Privacy Policy

The short version

About a minute of reading. The full policy below has the detail, the exceptions, and the parts specific to where you live.

• We do not sell personal information, and no advertising appears on our sites, though the journal site does carry analytics and advertising trackers.

• We collect what we need to run submissions, peer review and publication: your name, email address, institution, ORCID iD, your public research profile (e.g., Google Scholar, ResearchGate), your manuscript, and a record of what you do on the platform.

• If you review for us and the article is published, your name and your review become public and permanent — that is what transparent peer review means. From the moment you accept an invitation, what you contribute during your peer review is part of that record. See What becomes public and permanent.

• Author names, affiliations and ORCID iDs are permanent too, and so are your responses to reviewers, which are published under the same CC BY 4.0 license as the article (see Open Access & Copyright).

• We send manuscript text and reviewer profile information to a contracted AI provider for typesetting, subject classification and reviewer matching, and we send the manuscript file to Turnitin for similarity screening. No editorial decisions are made by software.

• You can ask for a copy of your information, ask us to correct it, or ask us to delete it. Two things we cannot delete: anything already published, and the editorial record — a manuscript that was rejected or withdrawn is archived with its reviews rather than deleted.

• Questions, requests and complaints: contact@stacksjournal.org.

This policy covers personal information only. What you may do on the platform and the license you grant are in our Terms of Service; our fees are listed in the Editorial Policies (see Submission Fees, Memberships, & Special Issues).

Who we are and how to contact us

Stacks Journal, Inc. publishes Stacks Journal (ISSN 2836-4856) and runs the review platform at review.stacksjournal.org and the journal site at stacksjournal.org. Under European and UK data-protection law we are the "controller" of this information: we decide what is collected and why, and we are the ones answerable for it.

• Email contact@stacksjournal.org; our contact person is Dr. David Green, Editor-in-Chief (see Publisher & Contact)

• Write to us at: 16409 SE Division St, Ste 216 PMB 1098, Portland, OR 97236, USA

• Registered office: 5441 S Macadam Ave, Ste R, Portland, OR 97239, USA

Privacy questions go to the address above and are handled by the Editorial Team (see Peer Review & Editorial Processes).

Who this policy covers

Everyone whose personal information reaches us: authors and co-authors; reviewers and applicants to review; editors and staff; membership holders and institutional members; people we invite to review who never sign up; and visitors to our websites. What we hold, and what becomes public, differs a great deal by role.

People who never signed up with us

Some people in our records never agreed to anything with us.

• Co-authors. When a corresponding author lists co-authors we store each one's name, email address, ORCID iD and affiliations, and email them to confirm their involvement. We got those details from the corresponding author, not from the co-author.

• Reviewers we approach. An editor may invite a researcher who has no account with Stacks Journal. We create a record from the name, email address and subject area the Editorial Team entered, and send an invitation containing the manuscript title and its full abstract. Those details come from the editor's knowledge of the field, from names authors or reviewers gave us, or from public publication databases.

• Names other people give us. Authors may name reviewers they recommend and reviewers they ask us to exclude; applicants and reviewers may recommend others. We store those names, and any affiliation typed with them, as free text. Nobody has checked them, and the person named is not told. An exclusion request applies to the manuscript you made it for, and stays in front of the editor for as long as they are inviting reviewers to it. It does not carry over to a later submission, so tell us again each time.

• People a member invites to their team. A membership holder can invite colleagues by email address; we store the address and the invitation.

• People described in a manuscript. We process what is in the manuscript, as a publisher — see Information about research participants.

We rely on an exemption in European and UK law for the names third parties give us: writing to every person an author recommended or asked us to avoid would be disproportionate, and it would itself tell them they had been named — often for a reason the author would not want restated. Publishing this section is how we tell you instead.

If you are in one of these groups and want us to stop contacting you, or to delete what we hold, email contact@stacksjournal.org. We will remove you from the lists we invite from.

