Privacy policy
Cellucid (www.cellucid.com) is a free, open-source web app for looking at single-cell data. It runs in your browser. This page says what it reads, what it keeps and what it sends.
Your data
Cellucid reads your data in your browser, from where it is: a file on your computer, a server you connect to, or a link you open (for example GitHub, Zenodo, Figshare, Google Drive or OneDrive). It reads only the parts a view needs. Your data is never uploaded to a Cellucid server, and nothing Cellucid reads is stored by Cellucid; it stays in your browser's memory and is released when the dataset closes.
Google Drive and OneDrive
- What Cellucid accesses. On Google Drive, only the files you choose for Cellucid in Google's file picker (the
drive.filepermission), and a file shared with anyone who has its link. On OneDrive, the files your Microsoft account can read (Files.Read, andFiles.Read.Allonly when you open a file someone in your organisation shared with you), and only the file you open. Cellucid only reads; it never changes, creates or deletes a file. - Where the data goes. Your browser reads the file straight from Google or Microsoft. Neither the file nor your sign-in passes through a Cellucid server.
- Where your sign-in lives. The access token Google or Microsoft gives Cellucid (and Microsoft's renewal token) is kept in your browser tab's session storage. It survives a reload of the tab and is deleted when the tab closes. It is never saved by Cellucid anywhere else, never put in a link, a saved session or a figure, and never sent anywhere except back to Google or Microsoft.
- What a link or a saved session records. Only which service and which file (its id), never a token.
- Revoking access. Close the tab, and remove Cellucid at myaccount.google.com/permissions, account.live.com/consent/Manage or, for a work or school account, myapps.microsoft.com.
Cellucid's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Community annotation (GitHub)
If you sign in with GitHub to share annotations, sign-in and repository requests go through a small Cellucid-operated authentication service, which relays them to GitHub. Your GitHub token is kept in your browser tab's session storage and deleted when the tab closes. What you publish is stored in the GitHub repository you choose, under GitHub's terms.
Usage statistics
On www.cellucid.com, Cellucid sends anonymous usage statistics to Google Analytics: page views without the page's query, how long loading took, which features were used, and a dataset's coarse shape (ranges of cell and gene counts). It never sends a dataset's name, contents, link, file name or a sign-in. Google Analytics keeps two cookies of its own in your browser (_ga and _ga_K4774ZWGEQ) to tell a returning visitor from a new one. A copy of Cellucid you run yourself sends nothing and sets no cookie.
Stored in your browser
Cellucid keeps your preferences (such as the theme) and community-annotation drafts in your browser's storage, and sign-ins in the tab's session storage; on www.cellucid.com, Google Analytics adds its cookies. Clearing this site's data in your browser removes all of it.
Contact
Questions or requests: Kemal Inecik, k.inecik@gmail.com. Please report a security problem privately, as the security policy describes, not in a public issue. The full technical account is in the documentation's privacy model.