Privacy policy

The controller responsible for your data is [Operator name and address], based in Berlin, Germany (“FrameFight”, “we”).

For anything about your data, email [email protected]. We answer within one month, usually much sooner.

• We collect what the site needs to work: your account, the duels you judge, the comparisons you create, and basic usage data.
• Your individual votes are never public — not to other users, labs or sponsors. Only totals per model are published. Why
• We don't sell personal data and don't run ads.
• Prompts and start images are sent to AI model providers only to render your comparison.
• You can see, correct, export or delete your data — email us.

We use a few cookies that the site needs to work. They are strictly necessary (§ 25(2) no. 2 TDDDG), so they don't need consent:

• ff_at — your session (15 minutes, renewed automatically).
• ff_rt — keeps you signed in (30 days).
• ff_s — tells the site you have a session, so it can skip a request when you don't (30 days).
• ff_anon — random guest id for voting without an account (1 year).
• ff_ds — protects the Discord sign-in against forged requests (10 minutes).
• Cloudflare Turnstile — may store data in your browser to tell people from bots on sign-in.

Analytics cookies are described in the next section.

We use Google Analytics 4 to understand which pages people use. It is loaded through our own domain (a first-party proxy), with advertising features, ad personalisation and Google signals switched off. Until you accept, and if you reject, Google Analytics runs without cookies: nothing is stored on your device, and every page load is counted under a new random id, so separate visits are never linked. If you accept, Google Analytics sets the cookies _ga and _ga_* (up to 2 years).

We also use PostHog (EU cloud, through our own domain) to see how the site is used: page views, clicks, actions such as voting or starting a fight (never their contents), load times and errors. Until you choose, and if you reject, PostHog runs without cookies: nothing is stored on your device, and visits are counted with a hash of your IP address and browser that PostHog's server salts daily and then discards. If you accept, PostHog stores an id in the cookie ph_*_posthog and in local storage (1 year), links the visits of a signed-in account to its account id and public handle (no email or name), and may record session replays with every input masked.

The banner stores your choice in the cookie ff_consent (1 year); Cookie settings in the footer opens it again. You can also block these cookies in your browser; the site works the same without them. Google and PostHog act as our processors; data may be transferred to the USA (see transfers below).

Legal basis: for the cookieless measurement without stored ids, our legitimate interest in knowing how the site is used and where visitors come from (Art. 6(1)(f) GDPR); for cookies and session replays, your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future.

We use these providers to run FrameFight. Where they process personal data on our behalf, we have data processing agreements with them (Art. 28 GDPR).

Free renders run on open models on our own GPUs; the prompt doesn't leave our servers for them. Uploaded start images are checked for faces and nudity on our own servers before anything else happens with them.

Google, X and Discord are independent controllers for the sign-in they provide; their own privacy policies apply.

Some providers above are based in the USA or the United Kingdom. Transfers to the UK rely on the European Commission's adequacy decision. Transfers to US providers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards.

• Comparisons you publish, with your handle.
• Your public profile: handle, name, bio, level, badges and activity — you can hide parts of it or the whole profile in settings.
• Leaderboards built from everyone's votes. Votes are counted anonymously; nobody can see which clip you picked.
• Anonymised research datasets about where video models fail (duels, flags, descriptions) — without names, emails or handles. You can opt out in settings.

Prompts and uploaded images are checked automatically before rendering (for example for sexual content, real people, minors and gore). Votes and tasks are checked by an automated reviewer, which can reduce or withhold XP for careless or made-up answers. A person reviews flagged comparisons before they go public.

None of this has legal effects on you in the sense of Art. 22 GDPR, but if you think a check got it wrong, email us and a person will look at it.

• Account, profile and your content: as long as your account exists. After you ask us to delete it, we delete it within 30 days.
• Votes: when an account is deleted, its votes stay only as anonymous counts in the rankings — they can no longer be linked to you.
• Guest data: linked to the guest cookie for up to one year, or moved to your account when you sign up.
• Moderation records and strikes: up to two years after the last strike, to stop banned users from coming back.
• Server logs: up to 30 days, unless we need them to investigate abuse.
• Invoices and payment records: 10 years, as German tax law requires.

Under the GDPR you have the right to:

• access the data we hold about you and get a copy (Art. 15) in a portable format (Art. 20);
• have wrong data corrected (Art. 16) and data deleted (Art. 17);
• restrict processing (Art. 18);
• object to processing based on our legitimate interests (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7(3)).

Email [email protected] from the address on your account (or tell us your handle) and we'll handle it within one month. Many settings — public profile, emails, datasets — you can change yourself in settings.

You can also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany — or the authority where you live.

FrameFight is for people aged 16 and over. We don't knowingly collect data from younger children; if you think a child has an account, email us and we'll delete it.

Connections are encrypted (HTTPS). Session cookies can't be read by scripts. Each database query runs with only the rights of the person making it (row-level security), and production servers are reachable only through encrypted tunnels.

When we change this policy we update the date at the top. If a change matters for you, we'll tell you by email or on the site before it applies. See also our terms of use.