Privacy
The ugliness is on purpose. The data handling is not. This page says what we keep about you, why, and for how long. Last updated 24 September 2026.
- Who is responsible
- Rino Sinčić, Croatia, who runs The Ugliest Website as a private project. Questions and requests about your data: digitalfiaka at gmail.com.
- What we keep
- A visitor cookie. The first time you open the site, your browser gets a signed, random visitor ID in a cookie called
ugly_visitor. It lasts one year. It is how the site remembers your vote, your ideas and your picture limit. It holds no name and nothing about your device, and it is not used for advertising or tracking across other sites. - Your votes. Which idea your visitor ID voted for on which day, so there is one vote per person and a fair count.
- A connection code, for one day. To allow at most three votes per internet connection, each vote carries a scrambled, one-way code made from your IP address and a secret that changes every day. We never store the IP address itself, and the code is erased at midnight.
- Ideas, names and pictures you send. The idea text and the display name you choose are public once approved: they appear on the ballot and, if the idea wins, in the history. A picture you attach is private until the idea is approved, then public with it. Pictures not attached to an idea within a day are deleted.
- Daily participation counts. Which visitor IDs visited on which day, to count visitors and voters.
- Sign-in attempts to the owner desk. Hourly counters keyed by a scrambled code of the address, to slow down password guessing.
- Why, and on what legal basis
- Running the game you are taking part in: counting votes, showing ideas, keeping the vote fair, and protecting the site from bots and abuse. That is our legitimate interest under Article 6(1)(f) of the GDPR, and for the ideas and names you choose to publish, the arrangement you enter by sending them (Article 6(1)(b)). The visitor cookie is strictly necessary for the vote to work, so it needs no consent banner. We do not sell data, show ads, or build profiles.
- Who helps run the site
- These services process data on our behalf:
- Vercel (hosting, in Frankfurt): serves the site and, like every web server, briefly sees your IP address. Vercel Web Analytics counts page views, referring sites, countries and devices without cookies. Vercel BotID checks, when you vote, suggest or upload, that the request comes from a real browser.
- Supabase (database, in Frankfurt): stores the votes, ideas and counts above.
- Cloudflare R2 (file storage): stores uploaded pictures.
- Anthropic (Claude): each night an AI assistant reads the day’s new ideas and pictures to moderate them and builds the winning change. It sees the idea, the display name and the picture, not your visitor ID or IP address.
- Vercel, Supabase, Cloudflare and Anthropic are US companies. Where data leaves the EU, it is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
- How long we keep it
- The connection code: until midnight. Pictures never attached to an idea: one day. The visitor cookie: one year in your browser. Votes, ideas, names, attached pictures and daily counts: for as long as the project runs, because the history is part of the game. Backups of the database are kept by the owner for recovery. You can ask for your data to be removed at any time.
- Your rights
- You can ask to see the data we hold about you, to correct it, to have it deleted, to limit how it is used, to object to its use, and to receive it in a portable form. Your visitor ID is random, so tell us the idea, display name or day it concerns and we will find it. Write to digitalfiaka at gmail.com. You can also delete the cookie in your browser at any time; the site will simply treat you as a new visitor.
- You have the right to complain to a data protection authority. In Croatia that is the Personal Data Protection Agency (AZOP, azop.hr), or the authority where you live.