Privacy
What we keep, and what we don't
Last updated 2026-07-21.
CardioAT is built to hold as little about you as possible. Most of the site - the tools, calculators, guidelines and calendar - collects nothing at all. Data only comes in where you type it in: the Research Hub.
What we store
Here is every piece of information we hold, why, and for how long. Nothing else exists beneath it.
| What | Why | Kept for | Deleted when |
|---|---|---|---|
| A name | So a moderator can vouch for you when you register as an institution member | Minutes to days | The moment your registration is approved. Never asked anywhere else. |
| Listing contact email | So people can reach you about the listing | Up to 60 days, renewable | On takedown, or 30 days after expiry. Never published. |
| A shared contact address (optional) | Set by an administrator when a listing needs responders directed to a different address | The life of the listing | Deleted with the listing |
| A responder's email, and their message | To make the introduction | Until the listing they answered reaches end of life | Deleted with the listing. Unconfirmed responses: within 48 hours. |
| Institution membership email | To confirm you belong to your institution | Up to 24 months, renewable in the final three | On expiry, if not renewed |
| A reporter's email (optional) | Left only if you choose to, when reporting a listing | Until the reported listing reaches end of life | Wiped with the listing |
| Listing text, and a response's message | The content of the board | As long as the listing is live | The response message is deleted when the listing ends; the listing text comes off the board. |
| A report's reason | So a moderator can act on a report | Kept as a moderation record | Not removed with the listing (the reporter's email is) |
| Sign-in tokens, scrambled, never the original | To sign you in without a password | Login link: 15 minutes, one use. Session: up to 90 days of use. | On expiry, or when you log out |
| Aggregate view and response counts | Powers the public Insights page | Indefinitely | Never; they contain no personal data |
| Contact and feedback messages (your message, and your email if you include one) | So we can read and answer them - and so a message isn't lost if the email relay to us fails, which some institution mail filters cause | Up to 180 days | After 180 days, or sooner if you ask |
Nothing else. No IP addresses or access logs (Cloudflare handles those transiently to serve and protect the site), no names outside the moment above, no passwords anywhere. Anything deleted is purged from backups within 7 days.
In more detail
What we don't do
- We don't sell or rent your information to anyone.
- We don't run advertising or third-party tracking for advertising.
- We don't publish your email address.
Who processes the data
CardioAT runs on infrastructure operated by Cloudflare (content delivery and security) and uses Resend to send email. These providers process data only to deliver the service. Nothing is shared beyond what's needed to run the site.
Asking for deletion
You can ask us to remove your listing or the details you've submitted at any time. Contact us and we'll take it down.
Changes
If this page changes, the date above updates. Questions are welcome via the contact link.
© 2026 Christian Abhayaratna · CardioAT