Privacy Policy

Effective 2026-09-10 · last updated 2026-09-10

Written by the site's developer and not reviewed by a lawyer. It describes what the code actually does.

The short version. There is no account, no login, no password, and no email address. We never store your IP address — only a salted one-way hash of it. We never ask for your name. We use no advertising, no third-party analytics, and no tracking cookies. But we do store the topics you type and the votes you cast, and we do intend to publish and license them. Treat the topic box as public.

1.Who we are

LLM Jokes Arena, a personal project operated by Yichen Zhang in California, United States. Contact: legal@llm-jokes-arena.com. For the purposes of the GDPR we are the data controller for the information described here.

2.What you actively provide

The topic you type: It becomes the instruction sent to both models. Stored, and intended for publication.
Language and emoji options: Stored with the battle.
Your vote (left / right / both / neither): The leaderboard is built from these. This is the whole point of the site.

3.What is recorded automatically when you start a battle

IP address: Stored as a salted one-way hash only, never the address itself, and the salt changes every month. Used for abuse prevention and rate limiting.
Country: A two-letter code (e.g. `US`), from Cloudflare. Tells us where the audience is.
Region or state: A code only (e.g. `CA`), from Cloudflare. Never a city, postal code, or coordinates.
Time zone: e.g. `America/Los_Angeles`. Tells us when the site is used.
Device type: One of `mobile`, `tablet`, `desktop`. For layout and performance decisions.
Browser and operating-system family: e.g. `Chrome` and `Windows` — the family only, never the full version string, which would be close to a fingerprint.
Referring site: The domain only (e.g. `reddit.com`), never the full URL. Tells us what brought people here.
Preferred language: The first tag only (e.g. `zh-CN`). Helps decide which joke languages to support.
Viewport size: A bucket (e.g. `768–1023`), never exact pixels. Exact size is a strong fingerprinting signal and no layout decision needs more than a few buckets.

We deliberately do not collect your raw IP address, your city, your postal code, your latitude or longitude, your full User-Agent string, your exact screen resolution, or any device fingerprint. Every one of those is available to us and every one was considered and rejected as more identifying than it is useful.

4.What is stored in your browser, not on our servers

The site keeps a few small values in your browser's local storage. They stay on your device; only the session id is sent with requests.

Session id: A random string generated in your browser. Used for rate limiting and for grouping the battles of one visit. Not linked to any identity.
Theme, interface language, joke language, emoji preference: Remembers your last choices so you do not have to set them again.

Clearing your browser storage resets all of it, including the session id. The site sets no cookies of its own; Cloudflare may set a security cookie as part of protecting the site.

5.What we do not do

No advertising, and no data sold or shared for advertising.
No third-party analytics — no Google Analytics, no Meta pixel, no session recording.
No cross-site tracking. Nothing follows you off this site.
No profile of you is built, because there is nothing to attach one to.

6.Why we may lawfully do this (GDPR / UK GDPR)

Running the site, showing jokes, recording votes: Performance of a contract, Art. 6(1)(b) — you asked for a joke.
Rate limiting, abuse prevention, cost control: Legitimate interests, Art. 6(1)(f) — keeping a free service running.
Aggregate statistics about the audience: Legitimate interests, Art. 6(1)(f).
Publishing and licensing the dataset: Legitimate interests, and the licence you grant in the Terms of Service.

If you are in the EEA or UK and object to the last row, contact us and we will remove your contributions from future releases.

7.Who else sees this data

OpenRouter, and through it the model providers: The topic you typed, as part of the instruction. Providers include OpenAI, Anthropic, Google, Meta, Alibaba, DeepSeek, Mistral and others.
Cloudflare: Your IP address and request, in the normal course of routing. CDN, DNS, TLS, DDoS and bot protection.
Vercel, Amazon Web Services, Supabase: Hosting for the front end, the API, and the database. All in the United States.
Microsoft (Azure Speech / Edge TTS): The joke text, when you press "read aloud".

We do not sell your data to advertisers or data brokers. Publication of the research dataset is described separately below, because under California law that may itself count as a "sale".

Some model providers may train on what they receive. Several providers in the pool - including some models from Meta, MiniMax, StepFun, Sakana, Thinking Machines, Mancer and Poolside, particularly on free or discounted tiers - state in their own terms that they may use the prompts and outputs sent to them to train and improve their models. The topic you type is part of what they receive. We cannot opt you out of that on a per-request basis, which is one more reason to never put personal information in a topic.