Data we collect

Manuscripts and figures are stored in our own database rather than in a third-party file-storage service; that database runs on our hosting provider's infrastructure (see Who we share it with). We may add questions to the signup and submission forms; the answers are stored with your record, and we update this table when we do.

Information about research participants

A manuscript can contain health, genetic, biometric or other sensitive information about the people a study was about. So can a reviewer's conflict-of-interest answer or their note about an ethics concern — and ethics concerns are published with the review. We handle this material only to evaluate and publish the research and to keep the public scholarly record: we do not use it to make any decision about the individuals described, we do not try to re-identify anyone, and beyond the Editorial Team and the reviewers assigned to the manuscript it reaches only the service providers listed under Who we share it with, which hold it on our instructions and for no purpose of their own. Authors are responsible for the consents and ethics approvals behind what they submit (see Research Ethics and Non-Interventional Studies and Handling of Identifiable Data).

Why we use your information

The first two columns apply to everyone. The third is for readers in the EEA and the UK: it names the legal basis we rely on, which is a requirement of the law there.

Some information is required: we cannot process a submission without an author name, an email address and a manuscript, or publish without author names and affiliations. An ORCID iD is optional, and we take it as you type it — we do not verify it with ORCID. Where we rely on a consent you can withdraw it, which does not affect what we did beforehand. Where we rely on our legitimate interests you can tell us to stop; see Telling us to stop.

Who we share it with

These are the companies that handle your information for us. We also disclose information in four other situations, described after the table.

We also disclose information when we must: to professional advisers; to another publisher or an institution where a research-integrity matter requires it (see Handling Allegations of Misconduct); to authorities where the law compels us; and to a successor organization if the journal is sold or reorganized, which would be bound by this policy. We do not sell personal information, and no advertising, sponsored content or promotional material appears on either site. The journal site does use analytics and advertising services to measure readership and to promote the journal, described under Cookies and local storage; the review platform uses none.

What becomes public and permanent

This is the most consequential part of this policy, particularly if you review for us. We may also display metrics derived from the review process on published articles and in author and reviewer profiles — on an article, for instance, how many reviewers recommended acceptance (see Publication).

Reviewers. During review, authors and other reviewers see only a label such as "Reviewer 3". The Editorial Team sees your name throughout. If the article is published and you took part in every round of peer review, submitting a Final Thoughts Form each time, your real name, your institution, and your research profile links may be published alongside your review: the review form, your votes, your inline comments, your replies and your tracked-change suggestions, less any comments we removed for breaching professional standards (see Peer Review), all under a CC BY 4.0 license. From the moment you accept, what you write in the collaborative document is part of the published record if the article is published, and withdrawing later does not remove what you have already written. Accepting an invitation is your agreement to all of this, and it cannot be withdrawn once a review is submitted (see Reviewer Consent to Publication). In an exceptional case — if your personal circumstances change after publication, for instance — an editor can take the public review page offline; the article and its metadata stay. Reviews of manuscripts that are rejected or withdrawn are never published, and those reviewers' identities stay confidential. Notes you keep private are never published. A private note becomes part of the review if you choose to share it to the discussion, and is then published with the rest. Being credited as a "Collaborator" on the article, on a line under the authors, is a separate opt-in.

We call that agreement "consent" in the editorial sense our Editorial Policies use. Under European and UK law we do not rely on your consent as the legal basis for publishing a review: we rely on the agreement you made when you accepted, and on our interest in publishing and maintaining the scholarly record. That is why publication is not something we can reverse on request — see What we cannot delete.

Authors. At publication your name, affiliations and ORCID iD appear on the article, in the PDF, on the public review page, and in the Crossref DOI record, which feeds indexers and archives. Your per-round responses to reviewers and each round's version of the manuscript are published as part of the review history, under the same CC BY 4.0 license as the article, which lets anyone reuse and adapt them with attribution (see Open Access & Copyright, which also sets out the exceptions). The corresponding author's email address is sent to our website but not displayed; reader feedback reaches you through a link on the article page instead (see Post-Publication Review & Discussion).

