Privacy statement
What the WEAVE Operational Repository at CASU (https://weave.ast.cam.ac.uk/WOR) knows about you, why, who can see it, how long it is kept and what you can ask us to do.
Last updated 13 October 2026.
In short
What we hold
Your account details (name, e-mail address, the surveys and permissions of your account), a record of when and from which network address you signed in, and what you asked the repository to do (searches by project members, data requests and downloads).
Why
To let you in, to give you the data your account is entitled to, to send the messages you ask for, to keep the service secure and to find out what went wrong when something does.
What we do not do
We do not use advertising or analytics cookies, we do not sell personal information, and we do not use it for anything other than running this service.
Your choices
You can ask to see, correct or delete what we hold about you (see Your rights), turn on two-factor sign-in, revoke your API tokens and choose which alert e-mails you get.
Who is responsible
The WEAVE Operational Repository at CASU is the archive and status service of the WEAVE survey. It is run by the Cambridge Astronomy Survey Unit (CASU) at the Institute of Astronomy, University of Cambridge. This statement applies to the use of your personal information (also known as "personal data") by the University of Cambridge through the viewing or use of this site.
When you visit any website in the University of Cambridge domain, the University also holds certain information about you for service and security reasons. See the University's web privacy policy.
What we keep and why
Reading this statement and the sign-in page needs no account. Everything else needs one. The table lists what the repository itself stores. All of it is stored in our own databases.
| What | Details | Why we need it |
|---|---|---|
| Your account | User name, full name, e-mail address, the survey or programme your account belongs to, the groups that decide what you may see and do, the date the account was created, the time of your last sign-in and the number of sign-ins. Your password is stored only as a salted hash, never in the clear. | To identify you, to show you only the data your account is entitled to, and to reach you about your account. |
| Two-factor sign-in | If you turn it on: the key of your authenticator app and ten backup codes, stored as hashes. A one-time code sent by e-mail is held only in your browser session for 10 minutes and is not written to the database. | To protect your account. It is optional today and strongly recommended. |
| Sign-in and access records | For sign-ins (also failed ones), sign-outs, second-factor steps, uses of API tokens, changes to your sign-in security (password, two-factor, tokens) and visits to the administrators' pages: the date and time, the network (IP) address, a description of your browser or tool (its family and version, not the full identification string) and a short reason code. Passwords, codes, tokens, cookies and what you typed in forms are never recorded. A summary of the browsers and addresses each account has used, with the time of the last visit and a count, is also kept. | To keep the service secure, to notice misuse of an account (guessing, sharing, stolen tokens) and to help with problems. |
| Administrators' actions | When an administrator changes an account, its groups or its team settings, retracts data, resets or re-ingests data, changes a setting or edits the site's content: who did it (also while viewing the site as another account), what changed (field names, never passwords or tokens), the time and the network address. | So that every change can be explained afterwards. |
| Data requests and downloads | Who asked, the search or file list, the time, the network address, the e-mail address you give for the completion message, the status and the amount of data delivered. Each download link carries a secret that works for that request only. | To prepare and deliver your data, to tell you when it is ready, and to see how the service is used. |
| Project members | If the holder of an account invites other people to work in it: their name, institute, e-mail address, what the account holder allowed them to do, and a record of their sign-ins, searches and downloads with network address and browser. One-time sign-in codes are stored as hashes. The account holder sees the members and their activity, but not their network addresses. | So each person signs in as themselves, and so every action can be attributed to a person. |
| API tokens | The name you gave a token, its permissions, its expiry, when and from which address it was last used. Only a hash of the token is stored. If you connect an outside tool through the sign-in consent page, a token is created for it in the same way. | So that you can use scripts and connected tools, and so that you can see and revoke them. |
| Alert preferences | The e-mail addresses you ask us to notify about processing of a survey's data, and which events you want. | To send the alerts you asked for. Nothing is sent unless you set it up. |
| E-mail we send | Sign-in codes, invitations, password-reset messages, data-request notifications and the alerts above, to the addresses held as described here. | To provide those functions. We do not send newsletters or marketing. |
| Changes by editors | Administrators edit the site's news, banners, links and documents on the site itself. Every change is recorded with the editor's user name, the time, the network address and the browser, and earlier versions are kept. Files they upload are stored on our servers. | To know who changed what, and to undo mistakes. |
| Web server logs | Like any web server, ours records each request: the time, the network address, the page asked for and the size of the answer. | To run the service, to measure the amount of data delivered and to investigate abuse and faults. |
The WOR Assistant (experimental)
Where it is switched on, the assistant panel and help chat send what you type to CASPER, a service run by the same project at casper.ast.cam.ac.uk, which uses a language model to prepare an answer. Along with it go a pseudonymous reference to you (not your name or e-mail address), the names of the permissions of your account and the pages and survey options your account is offered. No archive data and no session are sent. If the assistant cannot help and you tick the box to send a help request, your user name and e-mail address go with the request so the team can reply. Project members cannot use the assistant.
