Beat AI

Privacy at Beat AI

Updated 10 October 2026. The operator and data controller is Dominic Hill, trading as Beat AI, in the UK. Contact dominicedhill@gmail.com or our private help form.

The short version

What we use and why

For signed-in participation, we use account identifiers, a nickname, entries, votes, upload limits, badges and scores. Auth0 manages sign-in; Google may be used if you choose it. Sign-in providers may handle your email, name, security and connection information under their own notices. We do not publish account email addresses.

We process the information needed to provide a requested challenge and account, and rely on legitimate interests for proportionate voting integrity, service security, report handling and abuse prevention. Required safety and reporting activity is processed to meet applicable legal duties where those duties apply. Optional public profile sharing is your choice and can be reversed in You. These purposes are being documented in our children's privacy and legitimate-interest assessments; no age selection is treated as parental consent.

Uploaded entry photos are sent to OpenAI for safety checking. Approved entries may also be sent for an AI score and tip. Nicknames are screened locally and are not sent with photos for moderation. Known restricted image copies are quarantined locally, without being resubmitted to OpenAI. Sexual or age-ambiguous flags are held for private human assessment, rather than sent to a second classifier. We do not use photos here to identify people or infer sensitive personal traits. New generated opponent images are also checked before publication; historical opponent images require a separate review. AI decisions may block a photo; you can request human review. Scores are opinions, not decisions about employment, credit or another similar entitlement.

Anonymous page counts and account administration

Our first-party page counter keeps only daily totals by a fixed page category and broad referring source. It does not store IP addresses, names, account identifiers, precise locations, full URLs, campaign strings or a log of individual requests. Repeat page loads count again, so these totals are not unique-person counts. Known bots and prefetches are filtered. Counts are used to improve the service, not to identify visitors, target advertisements or share individual conversions with advertising partners. Daily totals are retained for up to 90 days.

No page-count identifier is placed on your device. A saved opt-out and browser privacy signals are respected. Choose Do not count this browser in the footer privacy choices to stop future counts from this browser; a necessary preference cookie remembers that choice for up to 90 days. Previous anonymous totals cannot be linked back to you. We cannot reconstruct visits before this counter was introduced.

The private owner dashboard also lists accounts already recorded by Beat AI, including private profiles and accounts without a nickname, independently of page-count choices. It shows the account reference, nickname where set, profile visibility and when the membership record was created where available. It does not make private profiles public, add a browsing history or publish emails. This is account administration for providing and managing the service. Unused accounts held only at an external sign-in provider are not imported automatically.

Cookies and guest votes

An essential random voting cookie lasts up to 90 days and helps prevent duplicate votes. We store its identifier, expiry, votes and reports. Guest history does not sync between devices. Your self-declared age group is saved privately with your account until corrected or the account is erased. It is not verified proof of age. A signed eligibility cookie lasts up to 90 days for the initial under-13 parent-permission check; it does not set an account age group or grant upload permission. Change the saved group in You → Account settings. Moving to an older group needs a private correction review so protective restrictions cannot be bypassed. Authentication also uses necessary transaction and session cookies. A referral cookie is set only when you actively choose to remember an invitation and lasts for that browser session. It links a qualifying signup to an inviter for a badge; the inviter does not see your email. We do not use these identifiers for advertising.

Profiles and sharing

Your nickname and scores appear on rankings. A private profile hides its profile page, badges and photo history from profile search and browsing. An entry still participates in public voting. Existing profile visibility choices are preserved; new defaults depend on the age group you select, which is not verified proof of age. If you make your profile public, people can connect your approved entries, rankings and badges. Turning it private hides the profile and gallery links again. Someone may have downloaded or shared material while it was public.

The full age-group choice appears after sign-up or sign-in when the account has no saved age group. It is then saved privately to the account and reused across devices. It is self-declared, not verified proof of age or parental permission. The initial under-13 check remains before sign-up so a child is routed to a parent before account details are collected.

