Privacy

Short version: accounts are free, needed only for the fight desk (the rest of the site works without one), and keep only what they need (your email, name, Google ID or a hashed password, sign-up page and dates); no ads, no selling data. We count visits and clicks anonymously so we know which creators send us visitors.

What we collect

• Page views and clicks on our buttons and fight cards, with the text of the button or card you clicked (for example “See analysis”), the page path, a coarse screen-size bucket (mobile, tablet or desktop), the referring website's domain, and the creator code if you arrived through a creator link (?ref=name).
• Which fight or fighter you opened, and, for the fighter search, only how many characters you typed and how many results came back. The search text itself is never sent.
• A random session ID kept in your browser's session storage. It is deleted when you close the tab and is never linked to your identity.

If you buy a plan

• Payments are handled by Stripe, our payment processor. Stripe collects your email address and card details on its own checkout page and keeps the billing records. Card numbers never reach CageFrame.
• What we keep, on your Stripe customer record: your plan, and for the monthly allowances which fights you unlocked (and until when each stays open) and how many questions you asked this month. For Lifetime, a reference to the payment, and a note if it was refunded or disputed. Each purchase also records the plan, the page to send you back to and the creator code, if you used one.
• One essential cookie, cv_billing, set only after a purchase. It holds your Stripe customer ID, signed so it can't be forged, and is how this browser proves it paid. It lasts up to 400 days and is renewed when you come back. Scripts on the page can't read it. Clearing your cookies removes your plan from that browser (your payment and plan stay with Stripe).
• A short technical cookie, cv_fresh, for about a minute after you unlock a fight or come back from checkout or billing. It holds only the time of that change, so the next page shows it straight away.

Ask CageFrame

When you ask a question, its text and the rest of that conversation are sent with the fight's data to our AI provider, Anthropic (or Google, if we switch providers), only to write the answer. We send nothing that identifies you. Answers to common first questions may be kept in our server's memory for a few hours so the next fan gets them faster; we don't keep a log of what you asked.

Who is responsible

The operator of CageFrame is the controller of the account data described below. Every right below can be exercised directly from your account page.

Your account (if you create one)

• What we keep: your email address and, depending on how you sign in, either your Google account ID and name (we use only these; any other profile field Google sends, such as your photo, is discarded, and we never get your contacts, files or Google password) or your password, stored only as a salted scrypt hash, never the password itself. Also: the date you signed up and last signed in, a count of recent wrong passwords (to lock the account for 15 minutes after 5 in a row), the page you asked to analyze when you signed up (its path only, never a search), the creator code you arrived with, if any, and your settings (units, favorite division, visit counting).
• Why: your email, sign-in details, settings and sign-in dates are needed to create and run your account (GDPR art. 6(1)(b)). The sign-up page and creator code tell us which pages and creators bring people to CageFrame, a legitimate interest (art. 6(1)(f)) you can object to at any time. We don't send newsletters or share your details with anyone.
• Where: a Postgres database run by Neon in the United States (AWS us-east-1), connected through our host, Vercel. Transfers outside the EU rely on each provider's data processing agreement and its Standard Contractual Clauses.
• Cookies: one strictly necessary sign-in cookie (cv_session, 30 days) and, only while you sign in with Google, a 10-minute security cookie (cv_oauth). No tracking cookies.
• How long: until you delete your account. You can see what we keep, sign out or delete everything at any time on your account page; deletion is immediate.

Your rights

On your account page you can see everything we keep, download it (JSON) and delete it, which also ends any use you object to. If you sign in with Google, your name and email come from Google and are refreshed each time you sign in, so correcting them in your Google account corrects them here. If you think we got something wrong, you can complain to your data protection authority (in France, the CNIL).

What we don't do

• No tracking cookies, no fingerprinting, no advertising or social-media pixels.
• Analytics events go to our own server first and contain no IP address or browser details. When we pass them on to our analytics provider (PostHog, EU), that request comes from our server, not your browser, and location lookup is turned off. Our hosting provider processes IP addresses briefly to deliver the site and protect it from abuse, as every website host does.
• If your browser sends Global Privacy Control or Do Not Track, nothing is recorded at all. The billing cookie still works, since your plan depends on it.