Opening a dataset in the Explorer
The Explore buttons send your browser to the PyAPS Explorer on the same project's hub. The link carries a short-lived signed token that names your user name, the surveys your account may see and the dataset to open. The Explorer reads the data files; it does not receive your password or e-mail address.
Viewing the site as another account
To help with a problem, an administrator can view the site as the account concerned. The site then shows a banner, and the administrator's own name is recorded with what they changed.
Cookies and similar storage
The site sets two cookies, both needed for it to work:
- A sign-in cookie: tells the site who you are on each page after you sign in. It is removed when you sign out.
- A session cookie: holds short-lived information for the visit, such as a one-time code you are about to enter or a message to show you after an action.
There are no advertising or analytics cookies and nothing is shared with advertisers. Your browser also keeps a few settings of its own for this site (the light or dark display, the density of tables, notices you have dismissed, assistant preferences). They stay in your browser and are not sent to us.
Other services your browser contacts
The site serves its own scripts, style sheets and fonts: the icon font, the plotting library and the sky-map library come from this site, not from an outside service. Opening a page therefore does not send a request to anyone else to load a program or a font. A few things still go to outside services:
- The sky map (CDS, Strasbourg: alasky.cds.unistra.fr): pages that show where an observation points (the more-information pages of frames, the observation log, the night and observation statistics and the QA statistics) draw a map. While a map is on the page, your browser fetches the background pictures and the description of the picture survey from the Centre de Données astronomiques de Strasbourg (CDS). The list of surveys the map knows is part of the map program that this site serves itself, so no program of CDS is run in the page. CDS sees your network address and browser type, as any web server does, and the picture tiles requested show which part of the sky the map is showing, which is where the observation points. Your name, your account and the address of the page are not sent (the browser names this site, not the page, as the referrer). If you choose another survey in the map's layer menu, the map asks that survey's server (nearly always CDS); if you type an object name in the map's search box, the name goes to the CDS name resolver. No outside service is contacted on a page without a map.
- Our server asks CDS: to pick a picture survey that covers the field, the server sends CDS the sky position of the field (coordinates and a search radius) when it builds such a page. Nothing about you is sent.
- The help widget: where the CASPER help widget is switched on, and only for people who have signed in, its script is loaded from casper.ast.cam.ac.uk, the service of the same project that is described above.
- Administrators only: next to a network address in the account list there is a link that opens a public address-lookup site (opentracker.net) with that address. Nothing is sent unless the link is clicked.
Links to other sites, such as the WEAVE archive server, the project wiki or the University of Cambridge, take you to sites with their own privacy statements.
Who can see it
- You: your account details, your tokens, your data requests and, in the access log, your own sign-ins.
- The holder of an account: the people they invited as project members, and what those members did, without network addresses.
- Administrators of the service (CASU staff): the list of accounts with names, e-mail addresses and surveys, the sign-in and access records, the record of administrators' actions, and the data requests. Reading the sign-in and access records is itself recorded.
- Managers appointed for a survey or programme: the list of accounts with names, e-mail addresses and surveys. They do not see the sign-in and access records.
- The services named above, only what is described there.
We do not give personal information to anyone else, except where the law requires it.
How long we keep it
| What | How long |
|---|---|
| Account details | While the account exists. To close an account, write to us (see Contact). |
| Sign-in codes and invitations | An e-mailed code works for 10 minutes and is used once; an invitation link works once for 7 days. The stored record of a code is deleted after 7 days. |
| Project members' sign-in, search and download record | 12 months, then deleted automatically. |
| Sign-in and access records | 12 months, then deleted. After 90 days the network address is shortened (the last part is removed) so that it no longer points to one device. |
| Summary of browsers and addresses of an account | Kept while the account exists (the last visit and a count for each browser and address). |
| Administrators' actions | 5 years, as the record of accountability. The network address is shortened after 90 days. |
| Data requests | Kept with the records of the data service. They are not yet deleted automatically. |
| Editors' change records | 2 years. Deleted items stay in a trash for 90 days before they are removed for good. |
| Web server logs | Kept for a limited time for operation and security. |
Security
- The site is served over an encrypted connection (HTTPS).
- Passwords, backup codes, one-time codes and tokens are stored only as hashes.
- What you can see and do depends on the groups and permissions of your account; the pages for administrators are closed to everyone else.
- Two-factor sign-in is available to every account holder; project members always sign in with a one-time code or an authenticator app.
- Administrators' changes and actions on behalf of an account are recorded, and so is every look at the access records.
No system is perfect. If you think your account has been used by someone else, change your password and write to us at once.
Your rights
Under data protection law you can ask us for a copy of the personal information we hold about you, ask us to correct it, and in some cases ask us to delete it, restrict its use, or stop using it. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think your information is mishandled. To use these rights, write to us at the address below.
For more about how the University handles personal information and your rights, see the University's data protection pages.
Contact
Questions about this statement, requests about your information, or a wish to close your account: .
Changes to this statement
When what the service stores or does changes, this statement is changed and the date at the top is updated. Significant changes are also announced under Updates & News on the home page. This statement was last updated on 13 October 2026.