Privacy Policy

1. Who is responsible
2. What never leaves your browser
3. What we collect, why, and our lawful basis
4. The content fingerprint, explained
5. A note on lawful basis and consent
6. Cookies and browser storage
7. Who else processes data
8. International transfers
9. How long we keep things
10. Your rights, and how to use them
11. How we protect data
12. If something goes wrong
13. Research data and clinical use
14. Children
15. Automated decisions
16. Changes to this policy
17. Contact and complaints

1. Who is responsible

Colocalizer is operated by Colocalizations, an empresa unipersonal registered in Uruguay: a sole proprietorship, where the business and its owner are one legal person.

• Controller: Colocalizations
• Registered business details: available on request at [email protected]
• Contact for all privacy matters: [email protected]

We are the controller for the personal data described in section 3: the data our own service collects about you as a user.

We are not the controller, or the processor, of your research data. Your images are analysed in your browser and never reach us. If those images contain personal data, you (or your institution) remain the controller of it throughout, and we play no part in that processing.

We are a one-person business and are not required to appoint a Data Protection Officer. Privacy questions go to the address above and reach a human who can act on them.

2. What never leaves your browser

This is the part worth being precise about, because it is the whole point of the product.

When you drop images into Colocalizer, the page reads them from your disk using the browser's own file APIs. Decoding, thresholding, the Pearson / Manders / MOC / Costes maths and every chart run in JavaScript on your machine. There is no upload step, no background sync, and no "we only keep it temporarily". The following never reaches our servers, at any tier, free or paid:

• your image files, in whole or in part;
• pixel data, thumbnails, previews, crops or derived images;
• anything embedded in the image, including TIFF metadata and acquisition settings;
• the contents of folders you drag in.

You can verify this yourself: open your browser's network inspector and run an analysis. You will see the page's own files load, and nothing carrying your images going out.

3. What we collect, why, and our lawful basis

"Lawful basis" is the GDPR term for the legal justification for processing personal data. Each category below names ours.

a. Just visiting the site

To serve you the page, our edge network and origin receive the normal things any web request carries: your IP address, the time, the URL requested, your user-agent string, and the referring page if there is one. This ends up in short-lived request logs and is used for delivering the site, for security (blocking abuse and attacks) and for diagnosing faults.

Lawful basis: legitimate interests (GDPR Art. 6(1)(f)), running a website securely and keeping it working. We keep these logs briefly and do not use them to build a profile of you.

b. Product analytics

We use PostHog to understand how the tool is used: which features people reach, where they get stuck, whether an analysis completed. It is deliberately configured to learn as little as possible about individuals:

• No cookies, and nothing that outlives the tab. Analytics sets no cookies and writes nothing to local storage. It keeps one randomly generated session identifier in sessionStorage, which lets us see that three page views belong to one visit and roughly how long that visit lasted. Your browser discards it when you close the tab, so you are not recognised on a later visit and there is no identifier that follows you between visits or between sites.
• No autocapture. We do not scrape the page's text or DOM: filenames appear in the interface, and autocapture would sweep them up. Only explicit, named events are sent.
• No session recording, no screen capture. The canvas shows your images, so recording is switched off entirely. We do collect anonymous click and scroll coordinates on the page, to see which parts of the interface people actually reach; that is numbers on a grid, never a picture of your screen and never the text on it.
• Do Not Track is respected. If your browser sends a DNT signal, we send no analytics events at all.

What an event actually contains: the event name (for example analyze_completed), counts, durations, booleans, the threshold method you chose, file extensions such as .tif, the page path, the domain that referred you, the tab-scoped session identifier described above, and coarse device information from your user-agent such as browser and operating system. If you arrived from a link we published somewhere, the campaign labels that link carried (utm_source, utm_medium, utm_campaign and similar) are recorded too, so we can tell which of our own posts and adverts actually bring people here; those labels describe the link, not you. PostHog also receives your IP address with the request and uses it to infer an approximate location; we do not use it to identify you, and no identifier ties your events together across visits.

Never sent: filenames, pixel data, image dimensions, results, or anything you typed, except in the feedback form below, where you chose to type it.

