Privacy

Who we are

The AI Incident Index is an independent research initiative maintained by Raidu Inc. Raidu decides how the personal data described here is used. For anything on this page, write to data@aiincidentindex.org.

Reading the Index

You do not need an account to read the Index. The site shows no advertising and sets no tracking cookies while you browse.

Cloudflare Web Analytics, a script loaded from static.cloudflareinsights.com, reports page views to us without cookies so we can see how the site is used in aggregate.

We also count how many times each incident page is viewed. After an incident page loads, your browser sends one request to our service naming that incident, and we add one to the incident's count for that day. Only the incident, the day and the count are stored. We do not set or read a cookie for this, nothing is saved in your browser, and we do not store your IP address, browser details, the page you came from or your account with the count. Like any request, it may appear in the service logs described below. Other pages are not counted this way, and obvious automated traffic is ignored.

If your browser sends a Do Not Track or Global Privacy Control signal, it does not send the view request at all.

Signing in

Signing in is optional. You can sign in with Google, GitHub, LinkedIn or X where those options are shown. We ask each provider only for your basic profile: an account identifier, your name, your email address and whether the provider has verified it, and a profile picture. With Google we use the openid, email and profile permissions and nothing more. We never receive your password, and we do not ask for access to your contacts, files, messages or posts.

We use these details to create and recognise your account, to show your name in your account area, and to contact you about things you sent us. We need a verified email address to create an account; if a provider does not share one, we cannot sign you in with it.

When you sign in we set one cookie, which keeps you signed in for up to 30 days. It is HttpOnly, Secure and SameSite Lax, and it holds a random value. We store only a one-way hash of that value with your account, the provider you used and, for Google Workspace accounts, the Workspace domain. Signing out deletes the session.

The editorial admin is limited to Raidu staff who sign in with a raidu.com Google Workspace account.

Information we receive from Google

The AI Incident Index's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the information Google shares only to sign you in and operate your account. We do not sell it, use it for advertising, or transfer it to others except the service providers listed below that run the Index for us, or where the law requires.

Submissions, corrections and contributions

When you submit an incident, ask for a correction or add an annotation, we store what you send: the details, any source or evidence links, and the account it came from. Editors review it, and we may contact you at your account email about it. If we publish an incident or a change because of what you sent, the published record does not show your name unless you agree.

The submission and correction forms are protected by Cloudflare Turnstile, which receives a token from your browser and your IP address to tell people from automated traffic. We do not store your IP address with your submission.

Saved incidents, collections, follows and alerts

If you save incidents, build collections, or follow organizations, incident types, AI systems or countries, we store those choices with your account. Collections are private unless you make one public. If you turn on the weekly digest or alerts, we keep a record of what we sent so you do not get the same alert twice. You can change or remove any of this, or turn the email off, at any time.

How we use this information

• To sign you in and keep your account and preferences working.
• To review submissions, corrections and annotations, and to reply to the person who sent them.
• To send the digest and alerts you asked for.
• To keep the service secure, prevent abuse and fix problems.
• To understand aggregate use of the site.
• We do not sell personal data, and we do not use it for advertising or to build profiles about you.

Who handles it

Cloudflare hosts the website and the editorial admin and provides Turnstile, Web Analytics and email routing for data@aiincidentindex.org. Google Cloud, in the United States (us-central1), runs the service that handles sign-in, accounts and contributions, and stores that data in its database, cache and logs. Your sign-in provider handles your login with them under its own terms and privacy policy.

These providers process data only to run the Index for us. Your data may be processed in the United States and in other countries where these providers operate.

How long we keep it

• Account details: while your account exists, and deleted within 30 days after you ask us to close it.
• Sign-in sessions: until you sign out or they expire after 30 days; expired sessions are removed regularly.
• Saved incidents, collections, follows and alert history: until you remove them or close your account.
• Submissions, corrections and annotations: kept as part of the editorial record of how an incident was documented. When you close your account we remove your name and email from them.
• Service logs, which include IP addresses and browser details: kept for up to 30 days to run and secure the service.

Your choices and rights

You can ask to see, correct, export or delete the personal data we hold about you, or object to how we use it. Write to data@aiincidentindex.org from the email address on your account and we will reply within 30 days. You can also remove the Index's access from your Google, GitHub, LinkedIn or X account settings at any time; this signs you out but does not delete your account, so ask us if you want that too.

Incident records themselves are a public record about organizations and events. Requests to change them are handled under the corrections and disputes policy.

Children

The Index is not directed at children, and accounts are not meant for anyone under 16. If you believe a child has created an account, tell us and we will delete it.

Changes to this page

If we change how we handle personal data, we will update this page and the date at the top. For significant changes affecting account holders, we will also tell you by email before they take effect.