Privacy policy

This page describes what The Altshuller Institute for TRIZ Studies keeps when you use aitriz.org.

Who we are

The Altshuller Institute for TRIZ Studies, 100 Barber Avenue, Worcester, Massachusetts 01606. To ask what we hold about you, or to ask us to delete it, write to [email protected].

Google sign-in

Sign-in is Google, with the scopes openid, email, and profile. We keep the verified email address, the name, the profile photo address, and the Google account identifier (the subject). The email is stored in lowercase.

Those values live in our Cloudflare D1 database. Email, name, and photo address are on the user record. The Google identifier is stored with the provider name "google." A membership record may already exist for that email, including one added before the person first signed in. Sign-in links it to the user. The membership record holds the plan, status, paid-through date, whether access was granted without a payment, the role, where the record came from, and, when a Stripe payment is on file, the Stripe customer id and subscription id.

A cookie named ai_session keeps you signed in. It is HttpOnly, Secure, and SameSite=Lax, and it lasts 14 days. It carries a random session id and a signature. The database row is the login. Sign-out deletes that row and clears the cookie. An expired session row is deleted the next time it is presented. While Google sign-in is in progress, a separate cookie named ai_oauth is limited to the sign-in path and kept for 10 minutes. It holds the temporary checks for that handshake and is cleared when sign-in finishes or fails. An old cookie named ai_stub is cleared if it is still present. It is not a login.

This browser also keeps a local copy of the name, photo address, plan, and whether library access is on, so the header can draw before the server answers. That copy is not the login. Sign-out clears it. The store cart keeps the item and the quantity in this browser. The account page can save the newsletter checkbox and the email address in this browser. Neither of those is a profile we keep on the server. The library can also remember, in this browser, how you last viewed the list and which articles you opened.

Payments

Memberships are paid through Stripe Checkout. Certification testing fees, books, videos, and the other store items that offer checkout are paid through Stripe Checkout as well. A signed-in member whose membership has a Stripe customer id can open the Stripe billing portal from the account page. The site does not see or store card numbers.

Stripe collects the billing address, and the shipping address when an item ships. We tell Stripe which item is being purchased. For a shipped item we also send the destination region chosen on the cart (United States or international) and a weight used to price shipping. If you are signed in, checkout sends Stripe your account email, or uses the Stripe customer already stored for that membership, and sends your user id as a reference. It does not send the Google account identifier.

When Stripe confirms a membership payment, we store the Stripe customer id, the subscription id when there is one, the plan, the status, and the paid-through date. We also store the Stripe event id and event type so the same notice is not applied twice. A store purchase, including a certification testing fee, is not copied into the membership record. The receipt and the card details stay with Stripe.

Hosting and measurement

The site is hosted on Cloudflare. Cloudflare receives the connection data needed to deliver the pages, such as an IP address. Cloudflare Web Analytics may record a page view with a beacon. That beacon does not set a cookie. Pages also load typefaces from Google Fonts, and a signed-in header may load the profile photo from Google.

Members-only library

The full text of members-only library articles, and the member images and PDFs served with them, are available only to a signed-in person with an active membership. That is an annual, student, retired, lifetime, monthly, or group plan, or a complimentary membership. Signing in without that membership does not open those files.

Selling

We do not sell personal information.