Lawful basis: legitimate interests (Art. 6(1)(f)), improving a tool we give away. We think this is a fair balance because the data is cookieless, is not linked to an identity, is never combined with your research data, is not shared with advertisers, and is not used to track you across other websites. You can object at any time (see section 10), and enabling Do Not Track in your browser stops it immediately without contacting us.

c. Feedback you send us

The in-app feedback form sends what you fill in: a star rating, a category, your free-text comment, and your email address if (and only if) you choose to give one so we can reply. It is delivered through PostHog to the same project as the analytics.

Lawful basis: legitimate interests (Art. 6(1)(f)), reading and acting on user feedback, and replying if you asked for a reply. Please do not paste personal data or unpublished results into the comment box.

d. Your account

Accounts are not live yet; this describes them as they are being built. When you create one we store:

• an internal account identifier;
• your email address, if you sign in by email one-time code;
• your ORCID iD (for example 0000-0002-1825-0097), if you sign in with ORCID;
• sign-in timestamps and the plan you are on.

There is no password. Signing in by email means we send a one-time code to that address; the code itself is short-lived and is not kept once used or expired. Signing in with ORCID means you authenticate at ORCID and we receive your ORCID iD; ORCID will know that you signed in to Colocalizer.

Lawful basis: contract (GDPR Art. 6(1)(b)). We need this data to give you the account you asked for. Without it there is no account to give.

e. Analyses you choose to save

Saving is an explicit action. Nothing is saved to our servers unless you press save. When you do, we store:

• the numeric results: Pearson's r, Manders' M1 and M2, MOC, the Costes threshold and related statistics;
• the analysis settings you used: threshold method, background handling, channel assignment and similar parameters;
• the filename of each image;
• the image dimensions in pixels;
• a content fingerprint derived from the file (explained fully in section 4);
• timestamps, and which of your projects or workspaces the analysis belongs to.

The image itself is not stored, and never transmitted.

Lawful basis: contract (Art. 6(1)(b)). Storing and returning your saved analyses is the service you signed up for.

f. Your record of accepting the Terms

When you accept the Terms of Use, we write a small record: the date and time, the version of the Terms you accepted, your IP address, and your browser's user-agent string.

The IP address is there for one reason: it is evidence. Together with the timestamp it lets either of us show that a particular acceptance really happened, which is what makes the record worth keeping at all. We do not use it to locate you, profile you or link your activity.

Lawful basis: legitimate interests (Art. 6(1)(f)), keeping proof of what was agreed and when, so that a later dispute can be settled on evidence rather than memory.

g. Payments

Paid plans are billed through Polar (Polar Software Inc.) acting as our merchant of record, meaning Polar is legally the seller, takes the payment, handles VAT and sales tax, and issues your invoice.

You enter your card details on Polar's checkout, not ours. We never receive or store your full card number. From Polar we receive what we need to run your subscription and our books: your name and billing email, your country and tax status, the plan, the amount, the currency, the transaction date and identifiers, and whether the payment succeeded.

Lawful basis: contract (Art. 6(1)(b)) for providing the paid plan, and legal obligation (Art. 6(1)(c)) for the tax and accounting records we must keep.

h. Email you send us

If you email [email protected], we keep the message and our reply so we can help you and remember the context if you write again.

Lawful basis: legitimate interests (Art. 6(1)(f)), or contract (Art. 6(1)(b)) where the message is about your account or a payment.

4. The content fingerprint, explained

This one deserves a plain explanation rather than a line in a table, because it is derived from your image and we would rather you heard that from us.

When you save an analysis, your browser computes a SHA-256 hash of the image file (a 32-byte value calculated from the file's bytes). That value is sent with your saved results. On our side we do not store it as received: we compute an HMAC-SHA-256 of it using a secret key unique to your workspace, and store only that.

What this means in practice:

• It is derived from the content of your image. We are not going to describe it as "not your data", because it is computed from your data.
• It is one-way. A hash cannot be reversed. Your image cannot be reconstructed from it, not by us, not by anyone who obtained our database. It reveals nothing about what the image shows: not the cells, not the intensities, not the dimensions.
• It cannot link the same image across accounts. Because the HMAC key is per workspace, the same file saved in two different workspaces produces two unrelated values. Nobody (including us) can tell from the stored values that they came from the same file.
• What we use it for: recognising, within your own workspace, that you have analysed this exact file before. That is what lets us avoid duplicate rows and tell you "you already have results for this image".
• What we do not use it for: identifying you, tracking you, comparing your data against other users', detecting shared datasets, or building any kind of cross-account index. The per-workspace key is what makes those things impossible rather than merely forbidden.

