BIRDSEYE Privacy Policy
Last updated: October 26, 2026
This Privacy Policy describes our policies and procedures on the collection, use, and disclosure of your information when you use BIRDSEYE, and tells you about your privacy rights.
Purpose
BIRDSEYE is a browser extension based in the Information Science Department at Cornell University, New York, United States, as part of a research study on how AI chatbots personalize their responses. The study is approved under IRB protocol IRB0150880. If you have questions about this policy or your data, contact us at cpservicingacct@gmail.com.
Function
BIRDSEYE gives you questions to ask ChatGPT. You can then redact ChatGPT's response, submit it, and see how it compares with the responses other people tend to get.
What we collect
| Data | When we collect it | Why | |
|---|---|---|---|
| Your conversation with ChatGPT: your question, ChatGPT's first response, any follow-up messages, source links in the responses, the sponsor and text of any ad shown with them, the ChatGPT model name (when available), and your browser type | Only when you click Submit, and only after you redact any parts you choose to withhold. | This is the data the study is about, and it powers Community Insights | |
| Survey answers about a response you submitted | When you answer the short surveys after submitting | Research analysis | |
| Email address and password | If you create an account | For login via Google Firebase. Your password is not visible to us; to recognize your account, we store only the ID Firebase gives it. | We may contact you via email to request your participation in a follow-up study. |
| Profile details (optional): age range, gender, race, how often you use ChatGPT, country, and languages | If you create an account | To study whether AI responses differ across groups | |
| Research code and study code | If you join as a research participant | To give you your study's questions and your completion code | |
| IP address | With every request to our server | To limit how often answers can be submitted and to block abusive traffic. Our server and our tunnel provider (ngrok) also record your IP address and the time of each request in their logs, for security and troubleshooting. We keep our server logs until the server is reset; ngrok keeps its records under its own retention policy. |
BIRDSEYE reads the ChatGPT page you have open so it can tell when a response is finished, but nothing from that page leaves your device until you click Submit.
Submitting anonymously. If you check "Submit anonymously," your response is stored under a shared anonymous account instead of yours.
What stays on your device
BIRDSEYE uses your browser's extension storage to keep your login session, copies of the responses you submit (so it can show them back to you), a captured conversation until you submit it or 10 minutes pass, and cached Community Insights. This data stays in your browser, and can be deleted by uninstalling BIRDSEYE.
How we use your data
- To run BIRDSEYE: to show your next question, save your submissions, and show Community Insights.
- For research: our research team reads submitted conversations and survey answers to study how AI chatbots personalize responses. You agree to this by accepting BIRDSEYE's consent form.
- The data is anonymized before anything is shared publicly, such as in papers or datasets, and your email is never included. De-identified data may be used for future research without further consent.
We do not sell your data, use it for advertising, share it with advertisers or data brokers, or use it to make decisions about credit or lending.
Who else receives your data
We use these service providers to run BIRDSEYE:
- Google Firebase handles account login (your email and password).
- Supabase hosts our database, where submissions, survey answers, and profiles are stored. Dat amay also be stored on Cornell University clusters and password-protected computers.
- OpenAI receives the text of ChatGPT's response to a question from BIRDSEYE, along with that question, to identify the topics the response covers. It receives only what you submitted, after your redactions.
- ngrok securely carries requests between the extension and our server, and processes your IP address to do so and to block abusive traffic.
Legal requirements
We may disclose your data if required to do so by law or in response to valid requests by public authorities (for example, a court or a government agency). We may also disclose it in the good-faith belief that doing so is necessary to:
- comply with a legal obligation;
- prevent or investigate fraud, spam, abuse, or other wrongdoing in connection with BIRDSEYE.
Where your data is processed
Your information is processed by our research team and wherever the service providers listed above are located. This means it may be transferred to, and kept on, computers located outside of your state, province, country, or other governmental jurisdiction, where data protection laws may differ from those of your jurisdiction. We take reasonable steps to make sure your data is treated securely and in accordance with this Privacy Policy.
Security of your data
All traffic between BIRDSEYE and our server is encrypted (HTTPS). There is no feature for reading your submitted responses back from our server.
We will do our best to keep your participation in this research study confidential to the extent permitted by law; however, it is possible that other people may need to review the research records and may find out about your participation in this study. For example, the following people/groups may check and copy records about this research:
- The Office for Human Research Protections in the U. S. Department of Health and Human Services
- The research study sponsor, Toyota Research Institute
- Cornell University’s Institutional Review Board (a committee that reviews and approves research studies) and the Office for Research Integrity and Assurance
The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee its absolute security.
We keep your data for as long as is necessary for the purposes set out in this Privacy Policy. This includes retaining data for research purposes as described in our approved IRB protocol: https://crowdsourced-personalization.github.io/consent_form.html. Data may exist on backups and server logs beyond the timeframe of this research project.
When data is deleted, copies may remain in our database provider's backups for a limited period. They are not restored except where necessary for security, disaster recovery, or legal compliance.
Deleting your data
You have the right to ask us to delete the data we have collected about you. You may also contact us to request access to, correct, or delete any data that you have provided to us. Email cpservicingacct@gmail.com with your account email or research code. Data that has already been anonymized and shared cannot always be withdrawn.
Please note that we may need to keep certain information when we have a legal obligation to do so.
Age requirement
BIRDSEYE is not directed to, and we do not knowingly collect data from, anyone under the age of 18. If you are a parent or guardian and you believe your child has provided us with data, please contact us. If we become aware that we have collected data from anyone under 18, we will take steps to remove it from our servers as soon as reasonably possible.
Links to other websites
BIRDSEYE may display links to websites that we don't operate, including ChatGPT and the sources cited in ChatGPT's responses. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. In particular, your conversations with ChatGPT are covered by OpenAI's privacy policy.
We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top.
Contact us
If you have any questions about this Privacy Policy, please contact us at cpservicingacct@gmail.com.
Chrome Web Store Limited Use
The use of information received from BIRDSEYE will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.