8.Publication and licensing of the dataset

This is the part most worth reading. The Arena exists to produce a public record of human preferences between AI-generated jokes. We intend to publish that record, and we may license it commercially, including to AI research organisations.

What a release would contain: the topic, the two jokes, which models wrote them, the vote, the language and emoji options, the timestamp, and coarse technical metadata such as country, device type and browser family. Records will be grouped by a release-specific pseudonymous id, not by your session id — so two releases cannot be joined together to build a longer profile of one person.

What a release would NOT contain: IP addresses or their hashes, your session id, referring domains, time zones, region codes, or anything else we judge could help re-identify an individual.

Before any release we will make reasonable efforts to detect and remove personal information from the topic text. We cannot guarantee we will catch everything, which is why the Terms of Service ask you not to type any.

9.How long we keep it

Battles, jokes, votes and the coarse metadata above: Indefinitely. The leaderboard is recomputed from the full vote history, so deleting votes rewrites history.
Salted IP hash: 13 months, then deleted. The salt rotates monthly, so a hash older than a month can no longer be matched against a new one anyway.
Server and CDN access logs: Our server's access log records no IP address, no User-Agent and no referrer - only what a request was, its status and how long it took - and is kept for at most 30 days. Cloudflare's own logs follow Cloudflare's policies.

10.Your rights

Wherever you are, you may ask us to tell you what we hold that relates to you, correct it, delete it, stop using it for a particular purpose, or give you a copy in a portable format.

Write to legal@llm-jokes-arena.com. We aim to respond within 30 days, and we will not charge you or treat you differently for asking.

A practical limitation, stated honestly. Because we hold no identifier for you, the only way we can find your records is if you give us your session id — shown at the bottom of this page — or the approximate time and topics of your visit. If you have cleared your browser storage, we most likely cannot locate your data. That is a privacy feature, but it does mean a deletion request may not be actionable.

EEA and UK residents may also complain to their national supervisory authority.

11.California residents (CCPA / CPRA)

Categories collected in the last 12 months: identifiers (a salted IP hash and a browser-generated session id); internet activity (jokes requested, votes cast); and coarse geolocation (country and region). Sources: you, and your browser. Business purposes: operating the site, preventing abuse, controlling cost, producing statistics, and research publication. We draw no inferences and build no profiles.

Do we sell or share personal information? We do not sell it for advertising and we do not "share" it for cross-context behavioural advertising. However, if we license the research dataset to a third party for money, that may constitute a "sale" under the CCPA, and we treat it as one.

To opt out, email legal@llm-jokes-arena.com with your session id, or use the "Do Not Sell or Share My Personal Information" link at the bottom of this page. We honour Global Privacy Control (GPC) browser signals as a valid opt-out request. You also have the right to know, delete, correct, and not be discriminated against for exercising these rights.

12.Mainland China (PIPL)

If you are in mainland China, please understand two things before using the Arena.

Where your data goes. The Arena is operated from the United States and runs entirely on US infrastructure. Using it means your topics, votes and the technical information above are transferred to and processed in the United States. The jokes themselves are generated by AI models operated by companies outside mainland China.

What the content is. Jokes are written by overseas AI models and are not reviewed or filtered by anyone before you see them. They are not produced under, and make no claim to satisfy, any content-review regime.

Your rights as described above are available to you on the same terms as to everyone else, at the same address, including the practical limitation about needing your session id. What we do not do: we have no establishment or designated representative in mainland China, we do not target advertising there, and we do not transfer personal information to any recipient in mainland China.

13.Children, international transfers, and security

Children. The Arena is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided information, write to legal@llm-jokes-arena.com and we will delete it.

International transfers. We operate from the United States and our infrastructure is in the United States. If you use the Arena from elsewhere, your information is transferred to and processed in the US, which may not offer the same protections as your home country. Our providers rely on Standard Contractual Clauses or equivalent mechanisms where applicable.

Security. Traffic is encrypted end to end, and our servers verify the database's certificate rather than merely encrypting to it. Database access is restricted to the application and the operator's own machine; there is no public database access. No system is perfectly secure, and we cannot guarantee absolute safety.

14.Changes and contact

We may update this policy. The "Last updated" date will change, and material changes will be flagged on the site. Questions, requests, or complaints: legal@llm-jokes-arena.com.

Do Not Sell or Share My Personal Information