How review works, and who sees what during it, is in Peer Review & Editorial Processes and Confidentiality of Manuscripts Under Review.

Automated processing and AI

Our editorial commitments about AI, including that manuscript content never goes to public or consumer AI services, are in Stacks Journal's use of AI. Reviewers are forbidden from uploading manuscripts or review materials to AI tools (see Reviewers' use of AI), and authors must disclose their own use of them (see Authors' use of AI). This section adds the data-protection side.

No automated tool makes an editorial decision. No submission is rejected, flagged or assigned, and no reviewer invited, on an automated result alone. One output has no human step before it is stored: a manuscript's subject classification is generated automatically when it enters review, and it is used only to order the list of suggested reviewers an editor sees. Every other automated output — the typesetting structure, a reviewer vetting report — is read by a person before it is acted on.

What we send to an AI provider

Our contracted provider is Anthropic, which processes this material as a service provider acting on our instructions; the table above says exactly what it receives. We do not send unpublished review text, comments, votes or author responses to any AI provider. We do not permit our content to be used to train the provider's models, and we are completing the written data processing agreement that records that commitment and how long the provider keeps the content; we will state the retention period here when it is signed.

The profile we build about reviewers

If you review for us, we build an assessment of your published record: a summary of your work, subject tags, publication and citation counts, and a confidence score for whether the profile matches a real, active researcher. This information is drawn from your own public research profile and databases like OpenAlex and Semantic Scholar, neither of which covers every part of the world evenly. An editor reads it; it is a starting point, not a verdict, and no application is decided by it alone. You can ask us for a copy of yours, tell us it is wrong, and ask for it to be reconsidered — email contact@stacksjournal.org and the Editorial Team will look at it again. The Editor-in-Chief holds final authority over editorial decisions.

The editorial record we keep

We keep a detailed record of how each manuscript was handled: every accepted or rejected tracked change with its text, snapshots of every section before and after each revision round, the collaborative editor's full editing history, every comment including private reviewer notes, and which suggested reviewers an editor invited or skipped and why. We keep it for the editorial record, for research integrity, and so that a faithful round-by-round history exists.

Unpublished manuscript text, reviewer comments and other unpublished content are not used to improve the platform or to develop AI tools. For that work we use two things only: structured editorial data, meaning classifications, specializations, outcomes and processing times; and the text of published articles together with the published reviews that accompany them, including reviewers' names, which are public under a CC BY 4.0 license. Our Editorial Policies set this out (see Stacks Journal's use of AI).

How long we keep information

We would rather describe this honestly than publish a schedule we do not yet follow.

• The published record is permanent. Published articles and reviews, reviewer and author names, and Crossref metadata are not deleted; they change only through a correction or retraction (see Article Versioning).

• The editorial record is kept, and has no expiry today. A rejected or withdrawn manuscript is archived rather than deleted, with its reviews, decisions and revision history. So are the activity record, the collaborative editing history, the per-round section snapshots, the tracked-change log, integrity screening reports, reviewer-matching decisions and the names authors asked us to exclude. We keep them for as long as the journal operates, because questions about how a decision was made, misconduct allegations and corrections can arise many years after a decision; a manuscript in this archive can be opened only by the Editorial Team and its authors.

• Records of people we asked are kept. If you declined to review, never replied, or applied and were not approved, we keep that record so we know who was approached.

• Unfinished signup drafts are stored on our servers from the second step of the form onward and currently have no automatic expiry.

• Email records — who we emailed, which template, and what was sent with it — are currently kept indefinitely.

• Codes and sessions are short-lived; emailed links are not. A six-digit code expires in ten minutes, allows five attempts, works once, and is stored only as a hash. A staff session lasts seven days from your last visit and a reviewer session thirty, each re-extended when you use the platform; an author access cookie lasts thirty days. Some links we email — a co-author confirmation, a reviewer invitation, a billing link — do not expire and can be reused by anyone they are forwarded to, because someone acting on a year-old reminder should not hit a dead end. Treat them as passwords. An author's manuscript link also asks for a six-digit code sent to the author's email address, and a team invitation expires after 30 days. We are working to add expiry and rotation to the others.

