Privacy statement

Themescape is run by Themescape Limited, a New Zealand company, number 9459933, with its registered office at 168 Hawthornden Road, Avonhead, Christchurch 8042. We follow the Privacy Act 2020 and its information privacy principles. Our privacy officer is Charlotte Price, and you can reach her about anything in this statement at support@themescape.co.nz.

Your research data stays on your computer

Themescape is built so that your research data never reaches us. When you open your files in Start a project, or import a project from your coding software such as NVivo, your web browser reads them on your own computer. Your quotes, codes, themes, definitions and notes are not uploaded to Themescape, and we do not store your projects. When you save your progress, the files, including any layout file that holds your arrangements and figures, are downloaded to your own computer. Your research data therefore stays in the storage you have chosen and your ethics approval describes.

The app keeps a few settings in your browser so that it behaves the same way next time. These are your viewer settings, whether field explainers are on, how you have set out the side panels, which tips you have put away, the options you last chose in Figure export (never a figure's title or note), and a random code that identifies the browser for the sign in alerts described below. The student app also keeps your stage progress, so that you can carry on where you left off. Nothing from your project, such as your data, layouts or built figures, is kept in the browser: it lasts only while your project is open, and Your progress saves it to your own computer. If you ticked Keep me logged in on this device, the browser also keeps you signed in until you log out; otherwise you are signed out when you close the tab. Apart from the browser code, none of this leaves that browser. The tick box in Log out & exit, which is ticked unless you untick it, clears these settings, so please log out with it ticked when you finish on a shared computer.

The coding template can be downloaded from the app as a spreadsheet, or copied into your own Google Drive from a link in the app. A copy in your Google Drive belongs to your Google account, and Themescape cannot see it.

The rule that your data never leaves your computer has one exception, Google Sheets, which happens only if you choose it. You can connect a Google Sheet instead of loading files, in one of 2 ways: by its link, described here, or by signing in with Google so that you can save back to it, described in the next section. The sheet must then be shared so that anyone with its link can view it, and your browser reads it directly from Google. Anyone who obtains the link can open the sheet, and Google handles it under its own privacy policy. Please use this option only for data that is not confidential, such as a teaching example or synthetic data. Do not use it for participant data, identifiable data, or any data that your ethics approval requires you to keep private.

In Model mode, Start a project has an optional Look up button that finds the citation for the published model you are using. When you click it, your browser sends only the DOI or PubMed number you typed: to Crossref, to Europe PMC for a PubMed link, and to Unpaywall, which says whether a legal free copy of the paper exists. Unpaywall asks every request to carry a contact email address, so it also receives support@themescape.co.nz. Like any website, these services see your browser's internet address. Nothing from your project, such as your data, codes, quotes or notes, is sent, and Themescape does not receive the lookup. Crossref, Europe PMC and Unpaywall handle these requests under their own privacy policies.

Saving back to a Google Sheet (paid plans, opt in)

If you choose Connect with Google to save back, you sign in with Google in your own browser and pick one sheet. Themescape asks Google only for access to files you open with it (Google's drive.file permission), and your browser reads and writes that sheet directly through Google's Sheets API. When you click Save to sheet, your working definitions, connections and notes, preferred-quote stars and Custom placement layout are written to that sheet; verbatim quotes are never changed. Nothing passes through Themescape's servers, Themescape keeps no copy of your sheet, and the sign-in lasts only while the page is open and is never stored. Google's own terms and privacy policy apply to what is in your sheet. You can remove Themescape's access at any time at myaccount.google.com/permissions. Use this only for data you are comfortable keeping in Google Sheets; load participant data as CSV files instead. Themescape's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we collect about you

When you create an account, we collect your first and last name, your email address, your university or organisation, and your role. We also record whether you would like occasional updates from us, and that you were shown this statement, with its version and the date.

You can sign in with an email address and password, or with your Google or Microsoft account. Passwords are handled by Google's Firebase Authentication service and are stored only in a scrambled form that no one at Themescape can read. If you sign in with Google or Microsoft, that company confirms who you are and shares your name and email address with us. Google may also share a link to your profile picture, which Themescape does not use. We never receive your Google or Microsoft password, and we cannot see anything else in those accounts.

If you choose the Student plan, we confirm that you study at a university. When your login email is a university address, that address is enough. Otherwise we send a 6 digit code to a university email address you give us, and once you enter the code we keep that address and the date you confirmed it.

You can add a profile photo on the Account page if you wish. Your browser crops it to a square and shrinks it to 160 pixels before sending it, so we never receive the original. We keep this small copy with your account and show it on your account button and your Account page. You can remove it at any time on the Profile tab, and it is deleted when you do.

The Profile tab lets you link your account to a university only if your login email belongs to it. To check this, our server compares the part of your email address after the @ with a public list of universities and their email domains, published on GitHub under an open licence, which we refresh on the 1st of each month and add to when a university is missing. Only the domain of your address is compared. We do not contact your university, and the check tells no one that you use Themescape.

Each time you log in, your browser sends us the random code it created for itself. We store a scrambled version of the codes for up to 20 browsers per account. When a browser we have not seen before signs in to your account, we email you the time, the type of browser and the operating system, so that you can act if it was not you. We do not record your location.

