Privacy Policy

Section 01

Who We Are

AI-ID Center provides an identity layer for AI-generated content. Our service lets users bind a verifiable identity ("AI-ID") to AI-generated images they create on third-party AI platforms (currently ChatGPT and Gemini), and share those images with a public verification link.

AI-ID Center is the trading name of Murat Yüksel, entrepreneur individuel (micro-entrepreneur), SIREN 949430987, 115 Grand'Rue, 68180 Horbourg-Wihr, France. Murat Yüksel is the data controller for the processing described in this policy. See also our Legal Notice.

Contact: [email protected]

This service is intended for individual users only. We do not knowingly collect data from children under 13 years of age.

Section 02

Information We Collect

We collect the minimum information needed to operate the service. We do not sell your data.

2.1 Account Information (via Clerk)

We use Clerk (clerk.com) as our authentication provider. When you sign in (via Google or email), Clerk stores:

• Your email address
• Your chosen username (e.g. @yourname)
• Your authentication tokens

Clerk handles password storage and session management on our behalf. Their privacy practices are described at clerk.com/privacy. We never see or store your password.

2.2 AI-Generated Content You Choose to Capture

When you click the AI-ID button next to an AI-generated image (on ChatGPT or Gemini), the AI-ID Output Connector extension sends the following to our servers:

• The image itself (as base64-encoded data)
• The source URL of the page where you captured it
• A fixed label naming the platform (for example, "ChatGPT image output")
• A client timestamp
• Your username (from your AI-ID account)

Your prompts and the text of your conversations are not collected, stored or sent. In their place, the extension sends a fixed descriptive line (for example, "Live image output detected in ChatGPT.").

This data is captured only when you explicitly click the AI-ID button, and only for an image generated by ChatGPT or Gemini; images you upload yourself are not captured. We do not capture anything in the background.

2.3 Verification Artifacts

For each captured image, we generate and store:

• The source image as captured (a copy of the file you clicked on)
• A composite PNG: the image with a verification band showing your username, carrying an embedded AI-ID Content Credential (C2PA manifest)
• A record containing: a unique artifact ID and receipt ID, your username, the platform (ChatGPT or Gemini), the source URL and that fixed label (on ChatGPT, the source URL is the address of the conversation page), the fixed descriptive line, the client timestamp and the creation time, a record hash, the verification and share URLs, the status of the band and of the embedded Content Credential, and a summary of any Content Credential the source image already carried (for example its generator, issuer and signing time)

The images are stored on Cloudflare R2 (object storage) and the record on Cloudflare Workers KV. They are publicly accessible by anyone who has the verification URL — that is the purpose of the service.

2.4 Extension Storage

The AI-ID Output Connector extension stores the following in your browser's local storage (chrome.storage.local):

• A short-lived session token (a JWT) that carries your username, so the extension can show your session state
• The timestamp when the token was stored

This data never leaves your browser except when authenticating with our servers. It is automatically deleted when you sign out. The extension does not store your browsing history, page content, prompts or images.

2.5 Website Analytics

We use Cloudflare Web Analytics, which is privacy-friendly and cookieless. It collects aggregate, anonymized visit statistics (page views, country-level location, referrers) without using cookies or tracking individual users. More info: cloudflare.com/web-analytics.

We do not use Google Analytics, Facebook Pixel, or any other third-party tracking.

2.6 Server Logs

Our servers (Cloudflare Workers and Cloudflare Pages) automatically log standard request information (IP address, user agent, timestamp) for security and abuse prevention. These logs are retained for up to 30 days.

Section 03

How We Use Your Information

We use your information only to:

• Operate the service — authenticate you, generate verification artifacts, serve share pages
• Bind your identity to outputs — display your username on captured content
• Prevent abuse — detect and block fraudulent activity using server logs
• Improve the service — understand aggregate usage patterns via Cloudflare Web Analytics

Section 04

The Browser Extension and Its Permissions

The AI-ID Output Connector extension (version 2.1.6) requests the following permissions:

• storage — to keep your short-lived session token (which carries your username) and the time it was stored in chrome.storage.local
• alarms — a single local keep-alive timer for the extension's background worker; it makes no network requests and collects no data
• webNavigation — to notice page navigation on ChatGPT and Gemini so the AI-ID button can be attached again when you move between conversations; the address is only checked against those sites
• scripting — to re-run the extension's own scripts on ChatGPT and Gemini after such navigation

It also requests access to the following sites (host permissions):

• https://chatgpt.com/*, https://chat.openai.com/*, https://gemini.google.com/* — to add the AI-ID button under AI-generated images and to read the image you click

When you click the AI-ID button, the capture is sent over HTTPS to the AI-ID service at aiid-api.bosskeman.workers.dev (operated by AI-ID Center on Cloudflare). This connection does not require a host permission.