• Payment records are kept as long as we need them for accounting, tax and disputes.

If you want something removed, ask us and we will tell you plainly what we can and cannot remove, and why.

Your rights

Wherever you live, you can ask us to:

• send you a copy of what we hold about you, and tell you where we got it;

• correct anything wrong, including a name misspelled on an article;

• delete what we hold, within the limits below;

• restrict a particular use — keep the information but stop doing anything with it while a dispute about it is open;

• stop emailing you, apart from the email a live submission or review needs;

• withdraw a consent you gave us;

• send you, in a portable file, the information you gave us yourself.

Asking costs nothing and we will not treat you differently for asking. When we correct, delete or restrict something, we pass that on to the recipients we know hold a copy, and we tell you which ones we could reach.

Telling us to stop

Some of what we do rests on our own legitimate interests rather than on your agreement: building a profile of your published work and scoring it to match you to manuscripts, inviting you to submit or review, improving our editorial tools, understanding which outreach works, and keeping the platform secure. You can tell us to stop any of these at any time, by emailing contact@stacksjournal.org. We will stop, unless we have a compelling reason not to, and we will tell you which reason it is. That exception never applies to invitations: if you tell us to stop inviting you, we stop.

What we cannot delete

Three things limit deletion.

The published scholarly record. Once an article is published we cannot remove author names, affiliations, ORCID iDs or review content from it, from the Crossref record, or from the indexes and archives that have copied it, and a reviewer's agreement cannot be withdrawn after the review is submitted. Where something published is wrong, the remedy is a correction or retraction, not deletion. In an exceptional case an editor can take an article's public review page offline, but the article and its metadata remain.

Research integrity. We keep enough of the editorial record to answer a later question about how a decision was made, to handle a misconduct allegation, and to meet our obligations as a publisher. Where we keep something for that reason we will tell you what we kept and why.

What the software will not do. We cannot delete an account that holds editorial content — a submission, a comment, a suggestion or a vote — because the record it is attached to depends on it, which in practice means every author and every reviewer who has done anything here. For someone with no activity, the record goes. For everyone else, what we do instead is stop using the account, stop emailing you, and remove or replace the identifying fields we can, and we tell you which ones those are. A deletion also does not automatically reach the copies held by Loops, Stripe, our email log, our AI provider, Turnitin, Crossref or the indexers; tell us and we will instruct the ones we can, and say which we cannot.

What we may hold back

When we send you a copy of what we hold, we may redact parts of it: another identifiable person's information, a reviewer's identity while a review is open, and legal advice. We will tell you that we have redacted something and why, rather than leaving a silent gap.

How to make a request

Email contact@stacksjournal.org with what you want and the email address your records are under, or write to the address above. A privacy request needs nothing more than an email — the formal requirements in Appeals & Complaints apply to editorial appeals, not to a request about your own information. We may need to check the request is really from you. We answer within one month; if a request is complicated we may take up to two further months, and we will tell you why inside the first month. There is no self-service export or deletion today: a person handles every request.

Email from us

Two kinds of email come from us, and the difference is whether you have already agreed to something.

Outreach is a first invitation — to submit, to review, or to join the board — sent to someone who has not yet agreed to anything. You can refuse all future invitations by emailing contact@stacksjournal.org and we will not approach you again (see Direct Marketing).

Process email is about work you are already part of: access codes, reminders about a review you agreed to do, decisions, proofs and receipts. While a submission or review is live you cannot switch those off — they are how the work gets done.

Cookies and local storage

The review platform carries no third-party analytics, advertising or tracking scripts at all, so it sets no third-party cookies and asks you nothing about them. It does make one measurement call of its own when you open a manuscript, described under Data we collect, and that goes to our server and nowhere else.

A partial signup is also saved on our servers from the second step onward, and that copy has no automatic expiry.

