Privacy
What this website and the Nucleora application collect, where it goes, and what they do not do. Last updated 19 October 2026.
The short version
This website runs no analytics, no advertising pixels and no third-party tracking scripts. Nothing is loaded from a third-party script host. The only personal data collected is what you type into the contact or waitlist form, plus the network metadata described below.
The Nucleora application is a hosted service, and it works differently from this website. When you use it, the sequences and constructs you work on are sent to Nucleora's servers to be computed. The section The application below says exactly where they go.
The free calculators on this website's Tools pages are the exception: they compute in your browser and send the sequence you paste nowhere.
What the forms collect
Two forms submit data — the waitlist form and the contact form — both handled by Cloudflare Functions running at the edge.
| Field | Waitlist | Contact | Source |
|---|---|---|---|
| Name | yes | yes | you type it |
| Email address | yes | yes | you type it |
| Organisation | yes | yes | you type it |
| Sector | yes | — | you select it |
| Enquiry type, subject, message | — | yes | you type it |
| IP address | rate-limiting only | rate-limiting only | your connection; not stored with your submission |
| Country | yes | yes | derived from your connection |
| Timestamp | yes | yes | time of submission |
Your country is stored with the submission. Your IP address is not: it is used only to rate-limit abusive traffic, under a key that expires within the hour. An IP address is personal data in the EU and UK, which is why it is described here rather than treated as invisible infrastructure detail.
Where it is stored, and for how long
Submissions are written to Cloudflare Workers KV and are also sent to the operator by email.
Records are deleted automatically. The expiry is set in code, on the write itself, so it applies without anyone having to remember to run anything:
- Contact messages: 180 days.
- Waitlist entries: 365 days.
We no longer store your IP address with the submission at all. It is used only to rate-limit abusive traffic, under a separate key that expires within the hour, and it is not written into the record of what you sent. The stored record is your name, email, organisation, the fields you filled in, and a timestamp.
One honest exception: submissions made before October 2026 were written without an expiry and are not covered by the periods above. They remain until deleted by hand. If you sent something before then and would rather it were gone, ask using the contact route below and it will be removed.
The application
The application at app.nucleora.org is a browser interface. It
does not compute anything itself. Each calculation you run is sent over HTTPS
to api.nucleora.org, a Cloudflare Worker that checks your sign-in
and applies rate limits, and from there to Nucleora's computation service on
Google Cloud Run in the us-central1 region (United States), which
returns the result.
A project you save is stored in Nucleora's database on Cloudflare (Cloudflare D1), linked to your account.
Some features are lookups in public databases (NCBI, UniProt, Ensembl, RCSB
PDB, the AlphaFold database). Nucleora's server sends those the query or
identifier you entered. One feature sends a sequence to a third party:
predicting a protein structure for a sequence that has no UniProt accession
posts that protein sequence to Meta's public ESMFold service
(api.esmatlas.com). The application labels which route produced
each structure. The LIMS export sends data only to an endpoint and key that
you configure yourself.
The Nucleora desktop application is a window onto the same service. It is built so that the computer holds nothing of use: it does not store your password or session token, and it keeps no copy of your sequences or projects on disk.
The application also sends start-up performance timings, error reports and usage events to Nucleora's own API, by the same route as your calculations. It loads no third-party analytics or tracking script.
A retention period for application data, and a full statement of what those events contain, have not been published yet. Until they are, ask through the contact page if you want to know what is held for your account or want it deleted.
What we do not do
- No analytics or telemetry on this website. (The application is covered separately in The application.)
- No advertising, ad networks or remarketing.
- No sale or sharing of personal data.
- No tracking cookies set by this site.
Your rights
If you are in the EU, the UK, or a jurisdiction with comparable law, you may ask for a copy of what we hold about you, ask for it to be corrected, or ask for it to be erased. Use the contact form and say which you want. The records are keyed by email address, so the address you submitted is what we need in order to find them.
Processors
Cloudflare provides the hosting, the edge functions and the KV store for this website, and the API gateway and project database for the application. It therefore processes this data on our behalf. Google Cloud (Cloud Run) runs the application's computation service and processes the sequences sent to it. Email delivery to the operator passes through the configured mail binding.