Privacy Policy
Effective date: March 2, 2026
1. Introduction
This Privacy Policy describes what information Chive collects, how it is used, and what choices you have. Chive is an AppView on the AT Protocol -- a read-only indexer for scholarly eprints.
The key principle: your research data lives in your Personal Data Server (PDS), not on Chive's servers. Chive indexes publicly available data from the AT Protocol network to provide search, discovery, and display services.
2. Information We Index from ATProto
Chive indexes data from the AT Protocol firehose, a public data stream of repository events. This includes:
- Eprint metadata -- titles, abstracts, author lists, field classifications, keywords, and license information
- BlobRef CID pointers -- cryptographic references to files stored in your PDS (such as PDFs). Chive stores only the pointer, never the file itself.
- Reviews, endorsements, and comments -- scholarly feedback submitted by users
- Knowledge graph contributions -- field proposals, community votes, and tags
- AT Protocol identifiers -- your DID (Decentralized Identifier) and handle, which are public identifiers on the AT Protocol network
Chive does not store blob data (PDFs, images, or other files). We store only CID pointers. The actual files remain in your PDS and are served directly from it. Chive does not store passwords.
3. Information from Service Operation
In addition to data indexed from the AT Protocol, Chive collects the following through normal service operation:
- Authentication tokens -- AT Protocol OAuth session tokens, stored in encrypted Redis sessions (AES-256-GCM encryption) with a 7-day expiration. Chive does not store passwords or login credentials.
- Rate limiting data -- request counters tied to IP addresses (for unauthenticated users) or DIDs (for authenticated users). These counters are stored in Redis and automatically expire.
4. Analytics and Observability
Chive uses exclusively self-hosted analytics and observability tools. We do not use any third-party SaaS analytics services. No data is sent to Google Analytics, Meta, or any other external analytics provider.
Grafana Faro (Frontend)
Collects page load performance metrics (Web Vitals), JavaScript errors, and navigation events. User DIDs are hashed before collection using a one-way hash, making them non-reversible. Session IDs are randomly generated, non-identifying tokens.
OpenTelemetry (Backend)
Distributed request tracing for debugging and performance monitoring. Traces track request timing and database query performance. No personally identifiable information is included in traces.
Activity Service
Logs user-initiated write actions (such as "submitted eprint" or "posted review") tied to your DID, used for activity feeds and firehose event correlation. Activity logs are cascade-deleted when your account is removed.
Metrics Service
Tracks view counts and download counts per eprint. Uses HyperLogLog for unique viewer estimation, which provides approximate counts without identifying individual viewers. Trending calculations are based on time-windowed aggregate view counts.
Search Relevance Logging
Records search impressions, result clicks, and dwell time to improve search ranking quality. This data is anonymized and used only for training search models.
6. How We Use Information
Information is used to:
- Index and display eprints in search results and browse pages
- Authenticate users via AT Protocol OAuth
- Moderate content and enforce our Community Guidelines
- Improve search quality through relevance logging
- Monitor service health and debug errors
- Calculate trending metrics and view counts
- Prevent abuse through rate limiting
8. Data Retention and Deletion
- Index data -- retained as long as the corresponding record exists on the AT Protocol network. When a record is tombstoned (deleted from your PDS), Chive removes it from all indexes upon receiving the tombstone event via the firehose. Records are also removed when your PDS returns a 404 during periodic freshness checks.
- Authentication sessions -- encrypted in Redis with a 7-day expiration. Automatically deleted when expired.
- Rate limiting data -- stored in Redis with short time-to-live values. Automatically expired.
- Analytics data -- retained for service improvement. User DIDs are hashed before collection.
- Activity logs -- cascade-deleted when your account is removed from Chive.
9. Your Rights
Because your data lives in your PDS, you have direct control over it:
- Access -- you can access your data directly through your PDS provider at any time.
- Deletion -- delete records from your PDS and Chive removes them from its index.
- Portability -- your data is stored in AT Protocol format in your PDS and is inherently portable to any AT Protocol-compatible service.
- Correction -- update records in your PDS and Chive will re-index the updated version.
For any privacy-related requests that cannot be handled through your PDS, contact us at privacy@chive.pub.
10. Security
Chive implements security measures including encrypted session storage (AES-256-GCM), mutual TLS for inter-service communication, and secrets management. Personally identifiable information is scrubbed from observability data before collection.
No system is perfectly secure. While we take reasonable measures to protect the Service, we cannot guarantee absolute security.
11. Children's Privacy
Chive is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe a child under 18 has provided information to Chive, please contact us at privacy@chive.pub.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.
13. Contact
For privacy questions or requests, contact us at privacy@chive.pub or through GitHub.