Zotero Atlas

Privacy

What the plugin sends, what it never sends, what the server keeps, and how to stop. Written to be checked against the code: the plugin is in src/, the server in server/.

Zotero Atlas never sends your library, notes, files, Zotero account, email or anything that identifies you.

The one thing it can send

The first time it runs it asks one question, with Don't send as the default. If you choose Send my plugin list, it sends one message to zoteroatlas.com:

{
  "id": "4c9d3b2e-…",          a random ID made on this computer
  "atlas": "0.1.0",            this plugin's version
  "zotero": "7.0.32",          your Zotero version
  "os": "mac",                 "mac", "windows" or "linux"
  "event": "weekly",           "first-run", "changed" or "weekly"
  "plugins": [                 every plugin installed in this Zotero
    { "id": "zoterostyle@polygon.org", "version": "5.0.0", "enabled": true },
    …
  ]
}

It is sent when you turn the choice on, when the list of plugins changes, and once a week. The ID is a random UUID the plugin generates on your computer; it is not derived from your hardware, your Zotero account or anything else, and it is the only thing that links one report to the next. Show what would be sent, in Zotero's settings under Zotero Atlas, shows your exact message.

What the server keeps

Per reporting install: the random ID, when it first and last reported, the Zotero version, the operating system, the plugin's version, and the plugin list, replaced on every report. Nothing else from the request is kept: no IP address, no user agent, no headers. An install not heard from for 180 days is deleted by a nightly job.

Cloudflare, which runs the server, sees requests the way any web host does. We keep none of that, and the server code that decides what is stored is public.

What is published: totals, meaning how many installs reported in the last 30 days and how many of them have each plugin. Counts only.

Turning it off, and deleting your record

Open Zotero's settings, choose Zotero Atlas, and pick Don't send. The plugin then asks the server to delete the record for its ID and stops sending. Uninstalling the plugin does the same and also removes everything it stored on your computer.

What happens whatever you choose

  • Once a day the plugin fetches the directory's catalogue, a single public file, from raw.githubusercontent.com, the directory's repository on GitHub. The request carries no account and no identifier beyond what any download carries.
  • When you click Install, Zotero downloads the plugin's release file from GitHub, as it would for any plugin you install.
  • Zotero checks this project's GitHub releases for updates to Atlas itself, as it does for every plugin. You can turn that off per plugin in Tools → Plugins.
  • Nothing else is contacted.

What it stores on your computer

Three settings in Zotero's preferences (extensions.zotero-atlas.usage, .id, .state) and a copy of the catalogue at zotero-atlas/catalog.json in your Zotero data directory. Uninstalling removes all of it.

This website

zoteroatlas.com sets no cookies, runs no analytics, and loads nothing from third parties: the fonts are your system's, and the scripts and styles are served from here. The one image from elsewhere is the live grade badge, loaded from zoteroplugins.org, which we also run. Cloudflare, which hosts the site, sees requests the way any host does. The front page asks this site's own /api/v1/totals.json for the published counts; nothing about you is sent with that.

Questions

Open an issue at github.com/iliasbeshimov/zotero-atlas/issues.