Privacy

What we keep

• Your account: name, email address, and a one-way hash of your password (we cannot read your password).
• What you submit: your manuscript and the evidence files you upload, with a fingerprint (SHA-256) of each so findings stay tied to the exact file. The files themselves are deleted on a schedule (below); the fingerprints are not.
• Your card: the display name, website, links, note and photo you choose to show. Photos are re-saved without location data.
• A log of activity on your submissions (uploads, examiner actions, link openings) so the service can be audited.
• Sign-in attempts: to slow down password guessing we briefly keep a count of failed sign-ins against your email and your network address. These counters are cleared automatically.
• Link openings: when someone opens one of your links we count it, approximately, to tell you it was read. We do not keep the viewer’s name, address or device.

Who can see it

• Our examiners can read what you submit, to do the examination. Files are not readable by other authors.
• Anyone you send a link to sees your card, and the files only if you switch downloads on for that link.
• Anyone, via the register, sees a published record: the title, your name as you gave it, the counts and the findings summary, not your files.

Where it lives

On infrastructure from Vercel (hosting and file storage) and a managed Postgres database provider. Files are stored privately; they are served only through this service after it checks who is asking. We do not sell your data and we do not use your files to train AI models.

Cookies

One sign-in cookie, and a short-lived cookie that stops a card link from counting the same visit twice. No advertising or analytics trackers.

How long files are kept

Uploaded files (your manuscript and every evidence item) are deleted 30 days after your record is published or your submission is refused or withdrawn. You can shorten that to 7 days or to straight away, or delete them yourself at any time once the examination is over. Files from a submission you never send are deleted after 90 days without activity. A daily job does the deleting, and each deletion is recorded in your submission’s activity log. What we keep afterwards is each file’s fingerprint, name, size and your description, the examiner’s findings, and the signed record. Examiners may download a file to work on it and must delete their working copies when the examination ends. Your profile photo is kept until you remove it.

Deleting it

You can remove evidence yourself before you submit. To have your account deleted, or to correct something, team@theyardlab.com. A published record’s entry in the register stays, marked withdrawn, because other people may be relying on it.