Written plainly, because you are entitled to know before you type.
This is not a legal document written to protect us. It is a description of what the software actually does, checked against the running code rather than against what we intended it to do. Where something is imperfect, it says so.
Every exchange is written to a file on a server we run. That record holds:
Anything you type is stored as you typed it. If you write your name, your email address, or something private about your life, that is what goes in the file. Earth will not ask you for those things, and you do not need to give them to have the conversation.
Two companies, for one purpose: to write Earth's reply. Earth's words are produced by a language model, Google's Gemini, which our server reaches through a service called OpenRouter. Each time you send a message, our server sends OpenRouter your message, the conversation so far and Earth's instructions. OpenRouter passes them to Google, and the reply comes back the same way. For some messages this happens more than once: when your message looks like a search for a place, an event or something you need, and when a long conversation is summarised.
What OpenRouter and Google keep of those words, and for how long, is decided by their own terms, not by us. What we decide is what travels. The request leaves from our server, not from your browser, so neither company receives your network address, and no session or conversation identifier goes with it. Only the words.
Your browser holds the conversation identifier in local storage under
iami-conv. When you come back, the page sends it and the conversation resumes.
That memory lives in your browser, not in an account. Clear your browsing
data, or open the site on a different device, and it is gone permanently. There is nothing
we can do to recover it, because there is nothing linking it to you.
If a conversation grows too long to hold at once, Earth reads back the earlier part and writes its own summary of it, and tells you in the transcript when that happens. The original turns are then outside what it can see.
From the footer form. We store your address, the date, which page you sent it from, and the language. Nothing else, and it is not connected to any conversation. It exists so we can write to you when something real happens.
From inside a conversation with Earth. This one is different and you should know exactly how. We store the same four things plus the identifier of that conversation, because the whole point is to be able to give the conversation back to you. We then email you a link that does exactly that, once.
How the email reaches you. Any email we send leaves through Brevo, a company that delivers mail for us, so Brevo handles your address and the message on the way to you.
Until you leave an address, there is nothing anywhere connecting a conversation to a person. Leaving one creates that link deliberately, which is why Earth only offers it and never asks twice.
Three separate things.
The server's log. Like every web server, ours writes one line for each file it sends: the time, what was asked for, the network address that asked, the page that linked there if the browser says, and what the browser says it is. It keeps that for fourteen days and then deletes it. We use it to count how many real browsers arrived, as opposed to crawlers, and how many went on to a second page.
A summary of each visit. When you close or leave a page, it sends our server one short summary: which parts of the page were on your screen and for roughly how many seconds, how far down you scrolled, which of our own links and buttons you pressed, whether you were on a phone, the width of the screen, the kind of place you came from (a search engine, social media, typed in), your browser's language, and whether you tilted your phone to look around. That summary holds:
If your browser sends Global Privacy Control or Do Not Track, the page sends no summary at all. Summaries are kept for about thirteen months and then deleted by the server itself. The page we read them on shows only totals, such as how many visits reached the papers. No analytics company is involved: it all goes to the same server that runs this site.
The poster links. Two short addresses printed as QR codes on conference
posters, /r/aies307 and /r/ccs166, send you straight on to the paper.
Opened the way they are printed, those two are not written to the server's log above. They
have a log of their own, which holds the time, which of the two was opened, whether it sent you
on, and a rough kind of visitor worked out from what the browser says it is: a phone or tablet,
a crawler or link preview, one of our own checks, or anything else. It holds no network
address and does not keep what the browser said. Because it holds so little, it is
kept longer, for up to fourteen months, so we can count how often each
poster's link was opened after the conference is over.
The form on the contact page is protected by Cloudflare Turnstile, which keeps out automated spam. When that page loads, your browser fetches Cloudflare's script, so Cloudflare receives your network address and details about your browser and decides whether a person is filling in the form. When you send it, our server asks Cloudflare to confirm that decision and passes your address with the question.
What you write (your name, email address, the reason you chose and your message) is sent through Telegram to the founder, who reads it, and kept in a log with a one-way hash of your network address, the same kind of hash the conversation log uses. Your address is also held in memory for ten minutes so the form cannot be sent more than three times in that window. The six messages sent through the form in May 2026, before it was brought in line on 13 September 2026, still record the address in readable form.
These messages are kept like conversations, with no deletion schedule. To have yours removed, write to onebody@iami.earth.
Your network address is held in memory, not written to the conversation log, so that the service can limit how fast messages arrive and so that Earth can end a conversation with someone who is being abusive. If that happens, the address is recorded so that person cannot return.
Conversation records go back to 17 March 2026 and are currently kept indefinitely. We have not set a deletion schedule, and rather than imply one exists, this page says plainly that it does not.
Write to onebody@iami.earth and it will be
deleted. If you still have the conversation open, the fastest way to identify it is to send
the conversation identifier: open the chat, and it is stored in your browser under
iami-conv. If you do not have it, describe roughly when you visited and what you
talked about, and we will find it. You do not have to explain why.
IamI.Earth Foundation, a registered non-profit in Stockholm, Sweden, organisation number 802556-3308. Reach a human at onebody@iami.earth.
Last checked against the running code on 21 August 2026. The measurement section on 11 September 2026. The contact form section on 13 September 2026. The poster links on 14 September 2026. Who else handles your words, and how email reaches you, on 11 October 2026.