Privacy and data handling

What the archive collects and why

This notice describes information processed through the public archive, contact form, contribution workflow, curator workspace, API, and security controls.

Last updated August 9, 2026

Information you provide

The contribution form collects an approved contributor identifier, catalog descriptions, structured attributes, front and reverse photographs, and a rights confirmation. Contributor identifiers are used to verify submission access and are not displayed on public catalog records.

What becomes public

New contributions enter a private review queue. When a curator publishes a contribution, its catalog description, selected structured attributes, archive number, publication date, and approved photographs become publicly accessible and may be returned by the authenticated API.

Do not include private addresses, unrelated personal information, or information about another person in a catalog description or photograph.

Operational and security information

The application processes limited technical information such as IP addresses, request identifiers, timestamps, authentication events, rate-limit state, and security audit records. This information is used to prevent abuse, investigate failures, protect curator access, and maintain archive integrity.

Session cookies are used for curator authentication, CSRF protection, and secure form workflows. The application does not use its own session cookies to build advertising profiles.

Service providers

Depending on deployment configuration, information may be processed by the hosting and database providers, the configured OpenID Connect identity provider (currently Amazon Cognito) for optional Collector Account authentication and account-recovery email, the configured mail provider, Google reCAPTCHA for abuse prevention, Google Analytics for aggregate traffic measurement, and Google AdSense for advertising. Optional account, analytics, and advertising integrations are disabled unless the operator configures them.

Those providers operate under their own terms and privacy notices. The site operator is responsible for configuring consent or regional controls required for the audience it serves.

Retention and deletion

Published catalog records are retained as archival reference material until corrected, archived, or removed by a curator. Pending and rejected media, backups, logs, audit records, and rate-limit data should be retained only for the periods documented by the operator and required for security, recovery, or legal obligations.

Requests to correct or remove personal information will be evaluated against the archive's security, record-integrity, backup, and legitimate archival requirements.

Your choices

You may browse the public archive without creating an account. While signed out, saved items, recently viewed records, appearance, and archive display preferences are stored locally in your browser. When you sign in, new saved items belong to your private Collector account and existing browser saves can be imported into it; recently viewed records remain local to that device. Opening a browser-local library view requests the selected public record details from the site so they can be displayed.

If you choose to create a Collector Account, IIJJ stores your account email, optional display name, private collection/library status, and private notes so they can follow you across devices. The configured OpenID Connect identity provider handles the account credential, verification, and password-recovery workflow; IIJJ does not store your identity-provider password. Your private Collector information does not modify the public archive record.

You may choose not to use the contribution form. Browser controls can block optional cookies or scripts, although reCAPTCHA must be available to submit protected public forms when it is enabled.