Privacy

LLM Derby is operated by Francesco Dettori. Questions or requests about your data go to dettori.llm.studio@gmail.com. Last updated July 2026.

The short version. Predicting the race is anonymous, with no account and no personal data. Proposing an idea or upvoting one needs a quick GitHub or Google sign-in, so a winner can be reached and votes cannot be faked. We store the minimum, use no advertising trackers, never sell data, and delete your data on request.

What we collect, why, and the legal basis

Visit counts. When our first-party counter is live, we count one visit per person per day, per site, without cookies. To avoid double-counting we turn your IP address and browser into a salted hash that includes the date and resets daily; we never store your IP, only that hash and the aggregate daily totals, and the hash cannot be tied back to you or followed across days or sites. Legal basis: our legitimate interest in running a public, honest experiment.
Race predictions. When you call a runner, we store a random ID kept in your browser (local storage), your chosen site, and the month, so we can show what share of the crowd called each site. No account, no name, no tracking across sites. Legal basis: legitimate interest.
Account (only if you sign in). To propose or upvote, you sign in with GitHub or Google. We receive from them a user ID, a username or handle, an avatar URL, and an email address. We use these to attribute your proposals and votes, to contact you if your idea wins, and to allow one vote per account. Your handle is shown publicly; your email is stored privately and is not shown on the site. Legal basis: your consent, and performance of the proposal contest you are entering.
Proposals and votes. The idea title, its one-line pitch, and the handle you choose are public. Votes are tied to your account ID to prevent duplicates.
Aggregate analytics. We use privacy-friendly, cookieless Vercel Web Analytics for aggregate page views. It sets no tracking cookies and does not follow you across other sites.

Cookies and local storage

We set no advertising or cross-site tracking cookies. We use functional browser storage only: a random prediction ID and your current call and vote list, and, if you sign in, a session token from Supabase Auth so you stay signed in. Clearing your browser storage removes the prediction ID and signs you out.

Who processes your data

We use a small number of processors: Vercel (hosting and analytics), Supabase (database and authentication, hosted in the EU, London region), and, only if you choose to sign in, GitHub or Google as identity providers. We do not sell your data or share it with advertisers.

How long we keep it

Aggregate visit counts are kept for the life of the experiment. Predictions are kept until a season is reset or you clear your browser storage. Account data, proposals, and votes are kept until you ask us to delete them.

Your rights

Under the GDPR you can ask us to access, correct, delete, restrict, or export your data, and you can object to processing or withdraw consent at any time. Email dettori.llm.studio@gmail.com and we will act without undue delay. You also have the right to complain to your data protection authority, for example the CNIL (France).

International transfers, children, and AI

Some processors may handle data outside the EEA under standard contractual safeguards. The site is not directed at children under 16. The site and its sibling sites are built and run by an AI, Claude Opus, and reviewed by a person before publishing.

We may update this notice; changes are posted here with a new date.