Rehumanize Privacy Policy

Our commitments in brief

• To check a post, our server sends its text to our AI-detection provider (the AI detector currently in use), a service in the United States, which processes the text there and may keep it under its own policy. In the public version our servers never store the text.
• Without your yes to research, our servers keep only plain counts and a random code for each sitting (and, in Rehumanize Research, your enrolment).
• With your yes, the standard extension keeps one record per analysed post, made of measurements, never the post’s text, its author or a link to it.
• Your answer is kept with a random install ID made on your device, so you can change or withdraw it. That ID is pseudonymous personal data. It never goes on research records, which carry only a random session code.
• Saying no changes nothing about how Rehumanize works for you.
• Rehumanize Research is run by a research team. It records more than the public version, including the full text of each post once you join a study, unless the research team switches that off. Other details of posts, such as their authors, are kept only under switches that team turns on.
• We never sell data.

What we do, and what we don't

We do

• send each checked post's text to our AI-detection provider for the check;
• with your yes to research, for English posts, also send the text to a model-hosting provider for automatic labels;
• keep plain counts from everyone, and a random code for each sitting;
• keep research records only from people who said yes;
• keep your consent answer with a random install ID.

We don't

• store post text, any code made from it, author handles or IDs, post IDs, links or posting times in the public version;
• put the install ID on research records or send it with a post;
• store IP addresses in our database;
• set cookies, or show advertising, on the website, in the extension or in the app;
• open or follow the links in posts;
• sell data, use it for advertising or use it to decide credit-worthiness.

Who is responsible

• The public version (the extension and the Android app anyone can install, and this website): the Rehumanize project. [To be completed by the operator: the name and postal address of the person or organisation that is the data controller.] Contact: rehumanize-project@tuta.com.
• Rehumanize Research: the research team operating it. [For the lawyer to confirm; the project's instruction, not yet a settled fact: "the research team is the data controller for the study version".] [To be completed by the research team: its name, its institution, its postal address, its contact for data protection requests and, where it has one, its data protection officer.] While the operator of the public version also runs the server for Rehumanize Research, [to be completed after legal review: whether the operator acts for the research team as its processor, or the two are joint controllers, and how requests are shared between them].
• Representatives. [To be completed by the operator after legal review: an EU representative under Article 27 of the EU GDPR, and a UK representative under Article 27 of the UK GDPR, where either is required, with their contact details.]

The public version is for anyone and works on Reddit, X and Threads. Rehumanize Research is only for people who have joined a research study with a cohort code from its research team; the research team can also switch on LinkedIn for it in the browser. The two versions keep separate research records and separate consent records.

What we handle, and why

Post text, to check it. Rehumanize reads the text of posts in your feed on the supported sites and apps, and, in the browser extension, checks posts up to one screen below the one you are reading, so a mark is usually ready when a post appears. A post can be checked and scrolled past before you see it. Rehumanize checks posts of at least 25 words. Shorter posts, posts in a language Rehumanize does not check (it checks the languages on its list, which by default are those the AI detector currently in use supports), and posts that are not real language, or whose language the device cannot tell, are not analysed. Other posts go over an encrypted connection to our server, which sends the text, and nothing about you, to our AI-detection provider, and returns a verdict (AI, Mixed or Human) to your device. Rehumanize works out that verdict from the provider's answer. In the public version our server keeps no copy of the text. The text of a post can itself contain personal data about its author or about people it mentions.

Counts and session registrations, from everyone. Per day (some also per hour) and platform: how many posts were checked and with what outcome, how many were not checked because their language is not supported and in which language, how often a check failed, how often the setup pages and the research question were shown and what was chosen, how often switches were turned off, how many checked posts never came far enough onto the screen to count as displayed, how often a post's text could not be read (a sign that a platform changed its page), and how long checks took. Each sitting registers a random session code with our server (with the day and hour, platform, version and app type: the extension or the Android app), which is how the app receives its current settings. A sitting ends after 30 minutes without activity or after 24 hours, and in the browser also when you close the browser. None of it carries post text or your install ID. If you said yes to research, the switch-off counts carry your session code.

