01Information we collect
Artifact ID collects only what a contribution actually requires. There is no advertising network on this site, no third-party analytics or tracking script, and no cookies are set by Artifact ID for advertising or profiling.
Contributor information
- Full legal name — required, so an agreement acceptance can be attributed to a real person.
- Email address — required, so we can contact you about your submission.
- Public display name, collection name, affiliation, website — all optional.
- Attribution preference — public credit, "Private Collection," or no public identification.
- Founding Contributor interest — an optional yes/no.
Artifact and provenance information
The artifact name, category, subtype, material, measurements, weight, estimated cultural period and age, cultural affiliation, your stated identification confidence, and provenance details including country, state or province, general region, acquisition method and date, previous owner, collection history and free-text notes.
Please do not submit exact site coordinates. The portal asks only for a general location. Artifact ID may further generalize, redact or withhold location information to protect archaeological sites, property owners and cultural resources.
Photographs
The image files you upload, together with the original filename, file size, MIME type, the view type you assign to each photograph, their display order, and a SHA-256 checksum computed to confirm the upload completed intact.
Agreement acceptance record
When you submit, Artifact ID records evidence that you accepted the Contributor Agreement: the agreement version, the SHA-256 fingerprint of the exact agreement text displayed to you, each acceptance checkbox, the legal name you typed as a signature, and a server-side timestamp. This record exists to establish what you agreed to and when.
Technical information
Your IP address, your browser's user-agent string, and, for rate limiting, a salted SHA-256 hash of your IP address rather than the address itself. See Security and abuse information.
Information stored on your own device
If you begin filling in the form, the portal saves an unfinished draft in your browser's local storage so you can resume it. This never leaves your device and is never transmitted to Artifact ID. It contains only ordinary form fields.
The draft never includes your agreement acceptance checkboxes, your typed legal signature, the human-verification token, your photographs, or upload URLs. You are shown a clear "Resume saved draft" and "Discard draft" choice, and the draft is erased once a submission is finalized or you discard it. Clearing your browser data also removes it.
02Private versus public information
Your legal identity and your public attribution are stored separately and treated differently.
| Always private | May appear publicly |
|---|---|
|
Full legal name Email address IP address and user-agent Typed signature and acceptance record Original uploaded photograph files |
Public display name or collection name, only if you chose public attribution Artifact type, category, material and measurements Generalized location, such as country or state Cultural period and other artifact metadata |
Your email address is never included in public datasets. Your legal name and contact details do not automatically become part of a public artifact record.
If you choose "Credit as Private Collection" or "Do not publicly identify me," no contributor name or collection name is published alongside the record. Your attribution preference is independent of your identity: you can be a fully identified contributor in our records and still appear publicly as "Private Collection" or not at all.
Artifact ID reviews every submission, and not all submissions are accepted or published. Submission does not guarantee publication.
03Submission and image storage
Your photographs upload directly from your browser to a private storage bucket using short-lived, single-use signed upload URLs. Original files are not publicly readable, are not served from a public URL, and are not indexed by search engines. Retrieving them requires Artifact ID's own server-side credentials.
Uploads are limited to 15 MB per photograph, with a minimum of four and a maximum of twelve photographs per submission. Accepted formats are JPEG, PNG, WebP and HEIC/HEIF. These limits are enforced on the server, not only in your browser.
Submission records, contributor records, agreement acceptance records and photograph metadata are stored in a private database that is not directly reachable from the public internet. All writes pass through Artifact ID's own server-side endpoints.
Data is stored in the United States (US East). If you are contributing from outside the United States, your information will be transferred to and processed there.
04Security and abuse information
To keep the portal usable and to prevent automated abuse, Artifact ID collects a small amount of technical information:
- Cloudflare Turnstile — a privacy-preserving human-verification check that replaces a traditional CAPTCHA. It is used to confirm a submission came from a person, and its result is verified on our server. Turnstile is designed not to track users across sites.
- IP address — recorded with your submission and with your agreement acceptance, as evidence supporting the acceptance record and to investigate abuse.
- Salted IP hash — for rate limiting, we store a keyed SHA-256 hash of your IP address rather than the address itself, so repeated requests can be counted without keeping a plain list of addresses.
- User-agent string — recorded to diagnose upload failures and browser-specific problems.
- A hidden anti-spam field — invisible to you, used to detect automated form filling.
