Privacy
The register has no accounts, no database of visitors, and no analytics. The only place it collects anything is the submission form.
Browsing the site
The pages of this site are plain files. They set no cookies, load nothing from other companies, and do not track you between visits. Typefaces are served from this site's own domain rather than from an outside service, so simply reading a page does not tell anyone else that you did.
The web server keeps ordinary access logs, as web servers do. Those are held by the hosting provider and are not used to build any profile of readers.
What the submission form collects
When you send a submission, the form asks for:
- your email address, which is required, so that the register can reply to you;
- your name, which is optional;
- your description of the object, how it came to you, and what is said about it;
- any photographs you choose to attach, which are optional.
Photographs often carry more than the picture: many cameras record the date, the device, and sometimes the location in the file itself. The register does not read or use that, but it travels with the file. If that matters to you, strip it before attaching, or send the photograph another way.
A submission is also only accepted if you tick the box confirming that what you send is yours to share and that you accept the terms of submission. Those terms set out what the register may publish and what can be changed or taken down afterwards. The version you agreed to is named on the confirmation you are sent, so it stays possible to tell later which text you actually saw.
What happens to it
The contents of a submission are not stored on this server, and neither are the photographs. They are sent onward by email to the register and then exist only in that mailbox. A photograph is held in temporary storage for the seconds it takes to attach it to that message, and is discarded when the request ends. Your email address is placed in the reply field of that message, so a reply reaches you.
You are also sent a copy of your own submission, to the address you gave, as confirmation that it arrived. It repeats what you wrote and lists the photographs by name, but does not attach them. That message is the only thing the register sends you unless it writes back about the object itself.
The mail passes through the hosting provider's mail server on the way, as all email does. Where the register replies, that correspondence is kept in the mailbox for as long as the submission is under consideration.
If an object is entered into the register, its public record contains only what the register chooses to publish about the object. Accounts are attributed, and how they are attributed is agreed with you first. Your email address is never published.
The one thing that is stored
To stop the form being used to send bulk mail, the server limits each connection to five submissions per hour. To count them it stores a one-way hash of your IP address, combined with a secret value, together with the times of those submissions. The address itself is not written down, and the hash cannot be turned back into it.
These counters are discarded once they are more than two hours old. The server also keeps a running count of receipt numbers issued each year, which is a single number and contains nothing about any person.
Receipt numbers
A successful submission is answered with a receipt number such as E-2026.0142. It confirms that the message arrived. It is not a register number and does not mean the object will be entered.
Asking for removal
You can ask what the register holds about you, and ask for it to be corrected. Write to privacy@badprovenance.com, quoting your receipt number if you have one.
What can be deleted depends on whether it describes you or the object. The register separates the two, and is direct about which is which:
- Your email address and any correspondence are deleted on request, and so is a submission that has not been entered.
- Your name is taken off a published entry on request. The account is then attributed to an unnamed private submitter. No time limit, no reason needed.
- The description, the history, and the photographs of an entered object stay, because the record is the point of the register and a record that can vanish is not one. The terms of submission say this before you send, not after.
That last one has limits, and they are listed on the terms page. Material sent by mistake, material that was not the sender's to send, and material showing a person who did not agree to appear are taken down on request, whatever stage the record has reached.
A published record is never deleted outright, because the numbering depends on it. It can be withdrawn, in which case the page remains with a note saying so and the substance is removed. The register also withdraws entries on its own judgement, without being asked.