Your consent record. When you answer the research question, the app sends your answer to our server with your install ID, a random code made on your device. The server keeps the install ID, the answer, the app type, the day it last changed and the last day it heard from the app, so that you can change or withdraw your answer later. The install ID is pseudonymous personal data: it is not your name, but it stays the same on your device until you remove the extension or the app, so it can be linked to that device, which is why it is pseudonymous and not anonymous. It is never put on research records, never sent with a post for checking, and never linked to a participant code or to the session codes that research records carry.

Research records, only with your yes (public version). For every post Rehumanize analyses, whatever the verdict, one record. It holds these kinds of data:

• the result of the check: the verdict and the numbers the AI detector currently in use returns;
• basic facts about the post, worked out from its text on your device or on our server before the text is dropped: for example its exact number of words, its language and the language check's score for it, counts such as how many links it has, whether it is a reply, and simple measures of its writing style;
• automatic labels, for English posts: tone (such as sentiment, emotion and irony), topic, and hateful or offensive language;
• how and when the post appeared on your screen: the platform, the day and hour of the check, the exact times (in UTC) the post first appeared on your screen and was checked, your device's time zone (such as Europe/London), whether and for how long the post was on your screen, and how many times you came across it again after changing page;
• random codes that link records of one sitting and of one post: your random session code, and a random code for the post, made on your device and not from its text, which only tells us "the same post again" during the sitting; when you open a post in the browser extension, its record is linked to the record of the same post in your feed;
• the app and its settings: which app made the record (the extension or the Android app), the app version, the settings in use (including how marks were shown to you), and which language check was used and its version (in the browser extension, your browser's main version number, such as 141).

Never the post's text, its author or a link to it.

Requests you send us. If you use the deletion request page, we keep the platform, the handles you give, your email address and your message, to confirm that the account is yours and to act on your request. If you write to us, we keep your email for as long as we need it to answer.

The research dashboard. The research team signs in to the dashboard with a username and password or with an access key. For each username and password login it keeps the username, a one-way code of the password (never the password itself), whether the login is an administrator or view-only, and when it was made, changed or removed. The dashboard keeps a log of each sign-in, sign-out, refused sign-in, lockout and administrative action (such as a settings change, an export or a decision on a request), with the name of the person or key that acted, and a log of every export. These logs concern the dashboard's users. The same log also notes each enrolment in a study cohort, with its time and the cohort, but never the participant code.

The dashboard's demo mode. Anyone can open the dashboard with the access key demo. It offers two datasets. The example study is invented and made in your browser: nothing in it was measured, and what you change there stays in that browser tab. The real articles from a documented campaign are read from our server one page at a time, with no sign-in and no cookie. They are news articles that a website published, taken from a public-domain (CC0 1.0) research dataset. Besides that dataset's own labels and scores, it shows Rehumanize's check result for each article (the operator checked the articles before loading the set), labels for tone and topic (sentiment, topics, emotions, irony, hate and offensive language) and counts and measures of each article's text (such as its length, links and readability), computed by us. The articles name real people, but they are not data about Rehumanize's users. Our server stores nothing about these requests in its database; it holds your IP address in its memory to limit how many requests each address can make, and our hosting provider keeps its own logs (below).

Your IP address. Our server sees the IP address of every request. It holds it only in its memory, to limit how many requests one address can make and to block repeated failed sign-ins to the dashboard: for up to two minutes for most requests, up to two hours for the deletion request page and up to two days for the dashboard's real-articles demo set, and after a failed sign-in for up to one minute from the first failed try. It is never written to our database.

Rehumanize Research

Rehumanize Research records more than the public version. The research team must run it under its own ethics approval and data protection paperwork, and tells you in its own information sheet which of the switches below it has turned on. If you are in a study and say yes to research, each record also carries:

• your participant code, a random code made on your device when you enrol (not your name);
• your study group, and which of two experiences you were given at random: labels shown or labels hidden. Some participants will not see the marks, while everything is still measured;
• how you interacted with each post, worked out on your device, in the browser and in the Android app: time on screen, scrolling speed before and after the post, whether you scrolled back and whether you liked, replied or shared. Only these summaries leave your device, never each tap or scroll;
• your coarse country, in both the browser and the Android app, worked out differently: on Android, the two-letter country of the mobile network; in the browser, the two-letter country worked out on your device from the position your browser provides when you say yes to research, in the setup or when you switch research on in the side panel (Rehumanize Research asks the browser for your position for this alone; the position itself is never sent or stored, near a border no country is recorded, and the country is kept on your device only while research is on). Rehumanize itself never uses your IP address to find your country: it only turns the position your browser provides into a country, on this device. Your browser or operating system may itself work out that position from Wi-Fi, GPS or your network. A VPN, roaming or travel can make the country differ from where you are;
• a post code made from the post's text, on your device, from the session code and the text, in place of the public version's random one. The text cannot be worked back out of this code, but the code is not secret: anyone who has your record, which also carries the session code, and who has or guesses a post's text can check whether the record is about that post;
• the post's full text, recorded by default once you join a study; the research team can switch this off;
• other details of the post, only if the research team switches them on, each behind its own switch, off until the team turns it on: fingerprints of the text that tell identical and nearly identical posts apart; the post's ID; when it was posted (the time the page gives, the label it shows, such as "3h", and the time window that label points to); other details of the post, such as whether it is an ad (and, on Reddit, its subreddit and post type); the author's account as a code, or the author's handle and account ID as shown; the domains of shared links, full links where shown uncut, and hashtags.

A post that Rehumanize does not check because of its language also gets a record in a study: its platform, the times above, its language and which language check said so, its text while text recording is on, and the author details the switches above allow. It gets no verdict, no labels and no word counts or style measures. The browser extension sends such a post's text to our server, which drops it when text recording is off.

The Rehumanize Research browser extension can send all of these. The Android study app sends no post IDs, posting times, account IDs or links separately; its fingerprints and post text come from the text it reads from your screen, which in some apps includes the author's name or handle and the reply, repost and like counts, and can include your own name or handle when the post is yours or mentions you. When you view a post you wrote yourself, its author details are recorded like any other author's: the software never reads who you are, so it cannot tell your own posts apart.

When you enrol, our server keeps your participant code, study group and arm, the day you enrolled and the app type, and later any marks the research team sets for you alone and whether collection for you has stopped. While research is on, and once when you withdraw, your session registrations also carry your participant code (and, while research is on, your coarse country).

Rehumanize Research also keeps a shared store of verdicts, so the same text checked again is answered without a second check. For each checked text it holds a one-way code of the text (never the text), the verdict and the detector's numbers, which detector and version answered, and the day and hour it was written. It holds no participant code or session code.

The research team chooses how marks look and which marks are shown, for everyone, for your group or for you, and you cannot change it.

Withdrawing. Press "Withdraw from the study" in the browser's side panel or on the Android app's main screen, and confirm. Research switches off on your device at once, the app tells you so, and your participant code is sent to our server for the research team, which then either deletes the study records already made or keeps them, normally within 7 days, and no later than one month. If you are offline, research is still off at once, and the app asks you to send the withdrawal again when you are online; until it has been sent, research cannot be switched back on. From the moment you withdraw, no more research records are made for your participant code, whatever the decision. Your device forgets the participant code and your study group, and marks look as they do for everyone; to take part again you need a cohort code, and a new participant code is made. Your enrolment record and a log entry of the decision are kept.

Legal bases (UK GDPR and EU GDPR)

Data protection law requires a legal basis for each purpose for which personal data is used.

No decision with legal or similarly significant effects is made about you automatically. You do not have to say yes to research.

Who receives data

We send data only to these recipients:

• Our hosting provider runs our server and our database, and keeps its own platform logs, which may include IP addresses. [For the lawyer to confirm; the project's instruction, not yet verified from the hosting configuration: "our database is in the EU".] [To be completed by the operator: where our server runs, and how long the hosting provider keeps its logs.]
• Our AI-detection provider (the AI detector currently in use, a service in the United States) receives the text of each checked post, and nothing about you, for the check. It processes the text in the United States and may keep it under its own policy.
• A model-hosting provider receives the text of English posts, only from people who said yes to research, to add the automatic labels. It may hold the text in its own cache for a time.
• A web-font service receives your IP address when you open our website or the research dashboard, because your browser fetches the typeface from it. The extension and the app do not use it.
• On Android, the language check uses an on-device library; the post text is not sent for it, but the library sends usage information about itself to its maker.
• The research team can see and export research records through its dashboard, and can give named researchers read-only access. Read-only access never includes the records of, or figures from, a study group with fewer participants than the minimum the research team sets.