The journal site at stacksjournal.org is different. It uses third-party services of three kinds: analytics tools that measure how the site is used, including how visitors move around a page; advertising platforms that measure whether our promotion of the journal led to a visit, and let us show posts about the journal to people who have visited; and the email service that runs our newsletter. These services set cookies or similar identifiers and receive your IP address and the pages you view, and the advertising platforms also use that information for their own purposes under their own privacy policies. Article pages also load fonts and icons from third-party servers, which see your IP address. These services run as soon as a page loads. If you would rather they did not, there are a few things you can do. Your browser’s privacy settings can refuse or delete cookies. Google publishes an add-on at tools.google.com/dlpage/gaoptout that stops Google Analytics measuring you anywhere, not only here. The advertising platforms each let you control how they use what they collect, in your privacy or advertising settings with them. And our newsletter stops with the unsubscribe link at the foot of any newsletter we send.

Security

We claim no external certification or audit, and will not imply one. What we do:

• Both sites are served over HTTPS.

• Staff passwords are stored only as bcrypt hashes, and editor and administrator accounts can turn on two-factor authentication.

• Authors and reviewers sign in with a six-digit code we email, which expires in ten minutes, allows five attempts, works once, and is stored only as a hash. Some of the links we email do not expire and work for whoever holds them, so treat an email from us the way you would treat a password.

• Our server removes the Authors, Acknowledgements, Author Contributions and Funding sections — along with their revision history and any comments anchored in them — before a manuscript is sent to a reviewer's browser, and rewrites author labels. It cannot remove author identity from the body of your own text: if you name your institution in the Methods, or cite yourself in a way that identifies you, a reviewer may see it. Anonymizing the body of the manuscript is the author's job, but may also be performed by the Editorial Team.

• Database credentials are held only by the people who operate the journal. Authors, co-authors and reviewers reach their own manuscript through a personal emailed link, and for manuscript access a second code sent to their email address.

• Card details never reach our servers.

• Our application does not log IP addresses. The web server in front of it keeps the ordinary access log, which does.

If a security incident affects your information we will tell the people affected without undue delay, and in any event inside the period the law sets — for United States residents, within the time your state's law requires — and we will notify a supervisory authority within 72 hours where European or UK law requires it.

International transfers

We are a United States company working from Portland, Oregon. If you are outside the United States, using our platform means your information is sent to and stored in the United States, and in any other country where a provider listed above operates. Where European or UK law requires a safeguard for a provider's processing outside those regions, we rely on that provider's certification under the EU-U.S. Data Privacy Framework and its UK Extension, or on the standard contractual clauses in its data processing terms. You can ask us which applies to each provider. United States law gives you fewer protections than EU or UK law, and public authorities there may in some circumstances be able to require access to information held there.

Children

You must be at least 18 to create an account or submit a manuscript. We do not operate an age gate — the platform is used in a professional research context, and our forms do not ask your age — so we cannot check it. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, email contact@stacksjournal.org. We will remove what we can, and tell you plainly what we cannot: an account attached to a submission, comment, suggestion or vote cannot be deleted outright, for the reasons under What we cannot delete.

Complaints

Please come to us first, at contact@stacksjournal.org; the Editorial Team answers complaints about how we handled your information, and we will reply within one month. Complaints about editorial decisions go to the same address and the same people, under the process in Appeals & Complaints. Coming to us first takes nothing away from the routes below.

If you are in the EEA you can complain to the data-protection authority where you live or work (the list is kept by the European Data Protection Board); in the UK, to the Information Commissioner's Office. If you are in the United States you can complain to your state Attorney General; Oregon and California have dedicated privacy units. The comprehensive state privacy laws — Oregon's and California's — do not apply to a journal of our size, so the rights set out above are ones we offer as a matter of policy rather than under those statutes.

Changes to this policy

When we change this policy we will update the date at the top of this page and keep the previous version at a permanent address, so you can see what changed and when. If a change materially affects how we use information about you — a new recipient, a new purpose, or a new use of the editorial record — we will tell the people affected by email before it takes effect.