Privacy policy
Last updated 14 September 2026
Who we are
Arion is a tool for running systematic reviews and finding research collaborators. It is run by its two founders, Rishal and Ahmad, as individuals; there is no company yet. They decide how your data is used, which makes them the data controllers. Contact them about anything on this page at privacy@arionresearch.xyz.
What we collect
- Your account: your email address and a password, which is stored only in hashed form. If you sign in with Google, we receive your name, email address and Google account identifier instead of a password.
- Your profile: your name, handle, a short bio, interests, stated seniority, job title and institution, a photo if you add one, and who may see your profile.
- What you prove about yourself: extra email addresses you confirm and your ORCID iD, each with the date it was confirmed.
- Your review work: the reviews you create or join and everything you put into them, such as searches, references, PDFs and screening decisions.
- Technical records: our hosting provider keeps short-lived request logs, which include IP addresses.
Arion is for published research and researcher profiles only. Do not upload patient data. Arion is for people aged 18 and over.
Why we use it, and on what legal basis
- To run your account and your reviews, and to send you emails the service needs, such as confirmation links: this is necessary to provide the service you signed up for (contract).
- To show your profile and verification badges to other researchers, within the visibility you choose: our legitimate interest in helping researchers find and trust each other. You can limit or hide your profile in your settings.
We do not send marketing emails, show adverts, or sell or share your data for anyone's marketing.
Who processes it for us
- Supabase: database, sign-in and file storage, in London.
- Vercel: website hosting (a US company).
- Resend: sending email (a US company).
- Google: only if you choose to sign in with Google.
- ORCID: only if you choose to link your ORCID iD.
Where data goes to the United States, it is protected by the providers' standard contractual clauses approved for transfers out of the UK.
How long we keep it
- Your account and profile: until you delete your account, with the Delete account button at the bottom of Settings, or by emailing the address above. Deleting removes your profile, confirmed addresses, ORCID link, photo and sign-in details straight away.
- What stays after deletion: an empty account record holding only a random identifier and the date it was deleted, kept so a deleted account can never be brought back by mistake.
- Backups: deleted data leaves our backups within 30 days, as old backups expire.
- Old handles: when you change your handle, or delete your account, we keep a record that you held it. The handle itself is kept for you for seven days, so you can switch back; after that anyone can take it. Until somebody does, it still points at your profile.
- Your permanent link: the address of your profile is kept permanently, including after you delete your account, and is never given to anyone else. After deletion it says only that the profile has been deleted. We keep it so that a link to you in a published paper can never quietly start pointing at somebody else. Handles work the other way round: they are meant to be changed, so cite the permanent link rather than a handle.
Cookies
We use essential cookies: the ones that keep you signed in, and short-lived ones that protect sign-in with Google and ORCID linking. Two more remember whether you have hidden the review sidebar and how you last chose to view the data on a review. We use no analytics or tracking cookies.
Your rights
You can ask for a copy of your data, ask us to correct it, delete it or restrict how we use it, object to how we use it, or ask for it in a portable form. Email privacy@arionresearch.xyz. If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.