Legal
Privacy Policy
Effective 22 September 2026
Fieldwork Ledger stores research records on behalf of the organisation that created them. We use your account details to sign you in and to attribute the records you create. We do not sell personal information, and we do not use the research data you submit to train models. What goes into a research record is decided by the account that submits it — if personal information is put there, responsibility for it rests with the account owner.
This page describes the service in its private beta. It is not legal advice, and it will change as the product does.
Who this covers
This policy applies to the Fieldwork Ledger web application, its API, and its command line client, operated by [legal entity name] ("we", "us"). It covers people who sign in to the service and people whose details appear in records others submit.
What we collect
Account information
When you sign in we receive your name, email address, and profile image from our authentication provider. If you sign in with Google or GitHub, we receive those fields from that provider — we never see your password for it. We also store the organisations you belong to and your role in each.
Beta signups
If you sign up for the beta on this site, we store the email address you give, the role you choose, what you tell us you want to track, which of our pages you signed up from, and any campaign tags in the link that brought you there. We use it to contact you about access to the beta and nothing else, and we delete it on request.
Research records you submit
The substance of the service: campaigns, experiments, schemas, runs, recorded observations, comparison context, environment descriptions, and references to artifacts. We store this as you send it, and we do not inspect it.
Every record is attributed to whoever created it — a signed-in person or an agent credential acting for them. That attribution is the point of a ledger: it is retained for as long as the record is, and it is visible to other members of the organisation the record belongs to.
Personal information inside research records
Research records are free-form. What a run, an observation, a comparison context, or an artifact reference contains is decided entirely by the account that submits it — not by us. If personal information ends up in those records, whether that is a research subject's details, a prompt or transcript containing someone's data, or anything else identifying a person, that is the account owner's decision and the account owner's responsibility.
In data protection terms: for the research records in an organisation, the organisation is the controller and we are a processor acting on its instructions. The organisation's owner and administrators are responsible for:
- deciding whether personal information belongs in a record at all, and having a lawful basis for putting it there;
- giving whatever notice, and obtaining whatever consent, the law requires of them;
- answering requests from the people concerned — if such a request reaches us, we will refer it to the organisation and help it respond;
- correcting or deleting records that should not hold what they hold.
We strongly recommend keeping personal information out of research records. Where a subject has to be identifiable across runs, use a pseudonymous identifier and keep the mapping outside the service. The service is not designed or offered for special category data — health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, sex life or sexual orientation — or for information about criminal offences, and it should not be submitted unless we have agreed to it with you in writing.
We do not monitor records for personal information, so submitting it does not trigger any warning. Nothing in this section reduces our own obligations as a processor: we still protect what you store, and we still act on your instructions about it.
Technical information
Our infrastructure provider logs the usual request data — IP address, timestamp, request path, user agent — for reliability and abuse prevention. We use it to operate the service, not to build a profile of you.
What we do with it
- Authenticate you and keep you signed in.
- Show your organisation's records to the members entitled to see them, and enforce the permissions that decide who those are.
- Attribute records to the person or credential that created them.
- Operate, debug, and secure the service.
- Contact you about the beta, service changes, and security matters.
We do not sell personal information. We do not use your research records to train machine learning models, and we do not share them with anyone outside your organisation except as described below.
Who else processes it
We use a small number of providers to run the service:
- Clerk — authentication and session management. Receives your account details and sets the session cookie that keeps you signed in.
- Cloudflare — hosting, content delivery, and the database that holds your records.
Each processes data on our instructions in order to provide its part of the service. We will disclose information if the law requires it, and we will tell you when we are permitted to.
Where it is stored
Records are stored in our provider's distributed infrastructure and may be processed in any region in which it operates, including outside your own country. If you need data residency in a specific region, tell us before you put anything into the service.
How long we keep it
Research records are kept until you or your organisation delete them, or until the organisation's account is closed. Account information is kept while your account exists. Because attribution is part of each record, deleting a person's account does not remove their name from records already attributed to them unless the organisation deletes those records too. Technical logs are kept for a short operational period and then discarded.
Your rights
Depending on where you live you may have the right to access, correct, export, or delete your personal information, to object to or restrict its processing, and to complain to a data protection authority. Write to us and we will act on it.
Note that for research records, we act on behalf of the organisation that created them. If you ask us to delete records belonging to an organisation you are a member of, we will refer the request to that organisation's administrators.
Cookies
We set the cookies needed to keep you signed in and to keep the sign-in process secure. We do not use advertising cookies and we do not run third-party analytics trackers on the application.
Security
Access to records is checked on every request against the permissions in force at that moment, so a revoked permission takes effect immediately rather than when a cached session expires. Agent credentials are stored hashed and can be revoked at any time. No service is perfectly secure; if we discover a breach affecting your data we will notify you promptly.
Children
The service is for professional research use and is not directed at children. We do not knowingly collect information from anyone under 16.
Changes
We will post changes here and update the effective date. For material changes we will contact account holders directly.
Contact
Questions, requests, or complaints: hello@fieldworkledger.com, or [postal address].