MangroveNP v0.6
隐私说明 / Privacy
中文
本页说明访问 MangroveNP 网站时会处理哪些信息。以下内容依据 v0.6 网站发布包中的网页代码与服务器配置整理。
1. 无登录、无账户
- 本网站只提供静态文件，不运行其他服务器端程序。没有注册、登录或用户账户，也没有任何提交或写入数据的接口；服务器只接受 GET / HEAD 请求（以及跨域预检 OPTIONS）。
2. Cookie 与浏览器存储
- 本网站不设置 Cookie。
- 网页会在您浏览器的 Web Storage 中保存一项界面语言偏好（键名
atlas-language，取值为中文或英文）。该值只保存在您的浏览器中，不发送给服务器；清除本站的浏览器数据即可删除。 - 不使用其他浏览器存储。
3. 无统计分析、无第三方请求
- 本网站不使用访问统计、分析或广告追踪工具，不加载第三方脚本、字体或 CDN 资源。
- 网站的内容安全策略（Content-Security-Policy）只允许从本站自身加载脚本、样式、字体和数据。
- 结构检索程序（
/struct-worker.js）的响应头原文如下（未列出 Date、Last-Modified、ETag 与 Content-Length）：
Content-Type: text/javascript; charset=utf-8
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=(), interest-cohort=()
Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-eval'; connect-src 'self'
Cache-Control: no-cache
- 结构检索所需文件（包括 RDKit.js 运行库）仍只从本站加载，结构查询不发送到服务器。
- 页面上指向外部网站的链接（如 doi.org、PubMed、PubChem、出版社页面、许可协议页面）只有在您点击时才会访问对方网站。浏览器的引用来源策略为
strict-origin-when-cross-origin，对方网站只会收到本站的域名，而不是您浏览的具体页面地址。访问外部网站时适用对方的隐私政策。
4. 服务器日志
- 网站服务器（nginx）记录访问日志，采用 nginx 默认格式，包含：访问者 IP 地址、访问时间、请求行（包括网址中的检索参数）、响应状态码、响应大小、引用来源（Referer）和浏览器标识（User-Agent）。
- 服务器另记录警告级别及以上的错误日志。
- 保留期限即将公布。
- 服务器日志用于防滥用和排查故障，仅维护者可见。
5. 访问频率限制
为保证服务稳定，服务器按 IP 地址限制请求频率：每秒 30 次，允许 40–60 次的短时突发；SDF、SMI 与两个 TSV 下载文件（描述符表与 NPClassifier 分类表）另限为每秒 2 次，突发 4 次；超出限制时返回 HTTP 429。频率计数只保存在服务器内存中。
6. 联系方式
如对本说明有疑问，请联系：联系邮箱即将公布
English
This page explains what information is processed when you visit the MangroveNP website. It is based on the web code and server configuration in the v0.6 website release package.
1. No login, no accounts
- The website serves static files only and runs no other server-side program. There is no registration, login or user account, and no interface for submitting or writing data; the server accepts only GET / HEAD requests (and OPTIONS for cross-origin preflight).
2. Cookies and browser storage
- The website does not set cookies.
- The page stores one interface-language preference in your browser's Web Storage (key
atlas-language, value Chinese or English). This value stays in your browser and is not sent to the server; clearing this site's browser data removes it. - No other browser storage is used.
3. No analytics, no third-party requests
- The website does not use visitor statistics, analytics or advertising trackers, and loads no third-party scripts, fonts or CDN resources.
- The site's Content-Security-Policy allows scripts, styles, fonts and data to be loaded only from the site itself.
- Response headers of the structure-search worker script (
/struct-worker.js), verbatim (Date, Last-Modified, ETag and Content-Length not shown):
Content-Type: text/javascript; charset=utf-8
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=(), microphone=(), interest-cohort=()
Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-eval'; connect-src 'self'
Cache-Control: no-cache
- The files the structure search needs (including the RDKit.js runtime) are still loaded only from this site, and no structure query is sent to the server.
- Links to external websites (such as doi.org, PubMed, PubChem, publisher pages and licence pages) contact those websites only when you click them. The browser referrer policy is
strict-origin-when-cross-origin, so the external site receives only this site's domain, not the address of the page you were viewing. The external site's own privacy policy applies there.
4. Server logs
- The web server (nginx) keeps an access log in the nginx default format, which contains: the visitor's IP address, the time of access, the request line (including search parameters in the URL), the response status code, the response size, the referrer and the browser identifier (User-Agent).
- The server also keeps an error log at warning level and above.
- Retention period: coming soon.
- Server logs are used to prevent abuse and troubleshoot faults; only the maintainers can see them.
5. Rate limiting
To keep the service stable, the server limits the request rate per IP address: 30 requests per second, with bursts of 40–60 allowed; downloads of the SDF, the SMI and the two TSV files (descriptors and NPClassifier) are further limited to 2 per second, with a burst of 4; requests over the limit receive HTTP 429. Rate counters are held only in server memory.
6. Contact
For questions about this page, please contact: contact email coming soon
数据许可：CC BY 4.0 · Data licence: CC BY 4.0 — 许可与引用 · License & citation