Privacy

Last updated 6 October 2026.

FoldRay is a non-commercial project run by Max Stetina, Czech Republic, the controller of the personal data described here. Contact: info@foldray.org.

In the browser. Structure files, sessions, settings and renders stay on the user's device unless the user sends them through a form. A share link carries its session after the # in the address, which browsers never send to a server; anyone given the link can read it, and it stays in the browser history.

Visit counting. Cloudflare Web Analytics counts visits without cookies and stores nothing on the device. It reports each page's address and the address that linked to it, both without anything after ? or #, page load times, and the visitor's country, browser, operating system and device type. There is no other analytics or tracking, apart from Tally's visit counts on its own forms.

Hosting. Cloudflare, Inc. serves the site and processes IP addresses and request details to deliver and protect it, as a processor under its Data Processing Addendum and, for its own network's security, as an independent controller (privacy policy). Transfers to the US rely on the EU–US Data Privacy Framework and standard contractual clauses. Records of individual requests (IP address, approximate location, browser, page) are visible to the operator for 31 days and are used for security, troubleshooting and, during early access, to see how invited users use FoldRay.

Early access. FoldRay is open only to invited email addresses. The page at foldray.org checks an entered address against the list without storing it; an address not on the list is filled into the request form. Cloudflare Access emails a one-time sign-in code and records each sign-in (email address, IP address, country, time), which may be combined with the request records above. The only cookies are those sign-in needs, kept for up to 24 hours, and Cloudflare's security cookie if it checks that a visitor is not a bot.

Forms and email. Access requests (email, name, affiliation), feedback and render submissions are collected by Tally (Belgium), which stores them in the EU (Tally and GDPR) and counts visits to its forms by country, city, browser and device. Emails to info@foldray.org are forwarded by Cloudflare, which keeps each one's sender, recipient and subject for 31 days, to the operator's Gmail mailbox, which also receives a copy of each access request (Google; US transfers under the Data Privacy Framework). All of it is used only to manage access, to reply and, with permission, to show a render, and is deleted on request.

Structure databases. Opening a structure by ID, or opening or copying a share link, makes the browser contact RCSB PDB or AlphaFold DB directly, which see the visitor's IP address and the identifier under their own policies: RCSB PDB, AlphaFold DB.

Legal basis and rights. Showing a submitted render is based on consent (GDPR Art. 6(1)(a)), which can be withdrawn at any time; all other processing here on the legitimate interest in running the site (Art. 6(1)(f)). Requests to access, correct, delete, restrict or receive a portable copy of personal data can be sent to info@foldray.org. Complaints can be made to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz).

Right to object. Anyone may object at any time to processing based on legitimate interest by writing to info@foldray.org.