Privacy Policy

1. Introduction

NetCDF Studio ("the Platform", "we", "us") is a scientific data processing application that converts IMDAA (Indian Monsoon Data Assimilation and Analysis) reanalysis archives and Google Earth Engine (GEE) geospatial datasets into structured, research-ready CSV datasets. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — used for authentication and account recovery
• Full name — used for personalization and membership records
• Phone number — required for membership contact details
• Research background — optional, used for membership review
• Research purpose — optional, used for membership review
• Google Account profile — if you sign in via Google, we receive your Google-verified name and email address. No additional Google profile data is accessed.

2.2 Research Data

When you use the Platform to process data, we temporarily store:

• Uploaded ZIP archives — IMDAA reanalysis files you submit for processing
• Generated CSV outputs — processed and corrected datasets
• Processing metadata — job IDs, timestamps, file sizes, and processing status

2.3 Usage Data

We automatically collect minimal operational data:

• Job processing requests and their status (queued, processing, completed, failed)
• Storage quota usage per account
• Authentication timestamps (login/logout events)

3. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and manage your account
• Process your IMDAA archive-to-CSV conversion requests
• Apply scientific correction modules (Temperature, Radiation, Vapor Pressure, etc.)
• Manage storage quotas and processing thread allocations
• Review and process membership applications
• Maintain system health, prevent abuse, and troubleshoot issues

3a. Lawful Basis for Processing (GDPR Article 6)

For users located in the European Economic Area (EEA) or the United Kingdom, our processing of your personal data is based on the following legal grounds under GDPR Article 6:

Purpose of Processing	Lawful Basis
Account creation and authentication	Article 6(1)(b) — Performance of a contract (providing the platform service)
Processing IMDAA/NetCDF conversion jobs	Article 6(1)(b) — Performance of a contract
Membership review and account administration	Article 6(1)(b) — Performance of a contract
Security monitoring, abuse prevention, and system health	Article 6(1)(f) — Legitimate interests (securing the platform and protecting users)
Storing encrypted third-party credentials (GEE, CDS)	Article 6(1)(b) — Performance of a contract (required to execute jobs on your behalf)
Compliance with legal obligations (e.g. record-keeping)	Article 6(1)(c) — Compliance with a legal obligation

We do not rely on consent (Article 6(1)(a)) as the lawful basis for any of the processing described above; the processing is necessary to deliver the service you have contracted for or is based on our legitimate interests in operating a secure platform. You may exercise your rights under GDPR (access, rectification, erasure, restriction, portability, and objection) by contacting us at the address in section 11.

4. Google Earth Engine Integration

4.1 What GEE Is Used For

NetCDF Studio optionally integrates with Google Earth Engine (GEE) to retrieve geospatial datasets (e.g. satellite-derived climate variables) as inputs to processing jobs. GEE is a separate Google service — you must hold your own GEE account and agree to Google's Terms of Service independently.

4.2 Credentials Storage

If you provide a GEE service account key or personal token, it is stored encrypted at rest (AES-256-GCM) and decrypted only at job execution time, inside the worker process. Credentials are never returned to the client after initial submission — only the last four characters are shown for verification purposes. They are never passed via process arguments (where they could be read by other system users); they travel exclusively through the worker's environment.

4.3 Billing Clarification — You Are Not Charged for GEE Services

NetCDF Studio does not charge you for Google Earth Engine API usage, quota consumption, or Earth Engine compute credits. Your GEE account is governed solely by Google's own pricing and terms. What your NetCDF Studio membership covers is the server-side computation we perform on your behalf: CPU time, memory, worker processes, and storage consumed when processing the data fetched through GEE or uploaded directly by you. In other words:

• GEE data retrieval costs → billed by Google to your GEE account (subject to Google's free tier and quotas)
• Processing that data (correction modules, format conversion, output generation) → covered by your NetCDF Studio plan

5. Data Storage and Security

5.1 Storage Infrastructure

• Account data is stored in Firebase Realtime Database with encrypted connections
• Authentication is managed by Firebase Authentication with industry-standard protocols
• Research files are stored on the server filesystem within your account's isolated directory
• Job metadata is persisted locally on the server with per-user isolation
• Remote compute nodes enrolled by administrators may temporarily hold job input/output files in their own isolated scratch directories; these are deleted immediately after each job completes

5.2 Security Measures

• All API routes are protected by Firebase token verification
• Dashboard routes require active authentication sessions
• File access is scoped to authenticated account ownership
• Admin operations require separate elevated authentication
• Membership verification uses HMAC-signed authorization codes
• Third-party credentials (e.g. GEE service accounts, CDS API keys) are stored encrypted (AES-256-GCM) and never returned to the client in plaintext
• Node tokens are HMAC-hashed at rest and compared in constant time to prevent timing attacks

6. Data Retention

• Uploaded archives — retained until manually deleted by you or via workspace cleanup
• Processed CSV files — retained until manually deleted or account storage is purged
• Account profiles — retained for the lifetime of your account
• Job logs — retained as long as the associated files exist
• Membership records — retained for audit and renewal purposes
• Third-party credentials — retained until you remove them from Settings or delete your account

You can delete your processed files at any time from the Dashboard. Use the "Purge Studio Files" option in Settings to perform a full workspace cleanup.

7. Data Sharing

We do not sell, rent, or share your personal information or research data with any third parties. Your uploaded archives and generated outputs are never accessed by other users.

Exceptions:

• Firebase (Google) — authentication tokens and account metadata are processed by Firebase services under Google's privacy policies
• Google Earth Engine — if you configure a GEE credential, it is sent to Google's Earth Engine APIs solely to retrieve data you requested. This is governed by Google's Privacy Policy and GEE Terms of Service
• System administrators — admin users can view account metadata (name, email, membership status) for platform management purposes, but cannot access your research files or credentials

8. Your Rights

You have the right to:

• Access — view your profile, stored files, and processing history via the Dashboard
• Correct — update your profile information at any time from Settings
• Delete — remove your files and request account deletion
• Export — download all your processed CSV files at any time
• Revoke credentials — remove any stored third-party credentials (GEE, CDS) from Settings at any time
• Withdraw consent — stop using the service and request data removal

9. Cookies and Local Storage

The Platform uses:

• localStorage — to persist your theme preference (light/dark mode) and Firebase authentication session
• Service Worker cache — to speed up repeat page loads and deliver app updates

We do not use third-party tracking cookies or analytics scripts.

10. Children's Privacy

NetCDF Studio is a scientific research tool intended for use by researchers, students, and professionals. We do not knowingly collect information from children under 13 years of age.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable regulations. The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Continued use of the Platform after changes constitutes acceptance of the revised policy.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: