Privacy Policy

FORRT ORE — Open Research Extension · Last updated 16 October 2026

This policy explains how FORRT ORE — the Open Research Extension (“the Extension”) — handles data. The Extension is developed and maintained by FORRT — the Framework for Open and Reproducible Research Training — as part of the UKRI-funded project “Making Replications Count”.

1. Data controller

For the purposes of the UK and EU General Data Protection Regulation, the data controller is FORRT — Framework for Open and Reproducible Research Training, contactable at info@forrt.org.

2. What the Extension does

The Extension reads the page you are viewing to find academic paper identifiers (DOIs) and, where no DOI is present, article titles. It then looks up what is known about those papers — replication and reproduction studies, retractions and expressions of concern, post-publication comments, and open-access copies — and displays the result inline on the page.

The Extension's content script runs on all websites, because papers are cited everywhere: journals, preprint servers, blogs, reading lists, library catalogues. It reads page content only to find identifiers and titles; it does not transmit page content itself. You can switch it off for any domain from the toolbar popup, and disabled domains are never scanned.

3. What data is processed

• DOIs found in page metadata, links, tables and visible text. Sent to the services listed in section 5 to retrieve information about those papers.
• Article titles (and, where available, author and year hints) for papers that carry no DOI on the page. Sent to Crossref and OpenAlex to resolve the correct identifier.
• Your contact email address, if you enter one in settings. It is used solely as the mailto / email parameter that Crossref, OpenAlex, Unpaywall and NCBI ask API users to supply as a contact address. It is stored in Chrome's sync storage, is sent to those four services only, and is never sent to FORRT's own servers.
• The list of DOIs behind a Replication Atlas link — the papers on a page that have replication records — but only when that list is too long to travel inside the link itself. The Extension sends it to FORRT's replication API as soon as the page summary showing the link appears, so the link is ready to open; you do not have to click it for the list to be sent. The Extension encrypts the list on your device first, so what reaches FORRT is unreadable, and the API returns a short identifier, which the Extension turns into a link. The list is not sent for ordinary lookups, and a short list travels in the link with no copy stored anywhere. What the list reveals is which papers you grouped together, which is why it is stored the way section 11 describes.
• The URL and hostname of the current page, used within your browser to scope scanning and to apply your per-domain settings. Article-page PubPeer lookups also send the page URL to PubPeer. If you choose to report an issue, the report may include page information; review it before sharing.
• Google Sheets content, when you have a Google Sheet open: the Extension requests that sheet's own export endpoint using your existing Google session in order to read paper identifiers from rows outside the visible area. That request goes to Google only — nobody else receives the sheet or its contents. Identifiers found in it are then looked up like any other.

The Extension does not collect:

• Names, accounts or sign-in details — there is no account to create
• Browsing history for tracking or analytics
• Automatic analytics, telemetry or crash reporting
• Cookies for tracking or advertising

4. Storage on your device

• Settings (chrome.storage.sync): your contact email, citation style, cache limit, disabled domains, muted PubPeer commenters and the “Offer Copy log after each pass” preference. Because this uses Chrome's sync storage, these settings are synchronised across browsers you are signed into — that synchronisation is performed by Chrome under your Google account, not by FORRT.
• Cache (chrome.storage.local): results of the lookups described above, together with the retraction list, kept so that revisiting a paper does not repeat every request. Entries expire, and a shared soft limit covers all provider caches (50 MB by default; any limit you set is raised to at least 10 MB, and a limit of 0 means unlimited). Expired entries are removed first, then older entries; some provider caches are removed as a whole. Settings, diagnostic reports and the retraction list are outside this limit. The cache stays on your device and is never transmitted. Uninstalling the Extension, or clearing its storage from your browser, removes it.

Optional diagnostics: debug mode stores a bounded local log, which can contain paper identifiers, titles and page information. The issue-reporting tools let you review, copy, download or clear a report before you use it. Your configured contact email is excluded from reports, as is the key half of any Atlas set link, so a report cannot hand a reader the DOI list behind one. “Report an issue” opens GitHub's new-issue form with the report prefilled, so GitHub receives the report as the form opens; the issue becomes public only when you press GitHub's own submit button. The report goes nowhere else.

5. Services the Extension contacts

To do its job the Extension makes requests to the following services. Each receives only what is listed.

Title matching alternates which of Crossref or OpenAlex is queried first. The other service is contacted when the first fails or returns no single DOI. Both may therefore receive the same title.

For a long Atlas link, ORE sends the DOI list to FORRT to create a stored set and uses its identifier in the link. This happens while preparing the link, before you click it. The separate Meta Report share link encodes its report in the URL fragment instead.