The fingerprint is deleted with the analysis it belongs to, and the workspace key is destroyed when the workspace is deleted, after which the stored values cannot be reproduced or matched at all.

5. A note on lawful basis and consent

We rely on contract, not consent, to run your account and store the analyses you save. That is a deliberate choice and it is worth understanding what it means for you.

• You cannot "withdraw consent" to make us stop processing your account data, because consent was never the basis. What you do instead is end the contract: delete your account, and the processing stops and the data goes.
• You still have every other right: access, a copy, correction, erasure, portability, restriction and complaint. Nothing is weakened by this.
• Where we do rely on legitimate interests (analytics, security logs, the acceptance record), you have the right to object, and we will stop unless we have compelling grounds that override your interests. For analytics we will simply stop.
• The only thing we would ever ask consent for is optional marketing email. We do not currently send any. If we start, it will be opt-in, and unsubscribing will be one click.

6. Cookies and browser storage

We set no cookies. There is no cookie banner on this site because there is nothing to consent to, not a dark pattern, just an absence.

The application does use your browser's localStorage, which stays on your device and is never transmitted to us. It holds your preferences: your light/dark theme choice, your threshold method, whether you want background pixels ignored, and whether you have already seen the support prompt. You can clear it at any time through your browser settings.

Analytics uses sessionStorage for a single randomly generated session identifier, described in section 4b. It is not a cookie, it is not sent to any other site, and your browser deletes it when the tab closes. Its only job is to group one visit together so we can measure how long people stay and whether a page answered their question.

When accounts launch, signing in will store a session token in your browser. That is strictly necessary to keep you signed in, and it is not used for tracking. Our edge provider, Cloudflare, may also set a strictly necessary security cookie to detect abusive traffic.

7. Who else processes data

We use a small number of service providers ("sub-processors"). Each is bound by a data processing agreement, may only act on our instructions, and none of them receives your images, because we do not have your images.

ORCID is not a sub-processor: it is an independent organisation. If you choose to sign in with ORCID, you authenticate on ORCID's own site under ORCID's privacy policy, and ORCID learns that you signed in to Colocalizer. We receive only your ORCID iD.

We do not sell, rent or trade personal data, and we run no advertising, no ad pixels and no data-broker integrations. If we ever add a sub-processor we will update this list before it starts processing, and email account holders if the change is significant.

8. International transfers

We are in Uruguay and our providers are largely in the United States, so personal data does cross borders. Here is how that is covered.

• To Uruguay: the European Commission has recognised Uruguay as providing an adequate level of data protection (Decision 2012/484/EU), and confirmed that finding in its January 2024 review of pre-GDPR adequacy decisions. Personal data can therefore flow from the EU and EEA to us without Standard Contractual Clauses or any additional safeguard. Uruguay's own data protection law is Ley N° 18.331, supervised by the URCDP.
• To the United States (AWS, PostHog, Polar, and Cloudflare as a US company): these transfers are made under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), incorporated into each provider's data processing agreement, together with the technical and organisational measures in section 11. Several of these providers are additionally certified under the EU-US Data Privacy Framework, which we treat as a supplementary comfort rather than our primary safeguard.
• From the United Kingdom: the same clauses apply, extended by the UK International Data Transfer Addendum. The UK also recognises Uruguay as adequate.

You can ask us for a copy of the relevant transfer safeguards by emailing [email protected].

9. How long we keep things

We keep personal data only as long as it is doing a job.

Deletion means deletion from live systems immediately and from backups as those backups expire, within the windows above. We do not keep a shadow copy "just in case".

10. Your rights, and how to use them

If the GDPR applies to you, as it does for researchers in the EU, the EEA and the UK, you have the following rights. Uruguay's Ley N° 18.331 grants closely equivalent ones, and we apply the same standard to everyone regardless of where they live.

