Who runs Clio
Clio Online Museum (“Clio”, “we”, “us”) is a project run by Robert Evans in New South Wales, Australia.
This notice covers the public website at cliomuseum.org and the contributor workspace at cliomuseum.org/app. Clio aims to follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).
For any question or request about your information, email [email protected].
The short version
- Your private key, passphrase and recovery phrase stay on your device. Clio never receives them.
- Clio doesn’t store your email address when you verify a Google or Microsoft account as a contributor. It keeps a one-way code instead.
- Drafts are private. What you choose to publish is public, under CC BY 4.0, and linked to your contributor profile.
- Public pages use content-free measurement. The contributor workspace doesn’t.
- Clio doesn’t sell personal information or use it for advertising.
What Clio collects
Your contributor identity
When you set up a contributor identity, your browser creates a Ma’atara identity: a public identifier called a DID (decentralised identifier) and a matching pair of keys. Clio keeps your DID and public key so it can check that your contributions were signed by you.
Your private key stays on your device, protected by your passkey or passphrase. Clio never receives your private key, your passphrase or your recovery phrase.
Google or Microsoft verification
To create an identity, you verify a Google or Microsoft account. Today, Ma’atara’s sign-in service runs that step at auth.ma-atara.io. Ma’atara is a related identity project with the same owner as Clio. Because it runs the sign-in step, it receives the details Google or Microsoft share at sign-in, and it records which verified account is associated with your new DID.
From that step, Clio keeps only:
- which provider you used (Google or Microsoft);
- a one-way code (a hash) derived from your provider account ID; and
- one-way codes and times that show the verification happened.
Clio doesn’t store your email address, your name, your raw provider account ID or any sign-in token for contributors. It keeps these verification records with your account, and they’re designed not to be changed or deleted.
Drafts, contributions and versions
Drafts are private to you while you work. They aren’t listed or shown publicly.
When you publish, Clio keeps the signed record, the version you published and your acceptance of the deposit agreement for that version. A correction creates a new version linked to the earlier one. Earlier versions aren’t erased.
Images and other files
Before you upload, your browser checks each file for metadata that could reveal a location (such as GPS data), a person (such as an author or owner field) or the device used. The check runs on your device and reports which kinds of metadata are present, not their values.
For JPEG and PNG images, you can make a separate copy with that metadata removed. If Clio can’t safely clean a file, it tells you.
Clio stores each uploaded file with its original file name, type, size and checksums, plus a record of what the check found. Uploaded files are held in private storage. Only files attached to the current published version of a record are shown publicly. If you choose the cleaned copy, that copy is the one published; Clio keeps your original too. If you publish a file with its metadata, that metadata goes with it.
Clio may generalise or withhold a precise, sensitive location.
Your public profile
Your contributor profile is public by default. It shows your public handle, which Clio creates for you, and anything you choose to add: a display name, a biography, an ORCID iD and a website.
Your DID appears on your profile only if you turn that on. It’s off by default.
If you allow private contact about your published records, messages are held in Ma’atara’s private inbox. Your email address isn’t shown. See private contact below.
Private contact
PlannedPrivate contact isn’t open yet. We’ll update this notice before it is. Here’s how it is designed to work:
- The switch in your profile covers all your published, listed records. Turning it on lets visitors message you about any of them. Turning it off stops new messages for all of them.
- A visitor’s browser encrypts their name, email address and message so only you can read them, in your workspace. Ma’atara holds the encrypted message. Clio can’t read it, and visitors aren’t shown your name or email address.
- To check a visitor owns their email address, Ma’atara emails them a one-time code from [email protected]. Cloudflare Turnstile checks that a person is sending. To limit how often someone can send, Clio gives Ma’atara a keyed one-way code of the visitor’s IP address (for IPv6, of its /64 network), not the address itself.
- When a message arrives, Clio shows a notice in your workspace. It doesn’t email you.
