Privacy

In short

• Browsing the collections needs no account and sets no cookies. There is no advertising, no analytics service and no tracking across sites.
• Questions typed into Ask the collection and the Library assistant are sent to a language-model provider to be read. We send the words of the question and the figures or passages that answer it — nothing about you. We do not keep a record of questions.
• Staff who sign in to edit department pages have an account; that is the only personal information this site stores.
• Pictures and map tiles load from the services named below; your browser fetches them directly, as it does on any site with images.

What the site collects, and does not

Nothing to browse. The specimen records, maps, journeys, places, taxon and collector pages, the library and the department pages are public. Reading them creates no account and sets no cookie. We do not use Google Analytics or any other analytics or advertising service, and we do not fingerprint browsers.

Server logs. The site runs on Vercel. Vercel keeps short-lived request logs (address, time, page, browser string) for operating the service, as any web host does; we look at them only to find errors. They are not joined to anything else and expire on the host’s schedule.

Rate limiting. To keep the question features from being abused, each server instance counts questions per network address for ten minutes. The address is stored only as a one-way hash that changes daily, in memory, and is gone when the instance restarts.

Downloads and searches. Searches, CSV downloads, drawn areas on the places map and shared links are not tied to a person. A drawn shape is saved so its page has a permanent address; the shape says nothing about who drew it.

Staff accounts. Museum staff who edit the site sign in with an email address and password. We store the email, an optional name, which departments they belong to and their role, and the dates they signed in. Passwords are held only as hashes by our authentication provider (Supabase). These accounts are not visible to the public, except where a staff member chooses to appear on a department’s staff list.

Forms. Where a department page offers a form (a research or collections inquiry, say), what you type is sent to the department that owns the form and kept by it for the purpose you sent it. A form says, beside the button, where it goes.

Questions, and the models that read them

Two features use machine-learning language models: Ask the collection (/ask) and the Library assistant (on publication pages and in the library). We may use models from one or more providers, and change them without notice; at present the provider is Anthropic, through its commercial API. The provider sees only what we send. Here is exactly what that is, and what it is not.

• What is sent. The text of your question. For Ask, the model’s only job is to turn the question into search filters; the database counts the records, and the model is then given those figures — counts, years, names of taxa, islands and collectors — to write two sentences. For the Library, the model is given the passages from publications that match your question, and answers from those.
• What is removed first. Before a question leaves our server, anything that looks like an email address, a telephone number, a long number or a web link is replaced with a placeholder. The question is not sent with your network address, browser, location, cookies, account or any identifier; the provider cannot tell one asker from another.
• What is kept. We do not store questions, plans or answers. The figures an Ask answer is built from are counted fresh from the database each time (and cached briefly, by the filters, not by the asker). The address of an Ask page (/ask?q=…) contains the question itself, so a link you share carries your question with it.
• The provider’s side. Requests are made under the provider’s commercial API terms, which do not permit it to train models on the content, and under which it may retain requests for a limited period to monitor for abuse. Its current policy is at anthropic.com/legal/privacy; if we change provider, this page will change with it.
• What the models do not do. They never read or write the collection records; the answers’ numbers come from the database, and every number links to the records it counts. A model’s reading of a question is shown as filter chips so you can see and correct it.

Please do not put personal information about yourself or others into a question; it is not needed, and the filters above are a safety net, not a guarantee.

Other services your browser talks to

Some of what you see is fetched by your browser from other organisations’ servers, which therefore see your address and the file requested, as with any image on the web:

• Maps: satellite imagery tiles from NASA GIBS (earthdata.nasa.gov) and vector tiles and fonts from OpenFreeMap (openfreemap.org).
• Specimen photographs: from the Museum’s BishopVault, and from the image hosts of the records’ publishers (GBIF, iDigBio and the portals they aggregate).
• Living-species photographs and recent sightings: from iNaturalist (inaturalist.org), under their open licences.
• Collector portraits: from Wikimedia Commons.
• Videos: from YouTube, through its no-cookie player, and only when you press play.

Our own server also asks GBIF, iNaturalist, Wikidata and the Biodiversity Heritage Library for data about taxa and collectors. Those requests come from our server, not from you, and contain nothing about you.

Sensitive localities

For endangered species the exact collecting locality is withheld and coordinates are shown rounded to a tenth of a degree, so that the records cannot be used to find living populations. This is a protection for the species, not for people, but it is part of what the site deliberately does not publish.

Your choices and your rights

You can use everything on this site without giving us anything. If you are a staff member, you can change or remove your account by asking the site administrator. If you have submitted a form and want it withdrawn, write to the department it went to. For anything else about this page, write to nicholasg@bishopmuseum.org. The Museum’s general privacy policy, which covers bishopmuseum.org, ticketing and membership, is at bishopmuseum.org.