Who we are
Peace & AI is a steward-owned organisation in formation. It is not yet a registered legal entity, so for now the person responsible for your data (the data controller) is Sam Hopkins, co-founder, based in Portugal. Write to sam@peaceandai.org with any question about this policy or your data.
This policy covers two things: the public website at peaceandai.org, and the invitation-only share at share.peaceandai.org.
The website, peaceandai.org
- No cookies, no analytics, no advertising and no tracking scripts. Fonts and images are served from our own domain, so loading a page does not contact any third party.
- The site is hosted on Cloudflare. Like any web host, Cloudflare handles the technical details of each request (such as your IP address and browser type) to deliver the page and protect the site from attack. We do not use that data to identify or profile visitors.
- If you email us, we keep the correspondence so we can reply and follow up.
The share, share.peaceandai.org
The share lets people we have invited by name read the project documents we have chosen to share with them, and send us messages and files, either in their browser or through their own AI assistant (for example ChatGPT or Claude). Nobody can use it without an invitation.
Signing in with Google
You sign in with your Google account. We ask Google for the minimum it offers: the
openid and email permissions. From Google we receive only:
- your email address, and whether Google has verified it;
- Google's identifier for your account, so that a different account using the same email address cannot sign in as you.
We do not receive your name, photo, contacts, Gmail, Drive, calendar or anything else in your Google account. We use what we receive for one purpose: checking that you are on the invitation list and keeping you signed in. If you are not on the list, sign-in is refused and nothing is stored.
Peace & AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What the share stores
- Your invitation: your email address, Google's account identifier, and what you are allowed to do (read, or read and send).
- What you send us: messages, proposals and files (up to 2 GB each), with the time they were sent and which app sent them.
- An activity log: each action taken on your behalf (for example, which document was read, or that a message was sent) and when. You can see your own log on your status page.
- Reading state: which messages you have read and when you last visited, to show what is new.
- Sign-in records: if you connect an AI assistant, the access tokens that let it act for you. They last one hour and are renewed for up to 30 days of inactivity.
- Cookies: two, both strictly necessary: a session cookie that keeps you signed in for 12 hours, and a short-lived one (10 minutes) that protects the Google sign-in step. No advertising or analytics cookies.
We do not log your IP address in the share's own records.
Where it is kept, and who else handles it
- Cloudflare hosts the share and stores its data (database, files and tokens).
- Our own server in Portugal keeps a copy of messages, files and the activity log, so we can work with them.
- Telegram: when you send something, Sam receives a short notice naming who sent it and its title. The content itself is not sent.
- AI assistants: we use AI assistants, currently Anthropic's Claude, to help us read what you send and draft replies. Anthropic processes that content under its own terms and privacy policy.
- Your own AI assistant: if you connect ChatGPT, Claude or another app, that app sees what it reads from the share and what you ask it to send. What it does with that is governed by your agreement with its provider, not by us.
We do not sell your data, use it for advertising, or share it with anyone not listed above.
How long we keep it
We keep your invitation, messages and files for as long as you are invited and the collaboration is active. When an invitation ends, your access is switched off at once. Ask us at any time and we will delete your data within 30 days, apart from anything we are required by law to keep.
Your rights
Under the EU General Data Protection Regulation you can ask to see the data we hold about you, correct it, delete it, receive a copy of it, or object to how we use it. Email sam@peaceandai.org. If you are unhappy with our answer you can complain to the Portuguese data protection authority, the CNPD, or to the authority where you live.
We process your data because you asked to take part in the share (to provide the service you signed up for), and, for the activity log and security measures, because we have a legitimate interest in keeping it secure.
Changes
If we change this policy, we will update it here and change the date at the top. If a change matters to how your data is used, we will tell invited people directly.