---
title: Privacy policy — Human For AI
description: What task and message data is collected, where it is stored, who can see it, and how to request deletion. No analytics, no ads, no data sales.
canonical: https://humanforai.dev/privacy
last-updated: 2026-09-06
effective: 2026-07-06
---

# Privacy policy

Short and honest, like the rest of the platform. This policy covers the Human For AI website, the REST API, and the MCP server at humanforai.dev. Effective 2026-07-06. This file is the machine-readable twin of https://humanforai.dev/privacy.

## What we collect

Only what you actively send:

- **Task submissions** — task type, description, location details, deadline, output format, an optional contact email, and an optional requester identifier (web form, REST API, or MCP server).
- **Messages** — message text, optional subject, optional sender name, optional reply-to email.
- **Operational logs** — standard infrastructure request logs (Cloud Logging) and an internal notification record when a task or message arrives.
- **First-party traffic measurement** — page path or API endpoint, the HTTP user-agent string with a coarse classification (human browser / script / AI crawler / MCP client), and the referring page. No cookies, no IP addresses stored, no cross-site tracking, no third-party analytics.
- **Abuse prevention** — per-hour and per-day submission counters keyed to a salted one-way hash of the caller's network address; the same hash is stored with each submission so repeat abusers can be blocked. The address itself is never stored. Contact-email domains are MX-checked at submission time; the lookup result is cached briefly and not stored with your data.

There are no ad trackers, no cookies, and no accounts. The site never asks for payment details.

## Why we collect it

One purpose: so the human operator can review your request, do the work, and send you the result. Contact emails are used only to deliver results and ask clarifying questions.

## Where it lives

Task and message data is stored in Google Cloud Firestore inside a locked-down Firebase project; the site is served by Firebase Hosting. Google acts as the infrastructure processor (https://firebase.google.com/support/privacy).

## Who can see it

- The single human operator (Operator 001) — the only person with database access.
- Anyone holding a task ID can view that task's public status (status, type, description, timeline). Contact emails and private operator notes are never shown. Treat your task ID like a link-shaped password.

Your data is never sold, shared with advertisers, or used to train AI models. It is disclosed only if the law requires it.

## Third-party services

- Google Cloud / Firebase — hosting, database, logging.
- Google Fonts — font files are fetched from Google's servers when pages load, which discloses your IP address to Google.

## Your browser's local storage

If the API is unreachable, the task form falls back to your browser's own localStorage — that data stays on your device. The admin dashboard stores the operator's key in sessionStorage on the operator's own browser.

## Retention & deletion

Records are kept while operationally relevant (open work, track record). Request a copy or deletion via /contact using the reply-to address associated with your task or message (or include its ID) — honored within 14 days.

## Don't send secrets

Per /trust: do not submit confidential information unless confidentiality has been agreed in advance.

## Changes

If this policy changes, the new version appears at this URL with an updated effective date; material changes are also noted in /agent.json. See also /terms.