- You can block a sender, delete a message, or report a message to Clio staff. A report holds the message’s reference, the reason you chose and any text you choose to paste into it. Only Clio staff see reports. Anyone can also report misuse to [email protected].
- Messages are deleted after 12 months.
Sign-in and security records
Clio records sign-in outcomes and, when available, your IP address, approximate country or region, and browser and operating system. Authorised administrators use these details to look into access problems and protect accounts. They’re not public.
Administrators can see these details for 30 days. They’re then deleted during routine clean-up, which can happen a little after the 30 days. Your private key, passphrase and recovery material are never included.
Clio also keeps a record of when each session started and ended, without your IP address, as part of your account’s security history.
Where connecting an ORCID iD is available and you use it, you sign in at orcid.org and ORCID tells Clio your iD. Clio keeps that iD, when ORCID confirmed it and when you disconnect it. Clio doesn’t keep your ORCID password, name, email address or access token; it asks ORCID to cancel the token straight away. A connected iD shows as verified on your public profile. You can disconnect it at any time.
Staff
Staff sign in to staff tools with Google or Microsoft. For staff, Clio keeps your name, the email address on the staff list, the email address and account ID your provider reports, and sign-in records. For the administration area, it also keeps your Cloudflare Access user ID.
Emails you send us
If you email [email protected], we receive your email address and message, and use them to reply. Clio’s mail service runs on Cloudflare. Clio doesn’t send email notifications to contributors; notices appear in your workspace. When private contact opens, the one email it sends is the one-time code to a visitor who writes to a contributor.
Planned: Clio’s own Google and Microsoft sign-in
PlannedThis isn’t live yet. We’ll update this notice before it is.
Clio plans to let members sign in directly with Google or Microsoft. Here’s what it is designed to do:
- Ask only for the standard
openid,emailandprofilepermissions. - Use a keyed one-way code (an HMAC) of your provider account ID as your account key. Your email address won’t be the key.
- If your provider confirms your email address is verified, keep a keyed one-way code of that email to stop duplicate accounts, but not the email itself. If it isn’t verified, no email code is kept.
- Read your name only to suggest a display name, without keeping it.
These keyed codes are pseudonymised personal information, not anonymous. Someone who held both Clio’s database and its secret key could test a guessed email address against them.
Cookies and browser storage
Clio sets cookies only to keep sign-ins working. They’re marked Secure and HttpOnly, so scripts in the page can’t read them, and they aren’t used for advertising or tracking.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-clio_session | Keeps you signed in to the contributor workspace. | Until you close your browser, and the server ends the sign-in after 1 hour. If you tick “Remember this browser”, up to 24 hours at a time; it renews only while your tab stays unlocked. |
__Host-clio_staff | Keeps staff signed in to staff tools. | Up to 8 hours. |
Sign-in step cookies (__Host-clio_oidc_state, __Host-clio_auth_ticket, __Host-clio_staff_signin, __Host-clio_staff_handoff) | Protect a sign-in while it’s in progress. | 10 minutes or less. |
Clio’s server stores only a keyed one-way code of your session cookie, not the cookie itself. When you choose to remember a browser, Clio keeps a link between renewed sessions and the original sign-in so that signing out ends all of them.
Your encrypted identity key is kept in your browser’s own storage on your device. In a private or incognito window, it’s removed when you close the window. The measurement script on public pages uses your browser tab’s session storage, described below.
Measurement on public pages
Public pages load a small measurement script so we can see which pages and features are used. It records:
- page views, grouped by page type, and clicks on certain links and buttons;
- whether you scrolled halfway or most of the way down, and whether you stayed on a page for 30 seconds;
- errors in the page;
- your screen size class (mobile, tablet or desktop); and
- how you arrived (direct, search, social, another site or another Clio page), worked out in your browser. The address you came from isn’t sent.
It uses a random ID kept in your browser tab, which resets after 30 minutes of inactivity. It sets no cookies. It doesn’t collect record content, form values, file names, identities, IP addresses or browser details, and it doesn’t record your session or fingerprint your device. Measurements are sent to events.rmesolutions.com.au, a measurement service that runs on Cloudflare, and are kept for 30 days.
