1. Scope
This Privacy Policy applies to the Human Provenance Standard website, HPS Trusted Research Agent, browser extensions, Microsoft Word add-ins, verification and signing services, and related services.
Record the research trail, not the researcher.
2. Information we may process
Depending on the feature used, HPS may process account identifiers, creator or issuer identifiers, public keys, signatures, document hashes, timestamps, institutional attestations, record status, source titles and URLs, DOI information, evidence notes, research claims, claim-to-source relationships, AI-assistance disclosures, human-review records, document-audit results and provenance checkpoints.
3. Browser extension
The browser extension follows an explicit user-approved capture model. When you choose Save current page as source, it may record the current page title, URL, timestamp and a provenance event. It may also record AI-assistance disclosures, human-review notes and checkpoints when you deliberately create them.
The extension is not designed to collect browsing history in the background, keystrokes, passwords, form entries, unrelated tabs or hidden browsing behaviour.
The extension currently uses permissions such as activeTab and storage. activeTab is used when you explicitly invoke an HPS action on the active page. storage is used to keep provenance events locally in the browser.
4. Sending a browser trail to HPS
When you select Send to HPS, the extension packages the events you deliberately recorded and transfers them into the HPS Research Agent. In the current prototype, browser provenance may be encoded in the URL fragment of the HPS import page and decoded in the browser.
5. Microsoft Word add-in
The HPS Word add-in acts when a user deliberately invokes an HPS action. Depending on that action, it may read the current document or selected text, calculate a document hash, perform citation or claim checks, record an AI-assistance disclosure or transfer manuscript content to the HPS Research Agent. It is not designed to continuously record typing or keystrokes.
6. DOI and source verification
Where you ask HPS to verify a DOI, HPS may send that DOI to an external scholarly metadata service such as Crossref to retrieve bibliographic metadata. External services operate under their own terms and privacy policies.
7. Cryptographic keys and signing
Where HPS provides local key generation, private signing keys are intended to remain under the user's control. HPS may store public keys, identifiers, signatures and verification information needed to verify provenance records. Users are responsible for protecting private key material and passphrases.
8. Documents and hashes
HPS seeks to minimise storage of document content where a cryptographic hash can provide the required provenance function. Some workflows may process manuscript text where necessary for a user-requested citation, claim or provenance function. Private document content is not intended to become public merely because a hash or provenance record exists.
9. How we use information
- operate and secure the provenance service;
- verify records and signatures;
- provide citation, evidence-traceability and research-integrity tools;
- maintain research trails and institutional attestations;
- troubleshoot and improve HPS.
HPS does not sell research trails or personal information for targeted advertising.
10. Automated analysis and human review
HPS may surface potential provenance, citation or research-integrity issues, including missing citations, unresolved DOI records, source-origin concerns, possible contradictions or AI-review gaps. These are decision-support signals. They are not determinations of truth, misconduct, plagiarism, authorship or research quality.
11. Sharing and public records
HPS may share information where necessary with service providers, where a user deliberately requests interoperability, where an authorised institutional workflow requires it, where required by law, or to protect service security. Some provenance records are designed to be independently verifiable; information intentionally included in such records may therefore be visible to others.
12. Retention
HPS retains information only as long as reasonably necessary for the relevant service, legitimate provenance verification, legal obligations and platform security. Some issued records may need to remain historically verifiable and may be revoked, superseded or marked inactive rather than silently deleted.
13. Security
HPS uses safeguards appropriate to the information being processed, which may include cryptographic hashing, digital signatures, encrypted local key storage, access controls and secure communications. No internet-based system can guarantee absolute security.
14. Your rights
Depending on applicable law, users may have rights relating to access, correction, deletion, restriction or other processing of personal information. These rights may not always require deletion of historical cryptographic provenance where retention is necessary for integrity, verification or legal compliance.
15. Kenya data protection
Where Kenyan data-protection law applies, HPS intends to process personal information consistently with the Data Protection Act, 2019 and applicable regulations.
16. Changes
HPS may update this policy as integrations, APIs, institutional services or provenance capabilities change. Material changes will be reflected by updating the effective date.
17. Contact
Human Provenance Standard (HPS)
Elimara Technologies Limited
Kenya
Email: privacy@humanprovenancestandard.org