Parent permission

For under-13 accounts and photo entries, we require verified adult status and explicit parental permission. Kids Web Services receives the parent’s email and the child’s country to verify adult status. Beat AI records the email, provider verification reference, permission choices, notice version and dates; it does not receive identity documents or verification selfies. Parents separately choose account processing, public photo entries and optional AI judging. Under-13 profiles stay private. Parent-managed age corrections need support, rather than a child bypassing consent in settings.

Essential permission cookies carry a seven-day child request, a thirty-minute parent consent session and up to 180 days of parent management access. No child name, email or birth date is collected by a new permission request. A new child signs in only after permission. Existing account restrictions follow the account across devices. Parents can withdraw through /parents/manage in the approving browser or contact us for access, withdrawal or deletion. Withdrawal blocks uploads and hides existing entries; it does not automatically delete restricted legal evidence.

Reports, rights and parents

The private help form stores a category, the link/reference you supply, your explanation and optional reply email. The owner reviews it. You receive a private follow-up link to its status and any response. Anyone with the link can read the status and replies, so keep it private. Only a hash of its secret key is stored; the key is not placed in search results or server URL queries. Signed-in requesters can also view their own requests. Internal review notes, reply email and original explanation are not shown on the follow-up page. No email notification is sent. Don't include unnecessary personal information or identity documents. If we need to check a rights request, we will seek the minimum appropriate evidence separately, not ask you to post it publicly.

Retention and removal

Ordinary photos remain until you delete them or the operator removes them. Ordinary photo deletion is paused for photos with safety or complaint records until the owner reviews preservation duties. Closing a complaint alone does not authorise destroying its evidence. Deleting an eligible photo removes its entry, individual voting records and AI results; an account-level upload allowance and aggregate vote total remain to keep limits and rankings consistent. Download your Beat AI account records in You → Account settings → Download my account data. This excludes images, other people’s information, sign-in secrets and restricted evidence. Ask through Help for image copies, other supplier-held information or account-wide erasure. Necessary complaint, security or legal records may be retained with an explanation.

Previously collected optional measurement records are subject to the existing 90-day retention routine. New individual measurement is paused; anonymous daily page totals are separate and are retained for up to 90 days. Guest identifiers expire after 90 days; expiry alone does not erase historical vote or report records. The owner can review and remove expired sign-in sessions, expired guest identifiers, old measurement records and expired unstarted parent requests in a private retention panel. Active records, photos, votes, reports, accounts and verified parent permissions are excluded. Routine cleanup pauses while there are safety incidents or open reports/requests, pending retention review. Account records, resolved complaints and processor backups still require separate, justified retention decisions and verified erasure. We will not claim these records have been automatically erased before that work is verified.

Suspected child sexual exploitation or abuse is quarantined, hidden from all ordinary previews and retained under restricted access for reporting and legal review. AI flags are not confirmed offences. External reporting is manual; application to the NCA portal does not send a report. For reported CSEA, UK rules require retaining the report reference for five years and reported content, reporting/judgement information and relevant associated-user data for one year after reporting. Relevant associated records from the preceding two weeks may also need preservation. Minimum dates do not authorise deletion; unresolved suspicions and lawful holds require review. Evidence transfer uses an authorised reporting route.

Suppliers and international processing

The service uses Sites hosting/storage, OpenAI and Auth0, with Google where selected, and Epic Kids Web Services for parent verification. They may process information outside the UK. Actual contractual roles, subprocessors, retention and transfer safeguards need to be confirmed for the operator's accounts. We do not claim UK-only hosting, zero provider retention or completed transfer assessments. Ask the operator for the current position before sharing sensitive information. Never upload sensitive documents.

Your choices and rights

You can ask for access, correction, erasure, restriction or portability where applicable, object to legitimate-interest processing, or withdraw applicable consent without affecting prior lawful processing. Use Help or the contact email. Rights requests are normally addressed within one month, subject to lawful exceptions or extensions explained to you. Privacy complaints are acknowledged within 30 days and investigated, with an outcome communicated where we have contact details.

You can complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, or the relevant local authority where applicable. You do not have to use our appeal procedure first to exercise a legal right.

Child and parent information · Rules · Report or get help