry so we can fix it. No Sentry code runs in your browser.
What we store
- Your ORCID iD — it’s your account; there is no password.
- A copy of your public ORCID record — what the sync fetches, so your page renders fast.
- Your presentation settings — layout, palette, overrides, and anything you’ve hidden or added.
- Images you upload — at most a profile photo and a header background. Replaced images are deleted.
- Your published page — the rendered HTML we serve at your address.
- A referral-reward history — when referral months were earned. No payment details, ever.
That’s the whole list. We store no payment details: hosting subscriptions go through Stripe — card numbers never touch us. See the terms for hosting, billing and refunds.
Deletion
Instant and self-serve, from the editor. Deleting your account unpublishes your page and removes the stored copy of your record and your settings. Your ORCID record is untouched; it was never ours.
Last updated July 2026 · ORCID is a registered trademark of ORCID, Inc. This site is not affiliated with or endorsed by ORCID.