On ai-idcenter.org (this website) the extension only runs a content script whose sole job is to pass your sign-in session from the website to the extension.

If your session has expired when you click the AI-ID button, the extension may briefly open ai-idcenter.org in a background tab, for up to 8 seconds, to renew your session using your existing sign-in, and then closes it. If renewal is not possible, it opens the sign-in page. This happens only as part of a click; nothing runs in the background without your action.

The extension:

• Runs only on ChatGPT, Gemini and ai-idcenter.org — it does not run on every website you visit
• Captures content only when you explicitly click the AI-ID button
• Does not collect your browsing history, passwords, or unrelated page content
• Does not send any data to third parties

When you uninstall the extension, all data stored in chrome.storage.local by the extension is automatically deleted by Chrome.

Section 05

Data Sharing With Third Parties

We share data only with the following service providers, each acting as a processor on our behalf:

Provider	Purpose	Data shared
Clerk clerk.com	Authentication	Email, username, sessions
Cloudflare cloudflare.com	Hosting, API, file storage, analytics	All operational data

We do not share your data for advertising, marketing, or any commercial purpose with any other party.

We may disclose your information if required by law (court order, subpoena, lawful government request).

Section 06

Data Retention

• Account information (Clerk): Retained as long as your account exists
• Verification artifacts (R2 and Workers KV): Retained indefinitely unless you request deletion (these are intended to remain verifiable long-term)
• Server logs (Cloudflare): Retained up to 30 days
• Extension storage (your browser): Cleared on sign-out or extension removal

Section 07

Your Rights

You have the following rights regarding your personal data:

• Access — Request a copy of the data we hold about you
• Correction — Ask us to correct inaccurate data
• Deletion — Ask us to delete your account and associated data
• Portability — Request your data in a machine-readable format
• Objection — Object to certain uses of your data

To exercise any of these rights, email us at [email protected] with the subject line "Privacy request: [type]" (e.g. "Privacy request: deletion"). We will respond within 30 days, in line with GDPR Article 12.

Note on deletion

We do not yet offer an in-app "Delete Account" button. Deletion is handled manually upon email request. Upon a verified deletion request, we will:

• Remove your Clerk account
• Delete your verification artifacts from Cloudflare R2
• Remove any associated database records

If you have published verification URLs publicly, links to those artifacts will return a 404 error after deletion.

Section 08

International Users

Our servers are operated by Cloudflare, which uses a global network of data centers. By using our service, you consent to your data being processed in any of these locations.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the GDPR. The legal basis for our processing is:

• Contract — to provide you the service you signed up for
• Legitimate interest — for security, abuse prevention, and aggregate analytics

If you are a California resident, you have rights under the CCPA. We do not sell personal information, and we treat all California user requests as binding under CCPA.

Section 09

Security

We protect your data by:

• Using HTTPS/TLS for all data in transit
• Storing authentication tokens with a limited lifetime
• Using Clerk's industry-standard authentication infrastructure
• Hosting on Cloudflare's secure infrastructure with DDoS protection

No system is perfectly secure. If we ever become aware of a data breach affecting your information, we will notify you by email within 72 hours of confirming the breach, in line with GDPR requirements.

Section 10

Children's Privacy

This service is not intended for users under the age of 13. We do not knowingly collect data from children under 13. If you believe we have collected data from a child under 13, please contact us at [email protected] and we will delete it.

Section 11

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top
• Post a notice on ai-idcenter.org if the changes are significant
• For material changes, notify registered users by email

Continued use of the service after changes means you accept the updated policy.

Section 12

Contact

For any questions about this Privacy Policy or your data:

Email: [email protected]

We aim to respond within 7 days, and always within the 30-day GDPR timeframe.