You can read ScienceShot without an account. We collect only what the site needs to run, to be measured and to be funded by advertising, and we never sell personal data.
Last updated 19 October 2026.
Who we are
ScienceShot, Geneva, Switzerland, the publisher of scienceshot.com, is responsible for your data (the controller). ScienceShot is a Swiss company: our data protection law is the Swiss Federal Act on Data Protection (FADP), and we also apply the GDPR where it covers readers in the EU and the UK. Contact: [email protected].
What we collect
- Usage data. Google Analytics tells us which pages and tools are read and where visits come from. Account and tool events, such as a sign-in, a saved project or a purchase, are counted with the tool or market involved, never with your email address, your figures or your payment details. We only look at aggregated reports.
- Advertising. Ads are served by Google AdSense. In Europe and Switzerland, Google asks for your consent before showing personalised ads.
- Newsletter. If you subscribe, we keep your email address to send you the weekly brief until you unsubscribe. Subscriptions through Substack follow Substack’s own policy.
- Regulation alerts. If you ask for alerts on a country’s data-centre rules, we keep your email address, the country, and the company and kind of work you choose to give, to write to you when those rules change. We delete them when you ask.
- Member accounts. If you create a free account, we keep your email address, your language, your plan, the dates you signed up and last signed in, whether your email is confirmed and, when you choose them, the products you asked to hear about. If you set a password, we keep it only in hashed form. If you continue with Google, Google confirms your email address and gives us an account identifier, which we keep to recognise you next time; we keep no Google password or token. We use these details to sign you in and run your account, nothing else. A password sign-up whose email is never confirmed is deleted after 30 days. To limit abuse, sign-in and sign-up attempts are counted for up to one hour against a scrambled form of the email and network address, never the address itself. Account emails are sent from our host’s mail server.
- Saved work and projects. Signed out, the tools keep nothing on our server: a project lives in its link, and the compliance tracker keeps one site in your browser. Signed in, the projects you save, the figures the Build, Operate and Sell tools add to them and the work you save in a tool are stored on our server with your account. They hold what you typed, such as a market, a load, phases and costs, never files. We use them only to show your work to you on any device, and we never sell them, share them or use them in any dataset or publication of ours. We keep them until you delete your account, or sooner if you ask us.
- AI connector. If you make a personal key on your account page, we keep a public key identifier, a scrambled form of the secret (never the secret itself), when the key was made, last used and revoked, and how many runs your account used each month, with the tool and time of each counted run so a retry is not counted twice. Your assistant sends us the question it asks, such as a market, to get an answer. A short log of the last few hundred calls keeps the time, the tool and the start of the question, without your account or address, so we can find faults.
- Payments. ScienceShot Premium is sold through Stripe, which acts as the merchant of record: Stripe takes the payment, charges VAT, sends receipts and keeps your card and billing details under its own privacy policy. We never see your card. From Stripe we keep your customer, subscription and price identifiers, your plan and when it renews or ends, and the time you agreed that access starts at once. We use them to give you access and answer billing questions, and keep purchase records for ten years for accounting.
- Deleting your account. Delete my account, on your account page, erases your account, your saved projects and tool work, your compliance tracker sites, your connector key and its run counts in one step. A paid plan has to be cancelled first, so no subscription keeps billing after the account is gone. Purchase records stay for accounting, as above. We keep encrypted backup copies outside our hosting account, use them only to restore the service and remove them only when we decide; if one is ever restored, every erasure is applied again first. Copies in our web host’s own backups are overwritten within the host’s retention period.