• Access: ask what personal data we hold about you and get a copy.
• Portability: get your data in a structured, machine-readable format. Your saved analyses export as CSV or JSON, and the export button in the app does this without you needing to ask.
• Rectification: have anything inaccurate corrected.
• Erasure: have your data deleted. Deleting your account does this; you can also ask us. We will keep only what we are legally required to keep, such as tax records, and we will tell you if that applies.
• Restriction: ask us to pause processing while a dispute or a correction is worked out.
• Objection: object to anything we do on the basis of legitimate interests, including analytics and the acceptance record.
• Withdraw consent: where we rely on consent. Today that is only optional marketing email, which we do not currently send. Withdrawing consent does not affect processing that already happened.
• Complain: to a supervisory authority. See section 17.
• Human review: not applicable here, since we make no automated decisions about you (see section 15).

To exercise any of these, email [email protected]. We reply within 30 days, and usually much sooner. It is free. We may ask you to confirm control of the email address or ORCID iD on the account, not to obstruct you, but so we do not hand your data to someone else.

Note the limit of what we can do: we cannot give you a copy of your images or delete them from our systems, because we never had them.

11. How we protect data

• Encryption in transit. The site is served over HTTPS with HSTS. Modern TLS only.
• Encryption at rest. Stored files and database contents are encrypted by the cloud provider.
• Least privilege. Every component gets only the access it needs. Our deployment pipeline uses short-lived federated credentials rather than long-lived cloud keys.
• No passwords to steal. Sign-in is by one-time email code or ORCID, so there is no password database to breach.
• Workspace isolation. Saved analyses are scoped to your workspace, and the fingerprint key is per workspace, so a stored value from one workspace is meaningless in another.
• A hardened front end. A strict Content Security Policy, security headers and a web application firewall sit in front of the site.
• Minimisation as architecture. The strongest protection here is not a control we operate: it is that your images are never in our systems in the first place. Data we do not hold cannot be leaked, subpoenaed or misconfigured.

No system is perfectly secure, and we will not pretend otherwise. We will say clearly what we do, and tell you promptly if it fails.

12. If something goes wrong

If a personal data breach happens, we will investigate immediately and contain it. Where the breach is likely to be a risk to people's rights, we will notify the relevant supervisory authority (Uruguay's URCDP, and any competent EU or UK authority) within 72 hours of becoming aware of it, as those laws require.

Where the risk to you is high, we will contact you directly and in plain language: what happened, what data was involved, what we have done, and what you should do. We would rather tell you early and be embarrassed than tell you late.

13. Research data and clinical use

Colocalizer is a research tool and not a medical device. It is not approved by any medical device regulator and must not be used for clinical diagnosis, screening, treatment decisions or patient monitoring. See section 2 of the Terms of Use.

We do not process protected health information on our servers, and the service is not designed or contracted for it. If your images are patient-derived, browser-only analysis is exactly the right shape for that work, but remember that filenames do reach us if you save results, so use non-identifying filenames. You remain the controller of your research data at all times, and you are responsible for the ethical approvals and consents behind it.

14. Children

Colocalizer is a professional research tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

15. Automated decisions

We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you. No algorithm here decides anything about you.

16. Changes to this policy

We will update this policy as the service grows; accounts and paid plans in particular will bring changes. Every version carries the version date shown at the top of this page.

• For material changes (a new purpose, a new sub-processor that receives more than the current ones, a longer retention period, or a change of lawful basis), we will email account holders at least 30 days before the change takes effect.
• For clarifications and corrections, we publish the new version and update the date.
• We will not start using data we already hold for a genuinely new purpose without telling you first, and asking you where the law requires it.

17. Contact and complaints

Privacy questions, requests and complaints: [email protected]. Please tell us first; we would like the chance to fix it.

You also have the right to complain to a supervisory authority:

• Uruguay: Unidad Reguladora y de Control de Datos Personales (URCDP), the authority for our home jurisdiction.
• European Union / EEA: the data protection authority of the country where you live, work, or where you think the problem happened.
• United Kingdom: the Information Commissioner's Office (ICO).

Colocalizations · empresa unipersonal, Uruguay