Privacy notice

Last updated 2026-08-29. Consent version 1.

Summary

This archive is run by Doxcelerate Corporation. We collect very little: web server logs that every website keeps for security, and — with your permission where the law requires it — Google Analytics data about how the archive is used. We do not ask you to register. If you write to us through the contact form, we keep what you send until we have dealt with it. We do not sell your personal information for money. If you allow "Advertising" in your privacy choices, Google may link your visit to your Google account for advertising measurement. You can change your choices at any time from the "Do Not Sell or Share My Personal Information" link in the footer.

Who we are

Doxcelerate Corporation ("we", "us") operates this archive and is the controller of the personal data described here.

Website: https://www.doxcelerate.com
Privacy contact: doe.archives@doxcelerate.com

We are located in the United States. This archive is not operated by, endorsed by, or affiliated with the U.S. Department of Energy or the National Nuclear Security Administration.

What this notice covers

This notice applies to the three Doxcelerate archives:

https://archives.standards.doxcelerate.com (Technical Standards)
https://archives.directives.doxcelerate.com (Directives)
https://archives.nnsa.doxcelerate.com (NNSA Policies and Directives)

They share one set of cookies (set for doxcelerate.com and its subdomains), so the privacy choice you make on one of them applies to all three. You are reading this notice on Directives (archives.directives.doxcelerate.com).

What we collect, why, and for how long

Server logs

When your browser requests a page or a document, our web servers and our cloud provider's load balancer record the request: your IP address, the date and time, the address requested, the page that referred you, and your browser's identification string ("user agent").

Purpose: keeping the archive secure and available, diagnosing faults, and understanding aggregate load (for example how many requests come from automated crawlers).
Legal basis (EEA/UK/Swiss visitors): our legitimate interest in running a secure service (GDPR art. 6(1)(f)).
Retention: web server logs are deleted after 60 days. We are putting a retention limit on the load-balancer logs; until it is in place they are kept without a fixed limit, and we will update this notice when that changes.

Analytics (Google Analytics 4)

If analytics is on for you (see "Your choices"), we use Google Analytics 4, a service of Google LLC, to understand how the archive is used. Google Analytics sets cookies that give your browser a random identifier and sends Google, on our behalf:

the pages you view and how you move between them, how far you scroll, and links you click to other sites;
the search terms you type into the archive's search box, and how many results they returned;
which documents you open or download (the file name and the document identifier);
an approximate location (city or region) derived from your IP address at the moment of collection — Google Analytics does not store the IP address itself;
your device type, browser, screen size, language, and the site that referred you.

We use this to see which documents and searches matter to visitors, to find searches that return nothing, and to fix pages that fail. We do not use it to identify you personally, and we have not enabled Google's account-level data sharing with other Google products.

Legal basis (EEA/UK/Swiss visitors): your consent (GDPR art. 6(1)(a)), which you can withdraw at any time. Elsewhere, analytics is on by default and you can turn it off at any time.
Retention: Google Analytics keeps event-level and user-level data for 14 months, after which it is deleted automatically. Aggregated reports do not identify you.
Measurement ID for this archive: G-CGMCMFW93F.

Advertising measurement (Google signals)

Only if you allow "Advertising" in your privacy choices, we enable Google signals. With it, Google associates your visits with your Google account if you are signed in and have "Ads Personalization" turned on in that account. This lets us see aggregated demographic and interest reports and, when we run Google Ads campaigns in the future, measure them and show relevant ads to people who visited the archive. Google, not we, holds the link to your account.

Legal basis: your consent. Where you are in the United States, allowing Advertising means Google may use the data for cross-context behavioral advertising, which California law calls "sharing"; you can refuse or withdraw it with the footer link at any time.
Ways to opt out beyond our banner: Google's Ads Settings at adssettings.google.com, the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout, and the Network Advertising Initiative at optout.networkadvertising.org.
How Google uses data from sites that use its services: policies.google.com/technologies/partner-sites. Google's privacy policy: policies.google.com/privacy.

Messages you send us

If you use the contact form at /contact, we receive what you typed — your message, your email address, your name if you gave one, and any screenshots you attached — together with the context needed to act on it: which archive you were on, the page you came from, the document or search term the report is about, your browser's identification string, language, window size and time zone, and your IP address. The form links here so you can read this list before you send.

Purpose: answering you, and correcting the archive. A report of a wrong date or a missing file is how most of this archive's corrections begin.
Legal basis (EEA/UK/Swiss visitors): our legitimate interest in running and correcting the archive, and in replying to people who write to us (GDPR art. 6(1)(f)).
Retention: we keep messages until they are dealt with and for as long afterwards as the record of the correction is useful, which may be indefinitely. Ask us and we will delete yours.
We never send anything to an address typed into that form except a reply from a person. There is no automatic acknowledgement, no mailing list, and no way for a stranger to make the form send mail to somebody else.
Screenshots are re-encoded when they arrive, which removes the camera and location data a phone photograph carries. Nothing you attach is published.
We do not attach your analytics identifier, or anything else behind a privacy choice, to a message.

