Privacy policy
Last updated October 22, 2026
Creative Arena (creativearena.dev) is operated by Kyle Pomykala, an individual based in the United States, who is the controller responsible for the personal data described here. Questions and requests go to the contact address at the end of this page.
What is collected
Browsing generates connection and security information, such as IP address, browser and device information, pages requested and request times. Cookies and similar browser storage support sign-in, account actions, preferences and voting; blocking them may stop those features from working.
Vercel Web Analytics counts page views and visitors without cookies, recording page paths, referring sites, browser and device information, and approximate location. Visitors are counted using a hash of request information that is discarded within a day.
Vercel Speed Insights collects performance measurements from a sample of visits, including page paths, loading and interaction timings, browser and device information, and approximate location, to help identify slow pages.
If you sign in, the sign-in provider you choose supplies account identifiers and basic profile information, such as your name and email address. Sign-in services also process connection and device information to detect bots, fraud and other abuse.
Votes are recorded with an account identifier, the images compared, the choice and the time. The site also keeps the information needed to apply voting limits and show your voting history. If you contact the operator, that correspondence is kept to handle it.
You can browse without an account. Account information is needed to sign in and vote; providing it is a condition of using those features, not a legal obligation.
Why it is used
- To provide account access, save votes and show voting history.
- To calculate rankings and show results based on votes.
- To operate and secure the site, fix faults and prevent abuse.
- To prepare and license vote datasets, as described below.
- To answer requests, meet legal obligations and handle legal claims.
Names, email addresses and IP addresses are never sold or licensed.
Licensing vote data
Creative Arena may license vote datasets to AI companies and researchers to train or evaluate AI models. Licensing helps fund the site. Datasets may contain votes and their context, including prompts, image pairs, model names, choices and voting dates or times. Votes cast by the same person may be grouped together. Datasets don't include names, email addresses, sign-in account identifiers or IP addresses, but grouped votes can still be personal data. Every license will prohibit attempts to identify voters.
To object to licensing, email the contact address at the end of this page. The rights described below apply to licensing as well as to the site's other uses of personal data.
Who receives data
Service providers process data to host the site, deliver images, store the database, run sign-in, keep the site secure and handle email. The sign-in provider you choose also processes information under its own privacy notice. AI companies and researchers may receive the vote datasets described above. Public rankings and results are based on votes combined across users. Information may also be disclosed where the law requires it, or where needed to investigate abuse, protect legal rights or handle legal claims.
Legal grounds
Where EU or UK data-protection law applies: account access and saving votes are necessary to provide the service under the terms of use. Operating and securing the site, preventing abuse and calculating rankings rely on legitimate interests in a reliable service and fair results. Preparing and licensing vote datasets, and keeping votes after an account closes, rely on legitimate interests in funding the site and enabling AI training and evaluation. Handling legal claims relies on legitimate interests in protecting legal rights, and processing required by law relies on that legal obligation.
International transfers
Creative Arena is operated from the United States, and personal data may be processed there and in other countries where its service providers operate. Where EU or UK law requires safeguards for a transfer, it relies on an adequacy decision or approved contractual safeguards, including the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum. Email the contact address at the end of this page for information about the safeguards that apply to your data or a copy of the relevant terms.
How long data is kept
- Account information: while your account is open.
- Votes: while your account is open, then as described under Closing your account.
- Connection and security records: as long as needed to detect and investigate faults or abuse and prevent repeat incidents.
- Correspondence and records of requests: as long as needed to handle the matter and show it was handled properly.
- Records needed for legal obligations or claims: for the period the law or the claim requires.
Backup copies are removed as backups are replaced. Personal data still in logs or backups remains subject to these retention rules and your rights.
Closing your account
You can close your account from the Account page. Closing it removes your sign-in account and profile from active use. Your votes stay in the rankings and may be used in licensed datasets. Votes from the same former account stay grouped together, without the sign-in account identifier. They are kept for up to five years after the account closes, unless an erasure request requires deleting them sooner. You can still ask for them to be erased or object to their use. Removing the account identifier reduces the chance the votes can be linked to you but doesn't guarantee anonymity.
Your rights
Where the law gives you these rights, you can ask for access to your personal data, a portable copy of it, or its correction, erasure or restriction. You can object to processing based on legitimate interests, including licensing, on grounds relating to your situation, and that processing will stop unless the law permits it to continue.
Send requests to the contact address at the end of this page. You don't need to close your account to make one. You may be asked for information reasonably needed to verify a request. Requests are handled without undue delay and within the periods the law requires; under EU and UK law that is normally one month, and any permitted extension and its reason will be explained within that month. After an account closes, the former sign-in details alone may no longer identify its votes, so more information may be needed to find them. If votes can't be linked to you, you'll be told why that limits the request.
Where the law requires, anyone who has received your personal data will be told about its correction, erasure or restriction, unless that is impossible or involves disproportionate effort. Data already shared isn't automatically outside these rights.
People in the EEA can complain to a data protection authority, including in the country where they live or work. People in the UK can complain to the Information Commissioner's Office.
Children
Creative Arena is for people aged 16 and over. Accounts found to belong to someone under 16 will be closed, and their personal data handled as the law requires.
Changes
The date at the top shows the current version. Where the law requires it, information about new uses of personal data, and any consent they need, will be provided before those uses begin.
Contact
Send questions and requests by email.
Adapted from the Basecamp open-source policies / CC BY 4.0. See also the terms of use.