Privacy

Last updated: 18 October 2026

In short

• No ads, no analytics, no tracking. Nobody is profiling you here.
• Without an account, your packs stay in your browser. Your prompt leaves it to make the images, and, unless you switch it off, a short anonymous record of each wash (and the pictures you love) comes to us to make the waiting time honest.
• Your prompt goes straight from your browser to the AI Horde, which sees your IP address. Volunteers around the world then see the prompt, with no name attached.
• With an account, we keep your email address, your saved packs and a generation counter. You can delete all of it yourself.
• Do not put personal information in a prompt.

Who is responsible

SIXFINGERS is made by Tristan Ulrich, a student living in France, on his own and not as a business. He is the data controller. That means he decides what is collected and why, and he answers for it.

Contact: tristanulrichlobey@gmail.com

What happens when you make a pack

You type a prompt, pick a machine and press the button. Your browser then sends the prompt, the machine name and a few image settings directly to the AI Horde. SIXFINGERS has no server in the middle.

The AI Horde is run by Haidra, a non-profit association in Luxembourg. Because your browser talks to it directly, it sees your IP address, like any website you visit. It passes the prompt to a volunteer's graphics card somewhere in the world. The volunteer receives the prompt and the settings, without your IP address or any other personal information.

The six images come back from the Horde's storage and are kept in your browser. The full story is on How the images are made.

What the AI Horde does with it

• Images made with anonymous access, which is how SIXFINGERS uses it, are always shared with LAION, a public dataset used for AI research and training. Your prompt may travel with them.
• If the Horde's filter rejects a prompt, the Horde logs it with your IP address for 30 days, and anonymises the record after 365 days.
• Generated images sit on Cloudflare R2 storage behind links that expire after 30 minutes.
• The Horde sets no cookies.

The Horde has its own privacy policy: aihorde.net/privacy. It applies to what happens on its side.

So: never put your name, address, phone number or anything about another real person in a prompt. Once it is sent, we cannot pull it back.

The radio

The radio on the floor plays live public radio stations (Classic Vinyl and Adroit Jazz Underground from WALM, FIP and FIP Groove from Radio France, Radio Swiss Jazz, 0R Lo-Fi). Nothing is loaded until you turn it on. When you do, your browser connects directly to that station's server, which, like any website, sees your IP address. SIXFINGERS sends them nothing else and keeps no record of what you listen to.

What we keep

If you do not have an account

Your packs (prompt, machine, date, six images) and your preferences are stored in your own browser, using local storage and IndexedDB. They do not leave your device, except the prompt sent to the Horde as described above, and the wash record described just below.

What the laundromat learns from each wash

After a wash, your browser sends us, without any account: a random number that names this one wash, the machine, your prompt, the random seed, how the wash ended, how long we said it would take and how long it really took (the line, then the work), the state of the Horde when it started (how many requests and computers), how many pictures came back or were blocked, whether you use your own Horde key, and whether it was a phone or a computer. When you tap the heart on a picture, we also keep that picture, its recipe, its seed and the name the volunteer's computer gives itself. If you take the heart off, the record is marked as no longer loved; the picture itself stays until the retention period ends or you ask us to delete it.

We use this to make the announced waiting time honest and the machines better. It is stored by Supabase (see below), in a part of the database that nobody can read through the site; the pictures sit in a private store that only the maker of SIXFINGERS can open. We do not store your name, your email address or a cookie with it. Like any web service, Supabase's servers see the IP address of the request when it arrives and keep it in their technical logs for a short time; we do not copy it into the data. A prompt can still contain something personal if you wrote it there.

If the site breaks on your device, your browser also sends, at most five times per visit, the error message, the file and line where it happened, and a rough description of the device (operating system, browser and its version, screen size, pixel density, whether it is a touch screen, and the language setting). Nothing in it names you. When you write to us with "tell us", we receive your message and the same description of the device, and nothing else; this one is sent even when anonymous wash data is switched off, because you chose to send it.

We keep this data for three years, then it is deleted automatically. If you want a wash deleted sooner, write to the contact address below with the prompt and the day. You can switch all of this off in your profile ("share anonymous wash data"): nothing is sent after that. Switching it off does not delete what was already sent; write to us for that.

If you create an account

Accounts are optional. They let you keep your packs across devices. We use Supabase (Supabase Inc., United States) to run them, with the database and the stored images hosted in the European Union, in Paris (France). We store:

• your email address;
• an account id and the date you created the account;
• the packs you save: prompt, machine, date and the six images;
• a generation counter, used for the quota.

You sign in with Google or GitHub, or with a link sent to your email address when that option is open. We never store a password. If you use Google or GitHub, they confirm who you are and send us your email address, together with the name and profile picture of that account and its identifier there. We ask for nothing more (Google: "email" and "profile"; GitHub: your email address). The site itself only uses your email address; the rest is stored with your account by Supabase and deleted with it.

The only emails you will receive are those sign-in links. There is no newsletter and no marketing email, so there is nothing to unsubscribe from.

The hosting provider

The site files are served by Vercel Inc. in the United States. Like any web host, Vercel handles your IP address and basic request details to deliver the pages. See the legal notice for its details.

Why we are allowed to do this

The GDPR asks every service to name a legal basis for each use of personal data. Ours:

• Running the service you asked for (contract): sending your prompt to make images, keeping your account and your saved packs.
• Legitimate interest: the quota counter, which keeps a shared volunteer network fair; basic hosting logs, which keep the site working and safe; and the anonymous wash records and loved pictures, which make the announced waiting time honest and help choose and tune the machines. You can object at any time by switching "share anonymous wash data" off in your profile, or by writing to us.

Nothing here relies on your consent: we use no advertising, no analytics and no tracking.

How long we keep it

• Account data and saved packs: until you delete them or delete your account.
• Anonymous wash records and loved pictures: three years, then deleted automatically.
• Error reports and messages sent with "tell us": three years, then deleted automatically.
• Data in your browser: until you remove it (see Delete your data).
• Data held by the AI Horde: according to its own rules, listed above.

Data that leaves the European Union

• Vercel (United States). Vercel says it complies with the EU-U.S. Data Privacy Framework and uses standard contractual clauses where needed.
• Supabase (United States company, data hosted in Paris): the anonymous wash records and loved pictures of every visitor who has not switched them off, and accounts for those who create one. Support staff may access it from outside the EU; Supabase covers this with standard contractual clauses in its data processing agreement.
• Google or GitHub (United States), only if you choose to sign in with them.
• Ko-fi (United Kingdom), only if you choose to leave a tip. The tip happens on their site, under their own privacy policy; SIXFINGERS receives nothing about you from it.
• AI Horde volunteers (anywhere in the world). Your prompt reaches them with no identity attached. This is the honest weak point, and the reason we ask you not to write personal information in a prompt.
• LAION. Images made anonymously through the Horde are shared with this public dataset.

Your rights

Under the GDPR you can:

• see what we hold about you (access);
• correct it (rectification);
• have it deleted (erasure): see Delete your data;
• take a copy with you (portability): use "Download my data" in your profile window;
• object to a use based on legitimate interest.

Write to tristanulrichlobey@gmail.com. You will get an answer within one month.

If you think your data is mishandled, you can complain to the French data protection authority, the CNIL: www.cnil.fr.

Children

SIXFINGERS is not made for children under 15. In France, someone under 15 needs a parent's agreement to create an account. Without an account, we only keep the anonymous wash records described above, which can be switched off.

Changes

If this page changes, the date at the top changes too. If a change matters, account holders will be told when they next sign in.