Privacy Policy

DECfinder is operated by the Institute for Development Impact, I4DI. It is a free public research archive that preserves and provides access to documents from the USAID Development Experience Clearinghouse and other USAID-supported knowledge collections.

This policy explains what information DECfinder collects, how it is used and protected, the service providers involved in operating the archive, and the choices available to users.

DECfinder does not sell or rent personal information, run advertising, or use personal information to create advertising profiles.

Information we collect

Account information

When you register, we collect your email address, name, and username. You may also choose to provide a short biography. This information is used to operate your account and is not displayed to other users.

Passwords are stored as cryptographic hashes. DECfinder does not store or have access to passwords in plain text.

Security and account activity

We record registrations, sign-ins, document downloads, and other security-relevant activity. These records may include the date and time, IP address, browser user-agent, account identifier, and the action performed.

We use this information to authenticate users, secure accounts, investigate suspected misuse, enforce download limits, and protect the archive from automated extraction and other activity that could disrupt the service.

Session information

When you sign in, DECfinder sets a first-party session cookie. We also record information such as the session’s IP address, browser user-agent, creation time, and most recent activity. This helps us identify unauthorized account access; signing out or changing your password ends the associated sessions.

Search and site-use information

DECfinder records search terms, filters, and result counts to understand how the archive is being searched and to improve its organization and search functions. This information is not intentionally associated with your DECfinder account.

If you consent, we also use Google Analytics to measure site use, including page visits, traffic sources, browser and device information, and general geographic information. DECfinder does not use Analytics to associate document page views with named accounts or to create advertising profiles. Google advertising and ad-personalization features are disabled.

Information you save or submit

We collect information that you choose to save or send through DECfinder, including:

• bookmarks;
• notification preferences;
• document suggestions;
• corrections and document-issue reports; and
• messages sent through support forms.

This information is associated with your account where necessary to provide the requested function, review a submission, or respond to you.

How we use information

We use personal information to:

• create and manage accounts;
• authenticate users and maintain signed-in sessions;
• provide document downloads and saved research features;
• send email verification and password-reset messages;
• send notifications that users have chosen to receive;
• respond to support requests and document submissions;
• protect accounts, documents, and infrastructure;
• prevent scraping, abuse, and service disruption;
• diagnose technical problems; and
• understand and improve use of the archive.

We may also retain or disclose information when reasonably necessary to comply with law, respond to valid legal process, protect the security of the service, or investigate fraud or misuse.

Legal bases for processing

For users in jurisdictions that require a stated legal basis, I4DI processes personal information:

• to provide the account and archive services requested by the user;
• for I4DI’s legitimate interests in operating, protecting, maintaining, and improving DECfinder;
• with consent, where consent is required for optional notifications, analytics cookies, or similar technologies; and
• where necessary to comply with a legal obligation.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before consent was withdrawn.

Cookies

DECfinder uses a first-party session cookie to keep signed-in users authenticated. This cookie is necessary for account functions and expires when the session ends or according to the session settings described on the site.

Cloudflare Turnstile is used on registration and other forms to distinguish legitimate users from automated activity. Turnstile may use cookies or similar browser information when performing this verification.

Google Analytics uses first-party cookies, including cookies beginning with _ga, to measure use of the archive. Analytics cookies are not used for advertising. Analytics is activated only after you accept in the cookie banner. You can change that choice at any time through the Cookie settings link in the site footer. Declining Analytics cookies does not prevent access to the archive or its account functions.

Service providers

I4DI uses a limited number of service providers to operate and protect DECfinder. They process information on I4DI’s behalf for the functions described below:

• Cloudflare for content delivery, network security, and bot protection;
• Fly.io for application hosting;
• Supabase for database and account infrastructure;
• Resend for transactional email;
• Sentry for error monitoring and technical diagnostics;
• Google Analytics for site-use measurement; and
• Hugging Face for document file storage.

These providers receive only the information needed to perform their respective services and are subject to their own contractual and legal obligations.

We may replace or add providers as the service develops. Material changes affecting how personal information is handled will be reflected in this policy.

International processing

I4DI is based in the United States. Personal information may be processed in the United States and in other countries where I4DI’s service providers operate.

Where applicable law requires safeguards for an international transfer, I4DI and its providers use recognized contractual or legal transfer mechanisms.

Accounts migrated from the previous DECfinder site

If you registered on the previous DECfinder website, your email address, name, username, password hash, and bookmarks were transferred to the current platform so that you could continue using the archive without creating a new account.

The migration did not give I4DI access to your password in plain text. Your migrated information is now handled according to this policy.

Retention

We retain information according to the type of record and the purpose for which it was collected:

• Account information and bookmarks: while the account remains active and for up to 30 days after deletion to complete removal from active systems and backups.
• Active session information: until the session expires or is ended by the user, followed by up to 30 days where needed for security review.
• Sign-in, registration, security, and download logs: 12 months.
• Search statistics: 12 months.
• Google Analytics information: according to the retention period configured in the Analytics account, currently 14 months.
• Support requests, document suggestions, and correction reports: 24 months after the request is resolved.
• Backup copies: no longer than 30 days after removal from active systems, unless longer retention is required for security, legal, or disaster-recovery purposes.

Some limited records may be retained longer when necessary to investigate misuse, comply with legal obligations, resolve disputes, or protect the archive and its users.

Account deletion

You can delete your account through your account settings.

Deleting an account removes the active profile, bookmarks, and notification preferences. Information held in backups, security logs, completed support records, or records required for legal and security purposes may remain for the limited periods described above.

Deleting an account does not remove anonymous or de-identified statistical information that can no longer reasonably be associated with the account.

Your rights and choices

You can use your account settings to:

• view and edit your profile;
• manage notification preferences;
• change your email address or password; and
• delete your account.

Depending on where you live, you may also have the right to request access to personal information held about you, correct inaccurate information, request deletion, receive a portable copy, object to or restrict certain processing, withdraw consent, or appeal the response to a privacy request.

You may submit a privacy request through the support form or by contacting I4DI at [email protected]. We may need to verify your identity before completing a request. We will not discriminate against users for exercising privacy rights provided by applicable law.

Users in the European Economic Area or United Kingdom may also have the right to submit a complaint to the data-protection authority in their country.

Children’s privacy

DECfinder is intended for researchers, practitioners, students, public officials, and members of the general public. It is not directed to children under 13, and I4DI does not knowingly collect account information from children under 13.

Anyone who believes that a child under 13 has created an account may contact I4DI so that the account and associated information can be reviewed and removed.

Security

I4DI uses administrative, technical, and organizational measures intended to protect personal information from unauthorized access, alteration, disclosure, and loss.

No internet service or storage system can guarantee absolute security. Users are responsible for protecting their passwords and should contact I4DI if they believe an account has been accessed without authorization.

Changes to this policy

We may update this policy when DECfinder’s functions, providers, or information practices change.

The effective date at the top of the policy will be updated when changes are made. For material changes, we will provide notice on the site and, where appropriate, notify registered users by email or through their accounts.

Contact

Questions and privacy requests may be submitted through the DECfinder support form (when signed in) or sent to: