OPRA is designed to know as little as possible about you and what you do. This policy explains what we collect, how it's processed, and the rights you have under applicable data protection law.
OPRA will never request information such as your name, address, age, gender, phone number, employer, social security number or payment information.
To access OPRA, you need to provide a personal email address and create a password. You will also be required to upload documentation verifying your eligibility for access.
Your email address is used to log in and to send important account-related messages. You can opt in or out of occasional OPRA newsletters at any time. Your email is never sold, and is never shared or disclosed to third parties except the service providers who operate our login and email delivery on our behalf — they may not use it for anything else.
Your password is transmitted to OPRA's authentication provider over an encrypted connection. It is stored as a string that cannot be converted back into your password by anyone, including the OPRA team. Because no storage method is immune to guessing attacks, we strongly recommend a password you use only for OPRA.
All documentation uploaded is reviewed by a member of the OPRA team and deleted immediately afterward, whether or not access is approved. We keep only a record that your eligibility was verified.
OPRA uses the analytics tool PostHog to understand how the website and the app are used, so we can improve the service. PostHog is our data processor and processes the data on our behalf. The data is stored in PostHog's EU region. PostHog is used for product analytics only, never for marketing, and does not record videos of your sessions.
If you accept, PostHog stores a random ID in your browser (localStorage), or on your device in the app, so we can see how OPRA is used over time. We record which pages and screens you visit, what you click and search for, and choices you make, such as favourites and language. The statistics are not linked to your name, email address or account. On the website, they are then also sent to Plausible and Vercel Analytics, which are only used with consent.
If you decline, nothing is stored on your device except your choice. On the website, we still count visits anonymously and in aggregate. PostHog creates a code (a hash) from your IP address and browser information (user agent), combined with a salt that is replaced and deleted every day. The code cannot be turned back into your IP address, and we cannot recognise you from one day to the next. We only record page views, not clicks or searches, and not where you are. In the app, no usage statistics are sent if you decline.
Legal basis. Analytics with cookies is based on your consent (GDPR Article 6(1)(a)). The cookieless counting is based on our legitimate interest (Article 6(1)(f)) in knowing how many people use the website and which pages work, so we can run and improve it. We consider this interest to outweigh the impact on you, because the counting is anonymous and aggregated, nothing is stored on your device, and you cannot be recognised from day to day.
Retention. Analytics data is kept by PostHog for up to 7 years, which is the retention period of our plan.
Changing or withdrawing your consent. You can change your choice at any time. On the website, use “Cookies” at the bottom of the page or “Consents” on the profile page; in the app, use the profile page. If you withdraw your consent, we delete what PostHog has stored in your browser and switch to the anonymous counting. Your choice itself is stored in the browser and in the app, and you will be asked again if we change what we collect.
What is always stored is what the service cannot work without: your login, language choice and your answer to the consent question. OPRA also counts how many answer yes and no, without knowing who answered what. OPRA does not sell the analytics data and does not share it with anyone other than the providers named here.
Our partners may track activity generated from OPRA through one or more of the following methods:
OPRA uses Google Cloud Platform to securely store and manage your data.
You may request at any time the export or deletion of all data associated with your account. Deletion also occurs automatically when you delete your user from the profile page. If you wish to view your data, please contact us through the contact page.
You can delete your account and all associated data at any time by clicking the "Delete user" button on the profile page.
If anything is unclear about how OPRA handles privacy or data processing, please contact us.