This information is used for security, fraud prevention, system operation and evidence of agreement. It is not used for advertising, profiling, or sale to third parties.
05Contact purposes
Artifact ID may use your email address to contact you about:
- your submission, including questions or requests for additional information;
- the status of a submission, or a decision about it;
- contributor programs, including Founding Contributor recognition if you expressed interest;
- important changes affecting material you contributed, such as a change to the Contributor Agreement;
- responding to a request you sent us.
Artifact ID does not sell contributor contact information and does not share it with third parties for their own marketing.
06Infrastructure and processors
Artifact ID relies on a small number of infrastructure providers to operate the portal. They process information on our behalf, under their own terms, and only as needed to provide their service.
| Provider | Role | What it processes |
|---|---|---|
| Supabase | Database, private file storage, server-side functions | All submission, contributor, consent and photograph data |
| Cloudflare | Website hosting, DNS, TLS, Turnstile human verification, email routing | Page requests, IP address, verification tokens, email sent to our contact address |
Adding a new processor that materially changes how contributor information is handled will be reflected in an updated version of this policy.
07Retention
Different categories are kept for different periods:
- Accepted submissions, photographs and artifact metadata — retained as part of the Reference Library for as long as Artifact ID maintains that record, because the library is intended as a durable reference resource.
- Agreement acceptance records — retained for as long as the related submission is retained, and afterwards for as long as needed to evidence the agreement. These records are immutable by design and are not edited or overwritten.
- Rejected or withdrawn submissions — the original photographs are deleted from storage. A minimal record of the submission and its outcome may be kept so the same material is not repeatedly re-reviewed, and so that we can evidence that a deletion request was honored.
- Security and rate-limiting records — the salted IP hashes used for rate limiting are short-lived and are pruned once they are no longer needed to enforce a limit.
- Local drafts on your device — controlled entirely by you, and removed when the submission finalizes, when you discard the draft, or when you clear your browser data.
08Deletion and withdrawal
You may ask Artifact ID to stop publicly displaying a submission, or to delete it. Email privacy@artifactid.org with your reference code — the code shown when your submission was received — and tell us what you would like done. See Withdrawal and Deletion Requests for what to include.
Artifact ID will evaluate every request and will honor deletion requests that are legally required.
An important limitation, stated plainly. Under section 4 of the Contributor Agreement, submitted material may be used in datasets that train or evaluate machine-learning systems, and may be included in publications, backups, licensed datasets and derivative works. Once material has been incorporated into a previously created model, backup, publication or distributed dataset, removing the original submission may not make it technically possible to remove what was already derived from it.
Artifact ID will comply with deletion and privacy obligations where required by applicable law, but cannot guarantee retroactive removal from all previously created or distributed material. If this limitation matters to you, please consider it before contributing.
Deleting an artifact submission does not delete the record that you accepted the Contributor Agreement. That acceptance record is evidence of a past legal act, and is retained separately.
09Your rights
Depending on where you live, you may have rights to request access to the personal information Artifact ID holds about you, to ask that inaccurate information be corrected, to request deletion, to object to or restrict certain processing, and to receive a copy of information you provided. Residents of the European Economic Area, the United Kingdom, California and several other jurisdictions have specific statutory rights of this kind.
To exercise any of these, email privacy@artifactid.org. We will ask you to verify that you control the email address associated with the submission before we act on a request, so that one person cannot alter or delete another person's contribution.
Artifact ID will not discriminate against you for exercising these rights. You will not be charged for a reasonable request.
10Children
The contributor portal is not intended for children. You must be at least 18 years old to accept the Contributor Agreement and submit an artifact. Artifact ID does not knowingly collect personal information from children. If you believe a child has submitted information, contact privacy@artifactid.org and we will delete it.
11Changes to this policy
If this policy changes, the effective date at the top will change. Where a change materially affects how contributor information is handled, Artifact ID will make reasonable efforts to notify contributors by email. Changes to the Contributor Agreement are handled separately: each agreement version is preserved, each acceptance is recorded against a specific version and fingerprint, and a new version requires a fresh acceptance before further submissions.
12How to contact us
For any question about this policy, your information, a withdrawal or deletion request, or to exercise a privacy right, email privacy@artifactid.org.
Please include your submission reference code if your question is about a specific artifact. It helps us find the right record without asking you for more personal information than necessary.