Better Than AI does not ask for your name, email, phone number, birth date, gender, country, job title, social accounts, avatar or nickname. Minimal does not mean zero, though: the data below can still be personal data under laws such as the GDPR, and we treat it that way. This notice describes the software as built; the operator of a particular installation is the controller and must complete it with their identity, contact point and legal basis.
What we store
| Data | Why | Retention |
|---|---|---|
| Account record (random id, creation date, day-precision “last active” date) | To run your account | Until you delete it |
| Keyed hash + scrypt verifier of your recovery phrase (never the phrase) | Sign-in | Until rotated or account deleted |
| Session records (hashed token, start, last seen, expiry) | Keep you signed in; let you revoke devices | Deleted after expiry (default 30 days of inactivity, max 180 days) |
| Your submissions: images (re-encoded, metadata stripped), versions, private notes | The challenge itself | Until you delete them or your account |
| Votes, expert scores and comments | Computing results | Open rounds: deleted with your account. Closed rounds: kept without any link to you, so published results stay reproducible |
| Reputation events, voting-reliability counters | Vote weighting, your Hall of Fame | Until account deletion |
| Push subscription (browser endpoint + keys), notification preferences | Only if you enable notifications | Until you disable them, the browser invalidates them, or account deletion |
| Rate-limit counters keyed by an HMAC of your IP address | Abuse prevention | Minutes to one hour; raw IP addresses are not written to the database |
| Audit log of administrative actions | Accountability | Kept for the life of the installation; contains account ids, never phrases or codes |
What we don’t do
- No advertising, analytics, fingerprinting, tracking pixels or third-party identity providers.
- No third-party requests from your browser: fonts and scripts are self-hosted; brief images can only come from this server.
- One first-party cookie for the session, one for your theme choice. No consent banner is needed for strictly necessary cookies — the operator should confirm this for their jurisdiction.
- No public discoverability. Your profile is private until you unlock it and shows only the works you publish.
Your controls
- Download all stored data as JSON (Settings → Your data).
- Delete individual submissions, withhold works from public results, lock your profile or regenerate its URL.
- Revoke sessions, rotate your recovery phrase, or delete your account immediately.
Hosting
The application is designed to be hosted in the EU, with the SQLite database and uploaded images on the same server (or EU object storage). Web Push messages travel through the push service of your browser vendor, which may be located outside the EU; payloads contain no personal data.
Open legal questions
Pending professional review: the legal basis for each processing activity, whether anonymised votes from deleted accounts are truly anonymous, retention of the audit log, the status of push endpoints, and — for any operation targeting users in Russia — whether personal-data localisation rules (Federal Law 152-FZ) apply. Using a VPN does not remove regulatory obligations. Nothing on this page claims an exemption from privacy law.