Privacy

In short

• No ads, no tracking, no analytics, no third-party scripts. Fonts and the human check come from our own server.
• Cookies only keep you signed in and protect our forms.
• We use your email address to sign you in and to send what you asked for. We never sell it or share it for marketing.

Who is responsible

TEDAI GmbH, Praterstraße 32/2/23, 1020 Vienna, Austria, is the controller under the General Data Protection Regulation (GDPR). For anything about your data, write to contact@unsolved.how.

When you visit

Your browser sends us its IP address and the page it asks for. We use the IP address for up to ten minutes to limit how often forms and sign-in can be used, and error logs, which can contain IP addresses, are deleted after 14 days. The legal basis is our legitimate interest in running a secure site (Art. 6(1)(f) GDPR).

The human check on our forms (ALTCHA) is a small puzzle your browser solves in the background. It runs on our server: no third party is involved and it sets no cookies.

Cookies and browser storage

unsolved_session

Keeps your session while you browse. Expires after two hours without activity.

XSRF-TOKEN

Protects forms against requests from other sites. Same lifetime.

remember_web_…

Set when you sign in, so you stay signed in. Lasts until you sign out, at most 400 days.

Session storage

If you sign in to finish an action, such as a vote or a follow, this browser tab remembers the action until it is done.

These are strictly necessary for the service you use, so they need no consent (§ 165(3) Telecommunications Act 2021). We set no other cookies.

Your account

To sign in, you give us your email address and we email you a six-digit code. We store the code only as a hash and delete it within a day. Your account holds your name, email address and role, and, if you use them, your passkeys (only the public key; the private key never leaves your device) and the accounts you sign in with: from ORCID, Google or GitHub we receive and store the account ID, name, email address and profile picture the provider shares, and from ORCID your ORCID iD. The legal basis is providing the account you asked for (Art. 6(1)(b) GDPR).

You can delete your account in your account settings at any time. That deletes the account, your sign-in methods, votes and follows straight away. It also deletes your proposals that are still waiting for an editor or were declined, and your contributions that are not yet triaged.

Everything else you submitted stays, no longer linked to your account: proposals in the public pool or curated for the registry, still showing "Proposed by" with your name, and contributions in triage, under review, verified or declined, which stay public with the authors and affiliation you entered.

What you contribute

Only vote totals are public, never who voted. Proposals and contributions stay private until the review board looks at them. A published proposal shows "Proposed by" with your account name; a published contribution shows the authors and affiliation you entered, its summary and its link, and if it solves a problem, the problem names them as solvers. Published proposals and contributions are part of the public record, so they stay when you delete your account (see above).

Review board decisions are recorded internally with who made them. The public timeline shows the decision and its reason. Spam is deleted when an editor removes it; the internal record keeps who removed it and its first 200 characters.

Following by email

You can follow the weekly digest, a single problem, a whole field or news about the conference without an account. Following a problem or a field brings at most one email a week, and only when something happened outside the registry that bears on it; following a problem also brings an email when it moves in the registry. We store your email address, what you follow, the consent wording you agreed to and when, and when you confirmed. Nothing is sent until you confirm the link we email you, and every email has an unsubscribe link that works in one click. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Requests that are never confirmed are deleted after 30 days. After you unsubscribe, we keep the record of your consent and your unsubscribe for three years, so we can show both, and then delete it.

Enquiries

When you ask about patronage, starting a chapter or hosting one, we store your name, email address, organisation, city and message, and send them to our team inbox. We use them to answer you and to discuss a possible collaboration (Art. 6(1)(b) GDPR). The site deletes enquiries after two years; our email correspondence is kept as long as it is relevant.

How our team keeps track

So our team knows who it is talking to, it sees in one place what is on record under your email address: your account, your email follows and your enquiries. Team members can add tags, such as a city or a topic, and short notes, for example about a conversation or what was agreed, and mark where an enquiry stands. Only the people we name as staff see them. We use only what you gave us and what you did on this site: we don't look you up elsewhere or buy data about you, and nothing here makes decisions about you automatically. The legal basis is our legitimate interest in answering you and organising our partnerships and community (Art. 6(1)(f) GDPR), and you can object at any time. If you ask what we store about you, the tags and notes are included. They are deleted together with the last of your account, follows and enquiries.

Emails

We send sign-in codes, confirmations, updates on what you follow and the weekly digest through Resend, from its EU region in Ireland. Our emails contain no tracking pixels and no tracked links. Mail to contact@unsolved.how reaches our team through ImprovMX, a forwarding service.

Who processes data for us

DigitalOcean

Hosts the site and its database in Frankfurt, Germany, and keeps daily backups for seven days.

Laravel Forge

Sets up, updates and monitors our server.

Resend

Sends our emails from the EU (Ireland).

ImprovMX

Forwards email sent to contact@unsolved.how.

They work on our instructions as processors (Art. 28 GDPR). Some are based in the USA; where data reaches them there, the transfer relies on the EU–US Data Privacy Framework or on the EU's standard contractual clauses. If you sign in with ORCID, Google or GitHub, that provider handles your sign-in under its own privacy policy.

How long we keep data

• Sign-in codes: deleted within a day.
• Sessions: two hours without activity; staying signed in, at most 400 days.
• Your account: until you delete it.
• Proposals waiting for an editor or declined, and contributions not yet triaged: until you delete your account.
• Email follows: unconfirmed requests 30 days; the record of consent three years after you unsubscribe.
• Enquiries: two years.
• Our team's tags and notes about you: until the last of your account, follows and enquiries is deleted.
• Error logs: 14 days. Backups: seven days.

Your rights

You can ask us what we store about you, and have it corrected, deleted, restricted or handed to you in a portable format. You can object to processing based on our legitimate interests and withdraw consent at any time. Write to contact@unsolved.how. You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

Changes

When what we do with data changes, we update this page and the date at the top.