Last updated: 5 November 2026
This policy explains how The Creative Room photo challenge website handles personal data, under the EU General Data Protection Regulation (GDPR) and the UK GDPR. It’s written to be read, so it uses plain language. It covers this website, the challenge emails, and entries to the challenges.
1. Who is responsible for your data
The data controller is Kessy.mp4, trading as “The Creative Room”, based in Hungary.
Email for any privacy question or request: [email protected]. (The address our emails are sent from, [email protected], cannot receive replies.)
We are a small, single-person project. We have not appointed a data protection officer, because the law doesn’t require one for a project like this.
2. What data we collect
If you enter a challenge
- Your first name (shown publicly with your entry).
- Your email address (never shown publicly).
- Your Instagram handle, and whether you chose to keep it private. If private, only the organiser sees it.
- Your photo. We keep three versions: a public web-size copy and a thumbnail, from which hidden data such as GPS location and camera details is removed; and your original file, kept privately, exactly as you uploaded it. The original may still contain hidden data (such as camera model, date taken, or GPS location if your camera or phone recorded it). Only the organiser can download originals.
- Your optional “why I edited it this way” text, and whether you allow it to be shown if you finish in the top three.
- Timestamps: when you submitted, when you replaced your photo, and when you ticked the consent boxes.
- A scrambled (hashed) code for your private “manage my entry” link, so we can recognise the link without storing it.
- The number of votes your entry received, and its place.
If you vote
- Your browser stores a random ID (see section 9). We store only a scrambled (hashed) version of that ID, so each browser can vote once per challenge.
- We store a scrambled (hashed) version of your IP address with each vote. It is only used to detect cheating (for example, many votes from one network) and is deleted 60 days after the challenge ends. We never store your IP address itself with your vote.
- Which entry you voted for, and when.
If you play duels (the side game)
- A scrambled (hashed) version of your browser’s random ID, separate from the one used for your official vote, so you never see the same pair twice.
- Which pairs you were shown, which photo you picked (or that you skipped), and when.
- A scrambled (hashed) version of your IP address. It is only used to detect cheating and is deleted 60 days after the challenge ends.
- A random session code, so your answers are accepted for about an hour after the anti-bot check. We keep only a scrambled version of it.
Hashed IDs are still personal data under the GDPR, because they could in principle be linked back to a browser or network. We do not use them to identify you or for anything other than fair voting and security.
The Hall of Fame
- The Hall of Fame adds up the public results of finished challenges by public Instagram handle: your handle, first name, places, points, badges and a thumbnail of one of your entries. Entries with a private handle are never included.
- To stop one person using another person’s handle, we keep a scrambled code made from the email address that first entered with each handle (never the email address itself). A later entry with the same handle but a different email address only counts after the organiser has checked it.
If you sign up for challenge updates
- Your email address, whether you have confirmed it, where you signed up (the sign-up form, or the box on the entry form), and when you signed up, confirmed or unsubscribed.
Emails we send you
- We keep a copy of each email we send (address, subject, content, and whether it was delivered), so we can check delivery problems and show what was sent.
Anti-bot and security data (everyone who submits, votes or signs up)
- Cloudflare Turnstile checks that you are a person, not a bot. To do this, Cloudflare processes information about your browser and device and your IP address. We only receive a pass/fail result.
- Rate limits: to stop abuse, we count attempts per network using a hashed version of your IP address, in short time windows.
- Server logs: our hosting providers (Cloudflare and Supabase) automatically record technical data when you visit, such as IP address, browser type, the page requested and the time. Our own email log lines mask email addresses (for example k***@gmail.com).
Challenge 001
Entries to the first challenge (RAW Edit Challenge 001) were collected through a Google Form and later copied into this website. That data includes first names, Instagram handles, submission times and edit notes, but not email addresses in the website’s database. Votes for Challenge 001 were recorded by the earlier version of the site using a browser identifier; they are kept unchanged as the record of that result.
What we don’t collect
We don’t use advertising, analytics or tracking tools, we don’t build profiles for advertising or tracking (the Hall of Fame only adds up public challenge results), we don’t sell your data, and we don’t use your data for automated decisions with legal or similarly significant effects. Winners are chosen by counting public votes, as explained in the Terms.
