Privacy

Who is responsible

Human Baseline is an independent research project based in the EU. It is the data controller for everything described here. Contact details (required by the GDPR): privacy@humanbaseline.org. Everything you can do with your data is self-service, below.

We are not affiliated with Google DeepMind, Kaggle, or any benchmark author.

What we collect

• Test answers. Your answer to each item, its score, the time you took, the time to your first input, and whether you pasted text, left the window or hid the tab while the item was on screen. Nothing outside this site is recorded, and no keystrokes.
• Sitting details. A random session ID, time zone, browser language, screen width, whether the screen is touch-based, the site that sent you here, campaign tags in the link (UTM), the first page you opened, and your optional score prediction. No IP address is stored with your answers.
• Visits, whether or not you take the test. Once per visit: the first page you opened, the page that linked here (without its query string), campaign tags in the link, and whether the screen is touch-based. No IP address, no identifier, and nothing that links the visit to your answers or your account. We use it to count where visitors come from.
• If you create an account. Your email address and password (stored hashed by our authentication provider), the date you accepted these terms, and the optional background questionnaire: age band, gender, countries, language, education, work, relative income, AI use and similar. Every question is optional. The questionnaire is stored apart from your email. Optionally, your LinkedIn profile address, stored apart from both and used only to check that you are a real person and to contact you about the research; it is never part of research data or shared with partners.
• If you send feedback or offer to help. Your message, the kind of feedback, the item it concerns, your “was this fair?” vote, the skills you tick, the page you sent it from, and your email address if you give one. A vote from the result page is linked to that sitting; if you are signed in, feedback is linked to your account.
• In your browser. Your recent sittings, results, queued answers not yet sent, and one random token per sitting that lets this browser erase it (see below). If you sign in, the sign-in session. None of this is a tracking cookie, and none of it is shared with other sites.

We do not use advertising, analytics cookies or third-party trackers, so there is no cookie banner. Page views are counted with our host’s cookieless analytics (Vercel Web Analytics): the page address, without anything after the “?” except campaign tags, plus the referring site, country and device type.

Why, and on what basis

Your data is used to build an open scientific comparison between human and machine cognition: how people of different backgrounds perform on the same tasks as AI systems, item by item. The legal basis is your consent (GDPR art. 6(1)(a)), given when you start the test or create an account, with the safeguards for scientific research of art. 89. Feedback you send us is handled on the basis of our legitimate interest in answering it and improving the project (art. 6(1)(f)), and so is visit counting, which holds nothing that identifies you; the newsletter, on your consent.

You must be 18 or older to take part. A future, longer questionnaire may ask about sleep and health; it will ask for separate, explicit consent first.

Who sees it

• Published results. Aggregated, anonymised results and an anonymised open dataset. Before release, background answers that could single someone out are coarsened or removed (for example, small countries grouped into regions).
• Research partners. Pseudonymised, item-level data (never your email) may be shared with research partners, including universities and AI developers, under agreements that forbid re-identification and limit use to research and evaluation.
• If the project changes hands. If Human Baseline becomes or joins an organisation, the data moves with it under these same terms, and we will say so here.

We never sell your email address or use it for advertising.

Services that process data for us

• Supabase: database and accounts, hosted in the EU. Its servers keep short-lived request logs, including IP addresses, for security; they are not linked to your answers.
• Vercel: website hosting. Its servers see your IP address to deliver pages, as any web host does. Vercel is a US company; transfers are covered by the standard contractual clauses in its data processing agreement.
• Resend: sends account emails (confirmation and password reset) from humanbaseline.org. It sees your email address and the message. Resend is a US company; transfers are covered by the standard contractual clauses in its data processing agreement.
• Cloudflare Turnstile: checks that a person, not a bot, is signing up, signing in or resetting a password. It sees your IP address and technical details of your browser for that check, sets no tracking cookie and keeps no profile of you. Cloudflare is a US company; transfers are covered by the standard contractual clauses in its data processing agreement.
• Google: only if you choose “Continue with Google” to sign in.
• ImprovMX: receives email sent to our @humanbaseline.org addresses and forwards it to our inbox (Gmail). It sees the messages it forwards; only if you write to us.
• Brevo (France): the newsletter, only if you subscribe. Your email address goes straight from your browser to Brevo, which sends a confirmation link first and an unsubscribe link in every email. It is not stored with your answers.
• Ko-fi (UK): donations, only if you donate. Ko-fi and its payment providers handle the payment; we see the name, email and message you give Ko-fi. Our own database keeps only the date, amount and Ko-fi’s transaction number of each donation, to track our funding.

Each works under a data processing agreement. We will list any new service here before using it.

How long we keep it

• Account, questionnaire and LinkedIn address: until you delete your account (or empty the LinkedIn field).
• Test answers: as long as they serve the research. Detailed timing and window data are reviewed after 24 months and reduced to summaries where possible.
• Feedback and volunteer offers: up to 24 months, or until you delete the account or sitting they are linked to.
• Newsletter: until you unsubscribe.
• Anonymised published data: indefinitely, since it can no longer be linked to you.

Your rights

Under the GDPR you can, at any time and free of charge:

• Access and take your data: download everything linked to your account as a JSON file from your account.
• Erase it: delete your account and everything linked to it (sittings, questionnaire, feedback, LinkedIn address) from your account, or erase the anonymous sittings of this browser below. It takes effect immediately.
• Correct it, restrict it, object, or withdraw consent: delete your account (or this browser’s sittings) as above. You can create a new account and start again at any time. Data processed before then stays lawful.
• Newsletter: the unsubscribe link at the bottom of every email.

Sittings and feedback that aren’t linked to an account or to this browser can’t be traced to you, so we can’t tell which are yours.

Anything already released in an anonymised dataset can’t be traced back to you, so it can’t be removed. You can also complain to any EU data protection authority, for example the one where you live or work (list of authorities).

Erase this browser’s sittings

Sittings you take without an account are anonymous, so we can’t find them by name. This browser kept a private token for each one, which proves they are yours. Erasing deletes those sittings and all their answers from our database, then clears this browser’s copies.

Changes to this policy

We will update this page as the project evolves, and change the date at the top. Material changes for account holders will be announced on your account page before they apply.