Cookies and similar technologies

Nothing is stored on your device until you make a choice, except the cookie that remembers the choice itself.

Name	Set by	Purpose	Lasts	Category
`pp_consent`	us	remembers your privacy choices	12 months	strictly necessary
`pp_notice`	us	remembers that you have already been shown the privacy banner, so it is not repeated; it records nothing about what you chose	12 months	strictly necessary
`_ga`	Google Analytics	distinguishes your browser from others with a random identifier	up to 2 years	analytics (needs your choice)
`_ga_CGMCMFW93F`	Google Analytics	keeps session state for this archive	up to 2 years	analytics (needs your choice)
`pp_dev`	us	set only if a Doxcelerate staff member opens the archive with a diagnostic link; turns analytics off for that browser	12 months	strictly necessary, staff use only
`aws-waf-token`	Amazon Web Services	proves your browser is a real browser when you send the contact form, so the form cannot be used by automated scripts; it is set only on the contact page and holds no information about you	up to 24 hours	strictly necessary
`auth_token`	us	keeps an editor signed in	session	strictly necessary, staff use only

We do not use pixels, fingerprinting, or local storage for tracking.

Your choices

The banner. The first time you visit, a bar at the bottom of the page offers "Accept all", "Decline", and "Manage" (separate switches for Analytics and Advertising). Declining is one click, the same as accepting.
Changing your mind. Use "Do Not Sell or Share My Personal Information" in the footer of every page, or the button below. Withdrawing consent stops further collection immediately and deletes the Google Analytics cookies from your browser; it does not undo collection that already happened.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of advertising measurement and of any "sale" or "sharing" of your personal information, unless you later choose otherwise in the banner.
Your browser. You can block or delete cookies in your browser settings; the archive works without cookies.
If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics and advertising are off until you turn them on. We ask again after 12 months.

Who receives your data

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — processes analytics data on our behalf under Google's Ads Data Processing Terms, and, if you allow Advertising, uses Google signals as described above.
Amazon Web Services, Inc. — hosts the archive and its load balancer in the United States (region us-east-2).
We do not sell personal information for money and we do not give it to data brokers. We disclose it only when the law requires (for example a valid legal order) or to protect the archive against abuse.

International transfers

We and our providers process data in the United States. If you visit from the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the United States when your browser connects to us. Google LLC and Amazon Web Services, Inc. are certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, and Google's Ads Data Processing Terms include the EU Standard Contractual Clauses as a fallback.

Your rights

Depending on where you live you may have the right to:

know what personal data we hold about you and receive a copy;
have it corrected or deleted;
restrict or object to how we use it, including objecting to processing based on legitimate interests;
receive it in a portable form;
withdraw consent at any time, without affecting what was done before;
opt out of the "sale" or "sharing" of your personal information and of targeted advertising (California and other U.S. states);
limit the use of sensitive personal information (we do not collect any);
not be discriminated against for exercising these rights;
complain to a supervisory authority: your national data protection authority in the EEA, the Information Commissioner's Office in the UK (ico.org.uk), the Federal Data Protection and Information Commissioner in Switzerland, or the California Privacy Protection Agency (cppa.ca.gov).

To exercise a right, email doe.archives@doxcelerate.com, or use the form at /contact and choose "Something else". Either way, tell us the archive you visited and what you are asking. Because we hold no account for you, we may ask for enough information to match your request to our records (for example the date and approximate time of your visits); a request we cannot match, we cannot fulfil. We respond within one month (EEA/UK/Switzerland) or 45 days (California), and we do not charge a fee. You may use an authorised agent; we will ask the agent for proof of your authorisation.

Children

The archive is a reference collection for professionals and is not directed to children. We do not knowingly collect personal data from anyone under 16 (under 13 in the United States). If you believe a child has provided us data, email us and we will delete it.

Security

Every page is served over HTTPS. Access to servers and to analytics accounts is limited to staff who need it and protected with strong authentication.

Automated decision-making

We make no decisions about you by automated means and we do not profile you.

Changes to this notice

We will post changes here with a new "Last updated" date. If a change adds a new purpose for which we need your consent, the banner will ask you again. Earlier versions are kept in our source-control history.

Contact

Use the form at /contact, or email doe.archives@doxcelerate.com. Both reach the same people. Doxcelerate Corporation, https://www.doxcelerate.com