If your browser sends Do Not Track or Global Privacy Control, the script doesn’t measure anything.
Cloudflare Web Analytics may also measure visits and page performance on public pages.
None of this measurement runs in the contributor workspace.
What’s public
Clio is a public museum. When you publish a contribution, it becomes public by default, under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). It’s linked to your public contributor profile and listed there. Published records can appear in Browse and search, and each has its own public page with its version details.
Write every field as if it will be public. Anyone may copy and reuse published material under CC BY 4.0.
What Clio never collects or sells
- Your private key, passphrase or recovery phrase.
- Your Google or Microsoft password.
- For contributors: your email address, your raw provider account ID or sign-in tokens from Google or Microsoft.
- Advertising cookies or advertising profiles.
Clio doesn’t sell personal information and doesn’t use it for advertising.
Where your information is processed
- Cloudflare hosts Clio’s website, services, database and file storage. It handles every request to Clio, so it processes your IP address and browser details to deliver and protect the site.
- Ma’atara provides Clio’s identity services: issuing and looking up DIDs, the current Google or Microsoft verification step, and the private contact inbox. Its services also run on Cloudflare.
- Google or Microsoft handle the sign-in you choose under their own privacy terms.
- The measurement service at events.rmesolutions.com.au receives the content-free measurements described above.
Cloudflare runs a global network, so your information may be processed outside Australia. We don’t give your personal information to anyone else unless the law requires it.
How long it’s kept
- Published records and their versions: Clio is designed to keep them, along with your acceptance of the deposit agreement. This isn’t a promise of permanent preservation.
- Drafts: kept with your account, including drafts you discard. A discarded draft is never published.
- Identity, verification and session records: kept with your account.
- Security details (IP address, approximate location, browser and operating system): 30 days, then deleted during routine clean-up.
- Measurements on public pages: 30 days.
- Private messages (once private contact opens): deleted after 12 months. Reports you make to staff are kept with your account.
Corrections and removal
You can change your profile at any time in the contributor workspace.
To correct a published contribution, publish a revised version from your workspace. The earlier version stays in the record’s history, so the change can be understood.
To ask for a copy of your information, a correction, or removal of something from public view, email [email protected]. There’s no self-service way to delete an account yet.
Clio can hide a record from search, restrict access to it, or replace its content with a short public notice that keeps its address working. Because records are signed, versioned evidence, Clio may keep a record’s history privately even when its content is no longer shown. Copies that others have already made under CC BY 4.0 can’t be recalled.
Your choices
- You decide when, or whether, to publish.
- Your display name is optional, so your profile can show just the handle Clio creates. Clio doesn’t offer anonymous publication: published contributions stay linked to your contributor profile.
- You choose whether to show your DID and whether to allow private contact. You can turn private contact off at any time in your profile, which stops new messages about all your records.
- You can publish a cleaned copy of an image instead of the original.
- You choose whether a browser is remembered. On a shared device, leave it unticked.
- Do Not Track or Global Privacy Control turns off measurement on public pages.
Children
Clio isn’t designed for children under 16, and it doesn’t check ages. If you’re under 16, use Clio only with a parent, guardian or teacher supervising you. Teachers planning classroom use can contact us first.
If you think a child has given us personal information without supervision, email [email protected].
Security
Clio is built so that your signing key never leaves your device, sessions are stored only as keyed one-way codes, and the site uses HTTPS. Access to security records is limited to authorised administrators. No system is perfectly secure, so keep your devices up to date and your recovery material private.
Contact and complaints
Email [email protected] with any question, request or complaint about your information. You may also be able to complain to the Office of the Australian Information Commissioner (opens in a new tab).
Changes to this notice
When Clio changes how it handles information, we’ll update this notice and its version and date. That includes before the planned Google and Microsoft sign-in goes live. See also the terms of use.
Version 1.0 · · Questions: [email protected]