We keep 2 further records to limit misuse. When you change your login email, we keep your previous address with your account, so that the change can be undone if it was not you. When someone asks for a password reset, we keep a scrambled form of the address entered and a count of requests for 30 days, so that reset emails cannot be sent too often. We also record whether you have hidden the getting started checklist on your Account page.

While Themescape is in beta, each tester signs a confidentiality agreement online before using the app. We keep the name you signed with, your login email, the date and time, whether you signed with the tick box or a typed name, and the version of the agreement, and we email you a copy.

Payments are handled by Stripe. When you start a plan, Stripe's checkout page collects your card details, your billing address and, if you give one, your tax number, and Stripe uses your address to work out the GST or other tax that applies. We never see or store your full card number, though Stripe gives us its last 4 digits and its expiry date, which appear in our receipts and payment reminders. We keep a link between your account and your Stripe customer record so that we can tell whether your plan is active, and Stripe tells us about each payment, such as its amount, its date and whether it went through. You manage your plan and your card in Stripe's billing pages, which open from Manage billing on your Account page.

If you buy seats for a team or an organisation, we keep its name and the email addresses of the people you give seats to, and each person's name once they join. When you add someone, we email them an invitation that names you and the team, gives your email address for replies, and links to this statement. Please add only people who expect to hear from us about Themescape. As the buyer, you can see each person's name, their email address and whether they have joined.

If you ask for a quote for an organisation, we keep the organisation's name, the numbers of staff and student seats, the billing period, any purchase order number, and the email address of the billing contact you name. Your request goes by email to our billing team, and the quote is issued as a Stripe invoice to that billing contact. Once the licence is paid, the person who asked for the quote becomes its administrator. The administrator can invite people, see their names, email addresses and whether they have joined, and see the licence details, including its end date and renewal invoices. Some organisation licences cover everyone with an email address at the organisation's domain, and for those we check your login email against that domain.

If you join with an activation code, we record which account used the code and when. To stop codes being guessed, we also count wrong attempts for each account over a day.

Emails we send

We send emails that are part of running your account, such as email confirmations, password resets, invitations, receipts, trial and renewal reminders, security alerts and replies to your messages. They come from addresses at themescape.co.nz and are sent through Resend, an email delivery service, which receives your email address and the content of each message. We have switched off Resend's open and click tracking, so we do not know whether you open an email or follow a link in it. If an email to you bounces for good, or you mark one as spam, Resend tells us and we note it with your account, with the date and which email it was, so that we can let you know your address is not receiving our emails. A spam report also turns off update emails. The note is deleted with your account. Stripe may also send you payment emails of its own.

We send occasional news and guidance about Themescape only if you ticked the box to receive updates. You can change your answer at any time on the Profile tab, and every update email has an unsubscribe link that takes effect straight away.

Messages and the website

When you use Request a feature or Report an error in the app, we receive your message, your name and email address, and the type of browser and operating system you are using. Report an error also adds technical details: the last error the app recorded, the page address, the view and mode you were in, and your browser's version information. These details are shown to you before you send them. An error message can occasionally include the name of a theme or code, so please check the details first, and do not paste quotes or other participant material into a message. Messages reach our support inbox, and we email you to confirm that we have it. Emails you send to hello@themescape.co.nz, billing@themescape.co.nz or support@themescape.co.nz reach the same team through Google Workspace.

The website at themescape.co.nz has forms for contacting us, joining the launch list and signing up for our newsletter. When you use one, we collect your name, your email address and anything you write, and keep them in a Notion database that our team works from. We send newsletter and launch list emails through Resend only to people who asked for them, and each one has an unsubscribe link.

The website also uses Google Analytics, with your agreement, to count visits and see which pages people read. It loads only after you accept analytics in the cookie notice. Google Analytics then sets cookies in your browser and records the pages you view, how you reached the site, your device and browser, and your approximate location, which Google works out from your IP address. Google does not store the IP addresses of visitors from the European Union or the United Kingdom. You can change your choice at any time through the cookie notice, and we keep analytics data for no more than 14 months.

Why we collect it

We use this information to create and protect your account, to check that your plan is active each time you open the app, to take payment and manage your plan, to let team buyers and licence administrators give seats to the right people, to send the emails described above, to answer your questions, and to see how the website is used. We use your role and organisation to understand who uses Themescape and to offer suitable plans, such as student pricing. We do not sell your information or use it for advertising, and the app uses no advertising, analytics or tracking tools.

Your name, email address, organisation and role are needed to create an account, and without them we cannot give you access. A profile photo and the updates box are optional, and leaving them out does not change what you can do in Themescape.

Where it is kept and who can see it

We use a small number of service providers to run Themescape, and some of them keep information outside New Zealand. Google runs most of the service. Your account details, profile photo, team seats, licence records and quote requests are kept in Google Cloud Firestore in Sydney, Australia, and the app reaches them only through our own server functions, which also run in Sydney. Sign in is handled by Google's Firebase Authentication, which runs only in the United States and keeps the email addresses, scrambled passwords, browser details and IP addresses it needs to sign people in and prevent abuse. Google serves the app from its worldwide network and keeps technical logs, such as each visitor's IP address, for periods of a few weeks to a few months. Each page of the app also loads its sign in code from Google's servers, so Google receives your IP address and browser details when you open it. Our team email runs on Google Workspace.

