Privacy & data handling

Summary

• We collect ranked lists of restaurants Google Maps shows for 9 pre-set Boston-area locations, plus your responses to a brief 3-question demographic questionnaire (residency, age bracket, income bracket).
• Each submission is tagged with a randomly-generated installation identifier — never your name, email, Google profile, or IP address. Our research server does not store your IP address.
• The extension only runs when you explicitly click Start study. It does not run continuously and does not track your general browsing.
• The downloaded zip contains the readable files Chrome loads — you can inspect them before clicking Load unpacked.

What the extension collects

Each submission contains:

• An anonymous installation identifier (UUID v4) generated locally when you install the extension. This identifier links your searches together so we can compare them — it has no link to your identity.
• For each of the 9 Boston-area locations (Downtown, Boston Shopping District, Harvard Square, Jamaica Plain, Assembly Row, Natick Mall, Burlington Mall, Seaport, Coolidge Corner):
  • For each restaurant: venue name, ranking position, Google Maps URL, star rating, review count, price level, and whether the result was marked as sponsored or promoted.
  • Whether the result was collected signed-in or in incognito.
  • Timestamps for the start and end of the search.
• A login-status flag — a yes/no indicator that you were signed into Google Maps during the personalized search. The extension does not read your account name, email, or avatar.
• An eligibility attestation — a single yes/no flag plus a short version label, confirming that you affirmed at the consent step that you are 18 or older, live in the United States, are fluent in English, are using Google Chrome, and have an active personal Google account. The attestation is stored as a boolean plus a version string; we do not store a free-text age, address, language proficiency, or account identifier.
• Optional feedback collected on a separate page after your study data is submitted. Feedback is stored in its own table without your installation identifier and without your IP address; only a timestamp is recorded alongside the text. Leaving the field blank is a no-op.

What the extension does not collect

• Your name, email address, or Google account profile.
• Your browsing history, location, or anything outside the 9 pre-set Maps queries.
• The contents of any other tab or window. Content scripts only run on pages matching https://www.google.com/maps/*.
• Cookies, login tokens, or anything authenticated to your Google account.

Where your data goes

When you click Submit at the end of the study, the extension posts a single JSON payload to a study endpoint operated by the Social Urban Network Lab at Northeastern University. The payload travels over HTTPS only.

Network destinations contacted by the extension during a study run:

• *.google.com — Maps pages the content script reads (Google sees these as normal browsing).
• aiscapes.socialurban.net — this homepage's submission gate. When you click Submit, a small popup opens here and loads Cloudflare Turnstile (anti-abuse challenge) from challenges.cloudflare.com before forwarding your payload.
• api.socialurban.net — the lab's research API that receives the forwarded payload and stores it in the submissions database.
• *.basemaps.cartocdn.com — map tile imagery for the post-submit cohort map basemap. No submission data is sent.

The endpoint stores submissions in a research database accessible only to approved members of the research team, under the IRB protocol governing this study.

We do not collect any identifiable information. The study does not collect your name, email address, Google account identifier, browsing history, IP address, or contact information. Each study submission is associated only with a randomly generated installation ID generated locally by the extension. (For abuse prevention only, the server reads the connecting IP in memory at request time, but it is never written to the database or shared.)

Who can see your data

• Approved members of the Social Urban Network Lab research team.
• Northeastern University's IRB office, in the event of an audit.

Sometimes, authorized people may ask to see research information about you and other people in this study. They would only look at the information to make sure that the research is done properly. We would only permit people to see this information if they are authorized by organizations such as the Northeastern University Institutional Review Board.

Aggregate, de-identified results may appear in academic publications, talks, or open datasets — but only in forms that cannot be linked back to any individual installation identifier.

What you see after you submit

After your submission, the extension shows a map of popular Downtown Boston restaurants from privacy-protected aggregate study data. Your signed-in Downtown Boston picks are overlaid only when enough aggregate data is available. The map fetches the aggregate from our research server (no information about your specific submission is sent — only the request "show me the Downtown Boston aggregate"). Counts on the map are bucketed (shown as ranges like 25–50%, never exact numbers), and a restaurant is named only when at least 5 submissions list it. Your installation identifier is never echoed back in any of these views.

Cohort map — technical detail

The cohort map applies several disclosure-control rules before any place is named on the map. These detail what "privacy-protected" means in practice; the summary above captures what most participants need.

• A restaurant is named on the map only when it appears in at least 5 submissions. Below that threshold the place is suppressed entirely.
• Counts are bucketed into the bands the server emits (0–10%, 10–25%, 25–50%, 50+%); the raw counts are never returned to the client, and the client further collapses the two low bands into 0–25% before drawing.
• A submit-time install gate is on the lab's roadmap; until it ships, repeat submissions from the same install count as raw submissions toward the thresholds above. This means a determined participant could reduce the effective cohort size, but cannot expose other participants' lists.
• Aggregate hot-spots are computed on a 50 m grid: a cell is only emitted when at least 3 submissions, from at least 2 different installations, reference at least 2 different places in that cell. Single-place or single-install clusters never form a hot-spot.
• Each emitted cell's plotted location is offset by up to 25 m from the true cell centre (deterministic, so an attacker cannot average the offset away).
• The map response is frozen for 30 minutes per snapshot; submissions made between snapshots do not change what the next visitor sees.

How long we keep it

Submissions are retained for the duration of the research project and a follow-up archival period as required by the IRB. Beyond that, raw submissions are either deleted or further de-identified for long-term archival.

Future use of data

With no identifiable information collected, we might re-use information about you for future research studies or share it with other researchers without additional informed consent from you.

Withdrawing from the study

Participation is voluntary. If you do not participate or if you decide to quit, there will be no penalty, and you will not lose any rights, benefits, or services that you would otherwise have. You can stop at any time:

1. To stop the extension immediately: open chrome://extensions and click Remove on the AI-scapes card.
2. To request deletion of an already-submitted record, email the study contact below with your installation identifier (visible on the extension's thank-you page) and we will delete the matching submission from our database.

Your rights as a research participant

This study has been reviewed and approved by the Northeastern University Institutional Review Board (protocol [DRAFT — REPLACE BEFORE LAUNCH IRB#]). If you have any questions about your rights in this research, you can contact the Northeastern University Department of Human Research at Tel: (773) 396-2327, or Email: IRBReview@northeastern.edu. You may call anonymously if you want.

Contact

• Lab: socialurban.net
• Study contact: Dr. Lin Chen, l.chen2@northeastern.edu
• Principal investigator: Prof. Esteban Moro, e.moroegido@northeastern.edu

← Back to homepage