• Email address and password. Held by our authentication provider so you can sign in and confirm your account. Passwords are never stored by us in readable form.
• Handle. Chosen by you. It is the only public identifier of you on the site. Your email is never shown publicly.
• Your image and the title you give it, plus its pixel dimensions and format, read from the file itself.
• Your photo number and whether it falls in the first 1,000 accepted entries.
• Votes you cast — which entry, which direction, and when. Votes are private to you.
• Moderation decisions about your entry, in an internal append-only record.
• Your AI disclosure — whether you declared the image AI-generated. This one is public: it is shown on your entry’s page.
• Your rights confirmation — that you warranted you held the rights, and when. Kept as evidence for takedowns and appeals, and never shown publicly.
• A session cookie so you stay signed in.

Reporting an image records the entry, the reason you chose, what you wrote, and your email address only if you give one. If you happen to be signed in, your account is recorded with it.

Reports are read by a person and are never shown publicly. We do not tell the entrant who reported them, and a report cannot be edited or deleted once made — it is evidence for the decision that follows. You do not need an account to report an entry.

We do not collect or store your IP address, device fingerprint, browser user-agent, advertising identifiers, or location. There is no analytics service, and no third-party tracking on this site. No cookie exists other than the one that keeps you signed in, so there is no consent banner to click.

Anti-abuse signals of this kind are described in our internal design documents but are not implemented and are not being gathered. If that changes, this page changes first.

We keep our own counters, in our own database, for a short list of events: a page was viewed, an account was created, an entry was started, a payment was made, a number was issued, a vote was cast. Nothing is sent anywhere else, and no third party is involved.

A counter records what happened, not who did it. No IP address, no user-agent, no device fingerprint, no location and no session identifier is attached to any of them. Your account is recorded only where the action already required you to be signed in — entering, paying, voting — because those are already yours. A page view by a signed-out visitor is a row with no person attached to it at all, and cannot be traced back to anyone.

These counters answer one question: whether the site works. They cannot answer what any individual did.

Payments are handled by Razorpay. Card details go directly to Razorpay and never reach our servers. We have never held a card number and have no way to receive one.

What we store against your account is the provider’s payment reference, the amount, the currency, the status, and — where one applies — the date a refund was made. That is what proves an entry was paid for, and it is kept as a financial record.

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• A payment provider, once payment is enabled. Not yet engaged.

These providers process data on our instructions in order to run the service. We do not sell personal data, and we do not share it for advertising.

Your original file is stored in a private location and is never served publicly. Only you can see your own submission while it is awaiting review.

If your entry is published, resized copies are served publicly — the original is not. The public page shows your number, your title and your handle. It does not reveal your email or any internal identifier.

Entries and their numbers are intended to be permanent: the competition is a fixed historical record, and a number that has been issued is not reissued.

Depending on where you live, you may have rights to access, correct or erase your personal data, to object to or restrict processing, and to complain to your data protection authority. Those rights come from the law where you live, not from this page, and nothing here reduces them.

There is no self-service export or account deletion in the product today. A request is made by writing to us through the contact page and is handled by a person. We would rather say that plainly than show a button that does not exist.

One thing we will not guess at: an issued number is permanent and is never reissued (see above), so what happens to a published entry and its number when an account is deleted is not yet settled. It is a decision we have not made, and we are not going to imply an answer here before we have. If you ask, we will tell you where that stands at the time.

Access is enforced in the database itself, not only in the application: each account can read only its own private data, and published entries are the only ones visible to the public. Original uploads are kept in private storage that no browser can address.

No system is perfectly secure. If a breach affects you, we will tell you.

One in Million is available internationally and its infrastructure providers operate globally, so your data may be processed outside the country you live in.

Privacy requests go through the contact page.