Stripe processes payments. Our contract is with Stripe New Zealand Limited, and Stripe stores payment information in the United States. Stripe processes this information for us, and also uses some of it for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.

Resend sends our emails. Themescape's emails leave from Resend's servers in Tokyo, but Resend stores email addresses, message content and delivery records in the United States. The Themescape website at themescape.co.nz is hosted by Cloudflare, which records each visitor's IP address in its logs to deliver the site and protect it from attacks, and which stores data mainly in the United States and Europe. If you sign in with Microsoft, Microsoft handles that sign in under its own privacy statement and shares your name and email address with us. Entries from the website's forms are kept in Notion, which stores data in the United States, and Google runs the website's analytics when you allow it. Our accountant receives billing records through Stripe and through Xero, our accounting software, which uses hosting providers based in the United States.

Google, Resend, Cloudflare, Notion and Xero act on our instructions and may not use your information for their own purposes. Each is bound by data protection terms that require it to protect personal information, and we remain responsible for that information under New Zealand law. Apart from these providers and our accountant, we share your information only where the law requires us to.

We protect account information by limiting who and what can reach it. Account records are held in a database that web browsers cannot open directly. The app reaches it only through Themescape's own server functions, which first check who is signed in. The keys that connect Themescape to Stripe and Resend are held in Google Secret Manager, outside our code. Every page and connection uses encrypted HTTPS. Only the Themescape team can see account records, and only when we need to in order to run the service or help you. Themescape Limited is owned by Integration Lab Limited, and our team uses Integration Lab accounts to run the service.

If a privacy breach happens that is likely to cause serious harm, we will tell the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires.

How long we keep it

We keep your account details while you have an account. If your account has no active plan, team seat or licence, we delete it 12 months after the later of your last log in and the end of your last membership, which lets you come back within that time without starting again. This includes accounts that never started a plan. We email you 30 days before the date, and logging in before then keeps your account.

The records of a team's seats are deleted 12 months after its plan ends, and the records of an organisation licence 12 months after the licence ends. Quote requests are deleted 12 months after their last change, unless the licence they led to is still on record. Messages in our email inboxes, and contact messages sent through the website, are deleted 12 months after the conversation ends. Newsletter entries are kept until you unsubscribe. Launch list entries are deleted once we have sent the launch emails, so if you would like to hear from us after that, please join the newsletter.

When you delete your account yourself, the 7 day wait described below applies instead. After it, we delete your account record and your login, remove you from any team or organisation licence and from any quote you asked for, and ask Stripe to delete your customer record. Firebase Authentication removes deleted logins from its backups within 180 days. A profile photo you remove is deleted straight away.

Billing records, such as invoices and payment records, are kept for 7 years, because New Zealand tax law requires businesses to keep their records for at least that long. Stripe keeps its own payment records for at least 5 years to meet its legal obligations. Our providers' technical logs are kept for the short periods those providers set, from a few weeks to a few months.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it, and you can do much of this yourself. The Profile tab shows your details and lets you change them. Your data, on the Account page, downloads a file of your main account details, and you can email us for a complete copy of everything we hold about you. If you sign in with an email address and password, you can change your login email on the Account page, and we confirm the change with both your old and your new address.

You can delete your account from Your data on the Account page. Your login is switched off straight away, and the account is deleted 7 days later, with a link in our email that lets you keep it until then. A free trial ends as soon as you ask, so you are not charged during the wait. If you are paying for a plan or manage a team, you will need to cancel it in Manage billing and wait until it ends. If you manage an organisation licence, please email us first so that we can pass it to someone else. We will help if your situation is not straightforward.

You can also email support@themescape.co.nz with any request about your information. We will respond as soon as we reasonably can, and within 20 working days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

If you are in the European Union or the United Kingdom

The General Data Protection Regulation, or the United Kingdom's version of it, may also apply to how we handle your information, and Themescape Limited is the controller of your account information. We rely on 4 legal bases. Performing our contract with you covers your account, your plan, payments and service emails. Our legitimate interests cover security alerts, preventing the misuse of activation codes, the organisation check and understanding who uses Themescape. Your consent covers update emails, the newsletter, the launch list and website analytics, and you can withdraw it at any time. Our legal obligations cover keeping billing records.

You also have the right to object to processing based on our legitimate interests, to ask us to restrict processing, and to receive your information in a portable form, such as the Your data download. You can complain to the data protection authority where you live or work. The European Commission and the United Kingdom both recognise New Zealand as providing an adequate level of protection for personal data.

Children

Themescape is designed for researchers and university students and is not intended for children under 16.

Changes to this statement

We will update this statement when Themescape changes what it collects or how it uses information, and the date at the top shows the current version. If a change is significant, we will tell members by email. We record which version of this statement each member was shown when they created their account.

See also the Terms of use.