3. Why we use your data, and our legal basis
| What we do | Data used | Legal basis (GDPR Article 6) |
|---|---|---|
| Run the challenge you entered: receive and check your entry, enforce one entry per person, let you replace your photo, show your entry in the gallery and results, and send you the confirmation, “voting is open” and results emails | Entry data, email address | Performing our agreement with you (the Terms) — Art. 6(1)(b) |
| Show and share your entry, credited to you, on the site and on social media | Photo, first name, Instagram handle (unless private) | Performing our agreement with you (the licence in the Entrant Content terms) — Art. 6(1)(b) |
| Show your “why” text if you finish in the top three | Your “why” text | Your consent (the tick box) — Art. 6(1)(a) |
| Email you when a new challenge opens | Email address | Your consent — Art. 6(1)(a). You can withdraw it any time with the unsubscribe link. |
| Keep voting fair and the site secure: one vote per browser, vote limits per network, anti-bot checks, rate limits, investigating suspicious votes | Hashed browser ID, hashed IP address, Turnstile result, technical data | Our legitimate interest in a fair, secure contest — Art. 6(1)(f) |
| Run the duel side game fairly: show each browser new pairs, limit duels per browser and network, detect cheating, work out the Duel Champion | Hashed browser ID, hashed IP address, your duel answers, Turnstile result | Our legitimate interest in a fun, fair side game — Art. 6(1)(f) |
| Show the Hall of Fame, and stop one person using another person’s handle | Public handle, first name, public results, scrambled email code | Our legitimate interest in celebrating regular entrants, balanced by your right to be left out at any time — Art. 6(1)(f) |
| Keep a record of emails sent, to fix delivery problems | Email log | Our legitimate interest in reliable communication — Art. 6(1)(f) |
| Keep the public archive of past challenges and results | Photo, first name, Instagram handle (unless private), place and votes | Our legitimate interest in showing the history of the challenges, balanced by your right to ask for removal — Art. 6(1)(f) |
| Handle complaints, takedown notices and legal claims; meet legal obligations (for example tax records for prizes) | Whatever is relevant to the case | Legal obligation — Art. 6(1)(c), and our legitimate interest in defending claims — Art. 6(1)(f) |
Giving us your email address, first name, Instagram handle and photo is needed to enter. Without them you can’t take part. Everything else is optional.
4. Who helps us (processors) and who else sees your data
We use these service providers to run the site. They process data on our behalf, under their data processing terms:
- Cloudflare, Inc. (USA, global network): hosts the website, serves the photos (Cloudflare R2 storage), runs the anti-bot check (Turnstile), and sends our emails (Cloudflare Email Service). Also manages the domain name records for kessysmedia.com.
- Supabase, Inc. (USA; our project’s database is hosted in the EU, in Ireland): database, photo storage, the server code that handles entries and votes, and the organiser sign-in.
- Resend (USA): backup email service, used only if Cloudflare’s email service fails.
- Google (Google Ireland Ltd / Google LLC): the site loads its fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads. Google Forms was used to collect Challenge 001 entries.
Public by design: your first name, your photo, your place and votes, your Instagram handle (unless you keep it private), and your “why” text (only if you allowed it and finished in the top three) are visible to anyone. Winners and entries may be shared on Instagram; Meta handles anything posted there under its own privacy policy. If you click an Instagram link on our site, Instagram’s own policies apply.
We may also share data if the law requires it, or to protect our rights (for example with a lawyer or a court in a dispute).
5. Data outside the EU
Some of our providers are based in the USA or operate worldwide, so your data may be processed outside the European Economic Area and the UK. When that happens, we rely on the safeguards in each provider’s data processing terms, such as the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework (and its UK extension). You can ask us for more information about these safeguards.
