Clear boundaries
Public and private information
Public after approval
- Name and any credentials provided
- Professional role or title
- Optional institution or affiliation
These fields appear only after email confirmation and signature review. An affiliation identifies the signer and does not imply institutional endorsement.
Kept private
- Email address
- Optional private note to organizers
- Confirmation status and timestamps
- Administrative review records
Email addresses are encrypted in the signature database and are never included in the public signatory list. Optional private notes are used only for organizer review and are never published.
Limited purpose
How information is used
Private information is used to send a one-time confirmation link, prevent more than one public entry per verified email within the current letter campaign, support signature review, and respond to a signer’s request about their entry. It is not sold, used for advertising, or added to an unrelated mailing list.
The private record includes an identifier for the exact letter revision displayed when consent was given. Non-substantive corrections such as spelling, punctuation, or source-link updates may remain within the same campaign without creating a duplicate public entry. A substantive change to the letter begins a new campaign and requires fresh consent.
Opening a confirmation link does not complete verification. The signer must deliberately select the confirmation button. Email confirmation shows access to the submitted account; it does not by itself prove professional status or institutional endorsement.
Private correspondence
Contact messages
The contact form collects a name, email address, optional state, and message. This information stays private, is sent to the organizers so they can review and respond, and is not published or added to the public signatory list.
Do not include patient information, medical records or details, or sensitive information about another person. Contact-form delivery copies may remain in organizer mailboxes and email-provider systems under their operational retention practices.
To limit automated or repeated submissions, the system keeps pseudonymous anti-abuse counters derived from the contact email address and request IP address. These counters do not contain the message and are retained for no more than two days.
Security and retention
Storage, access, and deletion
Service providers and access
Cloudflare hosts the website and encrypted signature database. Cloudflare Turnstile provides the form’s anti-abuse security check, and Resend is the production email-delivery service. Private submission records are limited to the designated organizers responsible for verification and review.
Retention
Signer confirmation links expire after 24 hours, and private organizer approval links expire after 30 days. Unconfirmed submissions are removed after the verification window and a short abuse prevention period. A pending-review record with no live organizer approval link is deleted after the 30-day review window. When an organizer rejects a pending submission or handles a verified withdrawal or removal request, the signature database record and its related private email payloads are deleted immediately. A private email address is retained while a submission awaits confirmation or review, or while its signature is published, so organizers can handle verification and verified correction or withdrawal requests. Approved public fields remain only while the signature is published. An optional private note is encrypted in the signature database only while the submission is unconfirmed or pending review. Its database copy is deleted when a signature is approved or when the submission record is deleted. After deletion, limited copies may remain temporarily in Cloudflare backup recovery and email-provider systems under their operational retention windows.
Records from a superseded campaign are not displayed with the current campaign and are removed within 30 days unless they have already been deleted through a verified request.
Correction or withdrawal requests
A signer can request a correction or withdrawal by replying to a verification message. Organizers verify the request through the same private email address before changing or removing a public entry. This is an organizer-handled process, not a perpetual automated self-service link.