The social platforms are not our recipients: Rehumanize reads what they already show you and sends them nothing. We may also disclose data where the law requires it.

Transfers outside the UK and the EU

Our AI-detection provider (the AI detector currently in use) processes the text of every checked post in the United States, so that text leaves the UK and the European Economic Area. The other recipients may also process data outside the UK and the European Economic Area. [To be completed by the operator after legal review: for each transfer, the safeguard relied on (for example an adequacy decision or the UK extension to it, the EU standard contractual clauses, or the UK International Data Transfer Addendum), and how to get a copy of it.]

How long we keep things

Your rights, and how to ask

You have the right to see the data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to withdraw your consent at any time. Write to rehumanize-project@tuta.com. We may ask for information to confirm who you are. We reply normally within 7 days, and no later than one month. If we decline a request, we say why.

What can and cannot be found:

• Withdrawing consent: switch research off in the extension's side panel or on the Android app's main screen. From that moment no further research records are made.
• Public-version research records cannot be picked out for one person: they carry only a random session code that our server does not link to you or to your install ID. Records made before you switched off are kept: by default without a time limit, or until the retention period the research team sets (see "How long we keep things").
• Your consent record is found by your install ID. You never need to know this ID: changing your answer in the extension or the app updates the record.
• Study participants: use "Withdraw from the study" (above).
• Post authors: use the deletion request page. The public version holds nothing about post authors. Rehumanize Research may hold, only where the research team has switched it on, an author's handle (as shown, or as a code), account ID, post text and the other post details above, taken from posts shown in participants' feeds. An administrator confirms by email that the account is yours, then deletes the records found or declines with a reason. Only records that hold your handle or its code can be found: a post that only mentions you in its text, records from the Android study app (which never records author handles as separate fields, although its stored text can include them), and LinkedIn records (Rehumanize Research never records a LinkedIn author's handle or account ID, so the deletion form does not offer LinkedIn) cannot be found this way. The administrator can also stop that handle being recorded again as a post's author; the list that does this holds only a code made from the handle, not the handle itself. Once a request is decided, the request log keeps the handle and its platform, the date, the decision (with any reason), the deciding administrator, how many records were deleted or changed, and which earlier exports held them.

You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority of the country where you live or work, or where you believe the law was broken.

How we protect your data

• Data travels over encrypted connections between the extension or app, our server, our providers and our database.
• In the dashboard, research data is shown only to people who sign in: the research team and the researchers it gives read-only access. Whoever runs our server and database can also reach it.
• No method of sending or storing data is completely secure, so we cannot promise that data will never be lost or accessed without permission.

If you find a security problem, write to rehumanize-project@tuta.com.

Cookies and similar technologies

Rehumanize sets no cookies: not on the website, not on the research dashboard, not in the extension and not in the app. A few things are kept in your browser's own storage instead: on the website, your light or dark theme; on the research dashboard, its theme, the view choices you made (the period, the build and the columns shown, and how far you got in the guided tour) and, once you sign in, the sign-in until you sign out, which the dashboard sends to our server with each of its requests for study data (in demo mode it keeps the demo key instead, which it never sends). The extension and the app keep your switches, your choices and your install ID on your device, and in Rehumanize Research your participant code and study group; the study extension also keeps your country there while research is on. The web-font service described above receives your IP address when the website or the dashboard loads its typeface. The cookie notice gives the details.

Children

Rehumanize does not ask your age and cannot tell whether a user is a child. [To be completed by the operator after legal review: the minimum age for using Rehumanize, and for Rehumanize Research, any age limit the research team sets.] If you believe a child's data is held, write to rehumanize-project@tuta.com.

Chrome Web Store: Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. The data our browser extension handles is used only to check posts and, with your consent, for the research described here; it is not sold, not used for advertising and not used to decide credit-worthiness.

Changes to this policy

If this policy changes materially, we will tell users before the change takes effect. [To be completed by the operator: how users are told, for example in the extension and the app.] The date at the top says when it last changed.

How to contact us

• Email: rehumanize-project@tuta.com
• Post: [To be completed by the operator: postal address]