Retraction status is determined locally. The Extension downloads the retraction list about once a week and checks papers against it on your own device, so no DOI is ever sent anywhere in order to ask whether a paper has been retracted.

No data is sold, rented or shared with data brokers, advertisers or analytics companies, and none of it is used for advertising.

6. Legal basis (GDPR)

Where GDPR applies, the legal basis for this processing is legitimate interest (Art. 6(1)(f)): providing the inline functionality you installed the Extension to perform. The data involved is, in the ordinary case, publicly available scholarly identifiers rather than personal data about you. The one exception is the contact email you choose to enter; you supply it voluntarily, it is used only as described in section 3, and you can remove it at any time in settings — the Extension then stops making the requests that require it.

Local storage is used strictly for the Extension's own function and not for tracking or advertising.

7. Retention

• FORRT API requests retrieve evidence for the submitted DOIs. DOI sets created for long Atlas links are stored by FORRT so those links can retrieve the list later; they are separate from the lookup cache on your device. Each set is encrypted on your device before it is sent, under a key generated for that set alone and kept only inside the Atlas link — FORRT never receives the key, so FORRT cannot read the DOI list. Anyone you give the link to can, so treat it as you would the list itself. A set expires 30 days after it is created, after which its link no longer opens it, and the encrypted record is then deleted automatically, usually within a few days; clearing extension storage does not delete one early.
• Third-party services (Crossref, OpenAlex, Unpaywall, PubPeer, NCBI, Google) apply their own retention policies to requests they receive.
• GitHub issue form holds a prefilled report only in the open form until you submit it; closing the form discards it. An issue you do submit is public and kept by GitHub under its own terms.
• Local cache and settings remain on your device until they expire, are evicted, or you clear the Extension's storage or uninstall it.

8. International transfers

The FORRT replication API is hosted on Amazon Web Services in the eu-central-1 (Frankfurt, Germany) region. The third-party services in section 5 are operated in other jurisdictions, including the United States; they are named there so that you can see exactly which services are involved, and the per-domain switch lets you stop the Extension running on any site.

9. Your rights

Under GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability where applicable, and to complain to your data protection supervisory authority.

In practice, FORRT holds nothing that identifies you: there is no account, the Extension's data lives in your own browser, and the only personal datum involved — your contact email — is stored on your device and sent onward only to Crossref, OpenAlex, Unpaywall and NCBI. You can exercise the practical equivalent of these rights yourself at any time by editing or clearing your email in settings, clearing the Extension's storage, or uninstalling it. A stored DOI set is a special case. It expires 30 days after it is created: from then on its link no longer opens it, and the encrypted record is deleted from FORRT's database automatically, usually within a few days. Because FORRT's database holds no key for a set and nothing linking it to you, we can neither read one to confirm it is yours nor attribute one to you from our records alone. Discarding your copy of the link only removes access through that copy: it does not revoke copies you have shared or delete the stored set, which anyone holding the complete link can open until it expires.

If you would like FORRT to look into anything on your behalf, write to info@forrt.org and we will respond.

Under California's CCPA/CPRA and similar US state laws: the categories of data processed and the third parties involved are disclosed in sections 3 and 5; you may delete the Extension's data at any time as described above; and no data is sold or shared as those laws define the terms.

10. Children's privacy

The Extension is intended for researchers, students and other academic users, generally aged 16 and over. It is not directed at children and does not knowingly collect data from them.

11. Security

All requests are made over HTTPS. Data stored locally is subject to your browser's own security model.

DOI sets are encrypted on your device. When the Extension stores a list of papers for a long Atlas link, it generates a fresh 256-bit key for that one list in your browser, encrypts the list with AES-256-GCM, and sends FORRT only the result. FORRT stores that ciphertext and returns a short identifier; the Extension adds the key to the link itself. When the link is opened, the Atlas page fetches the ciphertext and decrypts it in the reader's browser. Because the encryption is authenticated, a record altered in storage is rejected rather than shown. Each list has its own key, so one link that leaks exposes one list.

The key is not included in the HTTP request, but the Atlas page's JavaScript can read the fragment and decrypt the set. This protects against API or storage access, not against code served by the Atlas origin.

Treat an Atlas set link like a password: anyone who has the whole link can read the list until it expires, while the short identifier without the key reads nothing.

The Extension requests only the browser permissions it needs — storage, extended storage for its cache, and access to the tab you are actively viewing, plus alarms for scheduled maintenance — and its full source code is public.

12. Contact

Questions about this policy: info@forrt.org.

13. Changes to this policy

This policy will be updated as the Extension changes. The “last updated” date above reflects the most recent revision, and significant changes will be noted on this page.

This policy covers FORRT ORE only. Other FORRT services, such as the FLoRA Replication Atlas, may have their own policies.