6. How long we keep data
“The challenge ends” means the moment voting closes for that challenge.
| Data | How long |
|---|---|
| Public entry (web photo, thumbnail, first name, Instagram handle if public, place, votes) | In the public archive of past challenges until you ask us to remove it (see the Entrant Content terms). |
| Entrant email addresses | 12 months after the challenge ends, then deleted. |
| Private original photo files | 6 months after the challenge ends, then deleted. |
| “Why” text that isn’t public, and private Instagram handles | 12 months after the challenge ends, then deleted (together with the email address). |
| Hashed IP address stored with each vote | Only used to detect cheating. Deleted 60 days after the challenge ends. |
| The rest of each vote (hashed browser ID, which entry, time) | Kept with the challenge as the record of the result. It contains no IP address. |
| Hashed IP address stored with duel answers and duel sessions | Only used to detect cheating. Deleted 60 days after the challenge ends. |
| The rest of each duel answer (hashed browser ID, the pair, your pick, time) | Kept with the challenge as the record of the Duel Champion result. It contains no IP address. |
| Hall of Fame scrambled email codes | As long as your handle is in the Hall of Fame. If you ask to be left out, the codes are deleted and only your handle is kept, marked “hidden”, so it stays out. |
| Rate-limit counters (hashed IP address, short time windows) | Overwritten within minutes; deleted after 7 days. |
| Email log (copies of emails sent) | 12 months after the challenge ends (or after sending, for emails not linked to a challenge), then deleted. |
| Challenge-update subscribers | Until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days. After you unsubscribe, your address is deleted within 30 days. If we stop sending challenge emails, we delete the whole list. |
| Hosting and server logs | As set by Cloudflare and Supabase, usually days to a few weeks. |
| Records of privacy requests, complaints and takedown notices | 5 years after the matter is closed, in case of a legal claim. |
| Records of prizes awarded (if any) | As long as Hungarian tax and accounting rules require. |
We may keep data longer only if we need it for a legal claim or the law requires it.
7. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data (“right to be forgotten”), for example to have your entry removed;
- restrict how we use your data while a question is being sorted out;
- object to us using your data on the basis of legitimate interests (for example, to keep your entry in the public archive, or to show your handle in the Hall of Fame);
- data portability: receive the data you gave us in a common format;
- withdraw your consent at any time (for example, unsubscribe from challenge emails, or ask us to stop showing your “why” text). This doesn’t affect anything we did before you withdrew it.
Some rights have limits. For example, if you delete your entry during a running challenge, it is withdrawn from that challenge; and votes are stored without your name, so we may not be able to find a particular person’s vote.
8. How to make a request
Email [email protected] with the subject “Privacy request” (for example “Privacy request: delete my data”).
Please send it from the email address you used on the site, and tell us which challenge(s) it concerns. If we can’t confirm who you are, we may ask for more information. Please don’t send ID documents unless we ask.
We will reply within 30 days. If a request is complex, we may extend this by up to two further months, and we will tell you why within the first 30 days. Requests are free, unless they are clearly unfounded or excessive.
To stop challenge-update emails, you can also use the unsubscribe link at the bottom of any of those emails.
9. Cookies and browser storage
We don’t use advertising, analytics or tracking cookies, and we don’t show a cookie banner because there is nothing optional to accept. The site does store a few small items in your browser’s local storage, which are needed for the features you use:
- a random voter ID (
tcr-voter-token), so you can vote only once per challenge and see the gallery in a consistent shuffled order; - a note that you have voted or entered in a challenge (
tcr-voted-…,tcr-submitted-…), so the site can show “your vote” and your entry link; - how many duels you have played in a challenge (
tcr-duels-…), so the duel page can show your count; - on the organiser’s page only, the organiser’s sign-in session.
Cloudflare Turnstile (the anti-bot check) may use similar browser storage to tell people from bots; it is a security tool, not used for advertising. These items stay on your device; you can delete them by clearing your browser’s site data.
10. Children
This site is not directed at children. You must be 18 or over to enter (see the Terms). We don’t knowingly collect data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
11. Complaints
If you’re unhappy with how we handle your data, please contact us first, and we will try to put it right. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened.
- Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9–11, 1055 Budapest; naih.hu; [email protected].
- United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk.
- Other EU countries: your national authority, listed by the European Data Protection Board at edpb.europa.eu.
12. California and other regions
California: we don’t sell or “share” personal information (as those terms are defined in the California Consumer Privacy Act) and we don’t use it for targeted advertising. California residents can use the rights described in section 7 (to know, delete and correct their data) by emailing us, and we won’t treat you differently for doing so.
Elsewhere: wherever you live, you can use the rights in section 7. If the law where you live gives you more rights, we will respect them.
13. Changes to this policy
We may update this policy, for example if we change providers or add a feature. The date at the top shows the latest version. If a change is significant, we will say so on the site or by email to entrants of a running challenge.