What we keep
When you create an account: your email address, the name you give, whether you asked for research emails (and when you asked), your plan, and the dates you joined and last signed in. If you sign in with Google, Google tells us your name and email address; we do not see your Google password or anything else in your Google account.
Where it lives
On Google Cloud. Your sign-in details are held by Google's account service (Identity Platform), which checks your password and never shows it to us; Google runs that service worldwide, under the UK–US data bridge. Your account details are in a database in London that only the site itself can read. Nothing about you is sold, shared or used to train anything.
Cookies
One: a session cookie that keeps you signed in for up to fourteen days. It exists only once you sign in with a confirmed email address, it is needed for signing in to work, and it tracks nothing. There are no advertising or analytics cookies.
Emails
Google sends the emails that confirm your address or reset your password. We send research emails only if you tick the box — rarely, and never anything else — and you can untick it on your account page at any time.
Removing it
Your account page has a “Delete my account” button. It removes your account and everything we hold about you at once. Daily backups of the database are kept for seven days and then gone too.
Who we are
smallcap is run from the United Kingdom and follows UK data-protection law.