Privacy policy
Last updated 26 September 2026
Who is responsible
Clemens Thalhammer, Switzerland, runs clopen.solutions and is responsible for the personal data described here. Write to privacy@clopen.solutions with any question or request.
What we collect
- Your account: your name, email address, affiliation and homepage, and your password, stored only as a hash. Curators and admins also have a second-factor setup.
- Account requests: what you enter on the request form, including why you would like an account.
- Submissions: the paper's sources and the PDF we build from them, any Lean proof, the abstract, comments and claims, and each author's name, affiliation, email address and ORCID iD.
- Emails you send us, with your address and what you write.
- Technical data: your IP address, the page requested and your browser type, in server logs. The site sets only the cookies it needs to work: for your session, against cross-site request forgery, and to show a notice after you submit a form. There is no analytics, tracking or advertising.
If you are named as a co-author
Your details came from the author who submitted the paper. We use them to credit you, and publish your name and ORCID iD with the paper. We never show your email address. Write to us to have your details corrected, or if you object to being listed.
Why we use it
- To run your account, invitations and submissions, and to email you about them. This is the service you asked for.
- To keep published papers and their authors on record permanently, and to credit co-authors. This is our legitimate interest, and the public's, in a reliable scientific record.
- To keep the site secure and prevent abuse, which is our legitimate interest.
- Where the law requires it.
We send no marketing email.
What becomes public
When you announce a submission, we publish its title, abstract, comments, PDF and sources, its Lean proof details, the authors' names and ORCID iDs, and the automated review's report once it is released. Author email addresses are never shown, but the PDF shows whatever the authors wrote into it.
An announced version is permanent, because others read and cite it. You can withdraw it but not delete it, and it stays up if you delete your account.
Automated review
When your sources build, we send your draft, with its abstract, comments and claims, to Anthropic in the USA, where an AI model reviews it. Anthropic keeps what we send for 30 days, or for up to two years if its safety systems flag it, and doesn't use it to train models. When you announce, the model also reads each Lean statement that has no formalisation in the registry.
The review decides one thing on its own. If it finds that the submission isn't a paper, is empty or malformed, is off-topic, or doesn't address the problem it claims, you can't announce it. We tell you why, and if you write to contact@clopen.solutions, a curator reviews the decision and can overrule it. Everything else the review says is advice, and it never changes a problem's status.
Who else receives it
These providers process data for us, only on our instructions, under a data processing agreement with each:
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Render | Hosting and database | USA | Swiss-US Data Privacy Framework |
| Cloudflare | File storage | Eastern Europe | Swiss-US Data Privacy Framework |
| Modal | Building papers and checking proofs | USA | Standard contractual clauses |
| Resend | Sending and receiving email | Ireland and USA | Standard contractual clauses |
| Anthropic | Automated review | USA | Standard contractual clauses |
The USA does not protect personal data to the standard Swiss law requires. Each transfer there therefore relies on the safeguard shown: the provider's certification under the Swiss-US Data Privacy Framework, or the EU standard contractual clauses as adapted for Switzerland. Ask us for a copy.
We disclose data to authorities only where the law obliges us to. We don't sell personal data or share it for advertising.
How long we keep it
- Your account and drafts: until you delete them, or your account.
- Announced submissions and their authors: permanently. If you delete your account, your name stays on your papers as printed, and your email address is removed from them.
- Account requests and invitations: while your account exists. One that doesn't lead to an account is deleted 12 months after it is decided or lapses.
- Emails you send us: as long as we need them to deal with what you wrote.
- Server logs: at most 30 days.
- Database backups: 7 days.
Security
All traffic is encrypted. Files sit in a private bucket and are reached only through links that expire. Passwords are stored as hashes, and curators and admins must use a second factor.
Your rights
You can ask what data we hold about you and get a copy of it, have it corrected or deleted, receive it in a portable format, and object to how we use it. Write to privacy@clopen.solutions. We answer within 30 days, free of charge. You can edit your profile and delete your account yourself, from your profile page. Published papers stay, as described above.
If you think we have mishandled your data, you can complain to the Federal Data Protection and Information Commissioner in Switzerland, or to the data protection authority where you live in the EU.
Age
The site is not meant for anyone under 18. If we learn that someone under 18 has an account, we close it and delete their data.
Changes
When we change this policy, we update the date at the top, and we email account holders about any material change.