CERRA · Account privacy
Privacy & account data
Updated October 10, 2026. This notice explains how CERRA handles personal accounts, Google sign-in and shared Litter reviews.
Trial applications
Trial requests store your name, email, optional organization and intended use for administrator review. Applying does not grant access. Approved new applicants receive a single-use email invitation to choose a username and password; passwords are stored only as salted hashes. Administrators can view application details, decisions and invitation delivery status.
Information used to sign in
CERRA stores your email address, display name, account permissions and authentication activity. A team invitation lets you verify your Google account or email and submit an access request. After identity verification, access follows the invitation’s administrator-defined policy: either administrator review or a limited number of automatic approvals. Later requests wait for administrator approval. Approval records retain the policy and identity used.
Google supplies your account identifier, email, email-verification status and basic profile information. For a new team applicant, CERRA records the verified identity and Google display name for administrator review, and connects that Google identity only if a new account is approved. Existing accounts keep their identity and sign-in methods; connecting Google remains an explicit action in My account using the matching email. You can edit your CERRA display name in My account.
The Google sign-in flow requests only basic identity permissions. It does not request Gmail, Drive, Calendar or Contacts access. CERRA’s sign-in code does not save Google ID, access or refresh tokens in the account database.
Shared reviews and attribution
Your name and email are saved with Litter review decisions. Authorized Litter project members can view and export that attribution. Editing your display name does not rewrite the name on earlier reviews. Importing earlier browser reviews attributes the imported decisions to the account performing the import.
Cookies and service providers
Essential cookies maintain your CERRA session and complete Google sign-in. Display preferences and earlier review records may remain in your browser. Account records and authentication events support access control, troubleshooting and abuse prevention.
CERRA runs on Sites hosting with Cloudflare account storage. Google processes Google authentication. Resend processes your email address, name and message when CERRA sends an invitation, verification, sign-in or approval email. These services process information needed to provide those functions.
Your choices and record retention
Google sign-in is optional; invited members can also use an email sign-in link. You can edit your display name in My account and sign out at any time. You can remove CERRA’s connection in your Google Account settings, but this does not delete your CERRA account or past reviews.
Access requests, team-invitation metadata, accounts, authentication-audit and shared-review records do not currently have an automatic deletion schedule. Expired email-verification challenges are periodically removed. There is no self-service CERRA account deletion or Google-disconnection control. An administrator can disable account access and revoke CERRA sessions.
For account corrections, Google disconnection, deletion or other privacy requests, contact your CERRA administrator or Bo Shang at bshang@umd.edu. Requests involving shared research records require administrator review.