Sign in privacy

CSC Reports is operated by Stephen Brown. Contact stephen@iamsbrown.com about sign in, permissions or retained records.

Google provides a signed identity token. We verify your account identifier and email to check a report grant. Basic profile names and pictures are not retained. Google identity is used only for sign in and access administration. If Google cannot authoritatively verify ownership of an external email, you can give a five minute account code to someone sharing a report; it identifies your Google account and grants no access by itself.

The service stores account email addresses, verified account identifiers, report memberships and the account that shared a report. Other people with access to the same report can see its full audience email list and who shared access. They can add recipients to that report. Only the owner can remove access.

Records are stored in AWS in the United States (us-east-1). Authorized AWS administrators can access them. People permitted to retrieve deployment code can read the report package. Google and AWS process service data under their own service policies.

Report sessions last up to one hour; access sessions last up to fifteen minutes. Login challenges last five minutes. Pending first sign in expires after seven days. Removing a report grant blocks its subsequent private requests. Previously downloaded copies and already displayed pages remain with the viewer.

Current access records remain while access is maintained. Older state versions are scheduled to expire thirty days after replacement. Deployment and operational copies can also retain records. Generic service error logs are retained for seven days. Contact the owner to request correction or removal.