- Compliance tracker. Without an account, what you enter in the compliance tracker stays in your own browser, in its local storage: it is not sent to us, and “Clear all” or clearing your browser data removes it. If you are a member and save the tracker to your account, we store on our server what you enter for your sites: site names, profile figures such as power and dates, task states, references to where your evidence is kept and the values of your report items. We never store files. We use it only to show your tracker to you on any device, and we never sell it, share it or use it in any dataset or publication of ours. We keep it until you erase it or delete your account. We keep encrypted backup copies outside our hosting account, use them only to restore the service and remove them only when we decide; if one is ever restored, every erasure is applied again first; copies in our web host’s own backups are overwritten within the host’s retention period. A log of saves keeps only the time, the size and the number of sites, never their content, your IP address or your browser. Our web host stores it and sends the site’s emails, Cloudflare carries traffic to the site and Google holds our mailbox. From your account you can export everything you saved as a file and erase it in one step. Members sign in with a password, with Google or with a link sent by email. Google Analytics counts how the tracker is used, such as sites added and links followed, never the values you enter.
- ScienceShot Compliance (EED reporting pilot). If your organisation uses ScienceShot Compliance, it is the controller of the figures and names it enters, and ScienceShot processes them on its behalf under our data processing agreement, as part of the contract your organisation made when it bought the service. What is stored: the sites and their reporting figures, the definitions your team confirms, the checks and the written reasons your compliance manager records, the signed snapshots, and the name and work email of each person who enters a figure, kept with that figure’s history so the compliance team knows who to ask. Site leads enter figures through a link that needs no account; the link works for one site and one reporting year, expires after 90 days, can be revoked by your compliance manager, and is closed at sign-off. Your name and work email are also kept in your own browser so the form asks once per device; clear the site data for scienceshot.com to remove them. Reminder emails, if your organisation turns them on, carry the site and the site lead’s name, the reporting year, the number of open items, the due date and a fresh link, never figures. The records are held in our database at our host’s datacentre in Amsterdam, the Netherlands, and are never used for anything but your organisation’s reporting: no benchmarking, no advertising, no sharing with other customers. The activity log shows your compliance team who changed what and when; it holds no figures. Your organisation can export everything at any time and can erase it in one step; otherwise we erase the records 90 days after the pilot or subscription ends, at the latest two weeks later. Our backup copies are kept encrypted outside our hosting account, are used only to restore the service and are removed only when we decide; if one is ever restored, every erasure is applied again first. To see, correct or delete your data, ask your organisation’s compliance manager; you can also write to us and we will pass the request on within five working days. For the member account that buys the service and for its billing, ScienceShot is the controller: we process the buyer’s name, work email, company and the purchase to perform the contract (Article 6(1)(b) GDPR), and keep the purchase record for ten years for accounting.
- Comments and messages. When you comment or write to us, we keep what you send so we can publish your comment or answer you. Your email address is never published.
Cookies
We use a cookie to remember your language and, if you sign in, a cookie that keeps you signed in: for 30 days if you tick “Keep me signed in for 30 days”, otherwise until you close the browser and for at most a day. A cookie also ties an emailed sign-in link or a Google sign-in to the browser that asked for it. A few tools save your preferences and a draft of your work in your own browser. In the EU, the UK and Switzerland, Google Analytics and Google’s advertising cookies are set only after you accept them in the consent message; until then Google receives measurements without cookies that do not identify your browser. You can change or withdraw your choice at any time with the “Privacy and cookie settings” link at the foot of every page; cookies already set expire on their own. You can delete or block cookies in your browser settings at any time.
Sharing
We share data only with the services that run the site: our host, Google (analytics, advertising, our mailbox and Google sign-in), Stripe for payments, and the share buttons. For ScienceShot Compliance, the only services that touch your organisation’s records are our host (servers in the Netherlands) and Cloudflare, the network in front of our site, which passes those pages through without storing them; Google, which holds our mailbox, sees only support correspondence; the payment provider sees only the buyer’s billing details. Some of them may process data outside Switzerland and the EU under recognised safeguards. More on Google’s practices at policies.google.com.
Your rights
You can ask to see, correct or delete your data, or withdraw your consent, by writing to [email protected]. You can also contact the Swiss Federal Data Protection and Information Commissioner or your local data protection authority.
Changes
If this policy changes, we update this page and its date. See also our Terms of Service.