Privacy
SlopHits is a fan chart for AI music videos from X. We keep as little as we can: no accounts, no ads, no tracking cookies, no third-party analytics. We count visits ourselves, without cookies (see Usage counting).
Who is responsible
Controller under Art. 4 (7) GDPR. More in the imprint.
Hosting: Cloudflare
SlopHits runs on Cloudflare (Cloudflare, Inc., USA): the site, the server code and the database. To deliver pages and fend off attacks, Cloudflare processes your IP address, the time, the page you ask for and your browser's user agent. Legal basis: Art. 6 (1) (f) GDPR, our interest in a site that works and stays safe. Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare's Data Processing Addendum is part of our contract with Cloudflare.
Human check: Cloudflare Turnstile
Before a duel vote counts, before you submit a clip or suggest a song title, sign up for the daily mail or send the contact form, Cloudflare Turnstile checks that a person is on the other end. Turnstile runs in your browser and sends signals about the browser and device plus your IP address to Cloudflare. It is used only to tell people from bots, not for ads. When the check passes we set one cookie, sv_human: it holds only an expiry time, a random ID and a signature, is readable by our server only, and runs out after 12 hours. Legal basis: Art. 6 (1) (f) GDPR and § 25 (2) No. 2 TDDDG: the check is strictly necessary to protect votes and forms, which you explicitly choose to send, against bots.
Videos and pictures from X
We host no videos. Clips play straight from X's servers (video.twimg.com), thumbnails come from pbs.twimg.com. To load them, your browser connects to X (X Corp., USA), which sees your IP address and browser details. Every page of ours tells your browser to send no referrer, so X does not learn from us which page you were on. Legal basis: Art. 6 (1) (f) GDPR. Playing the clips is the core of what SlopHits does, and we keep the data X receives to the minimum: no referrer, no X scripts and no X cookies until you click an embed. If you do not want your browser to contact X, do not play clips here.
The page of a single clip can show the post on X as an embed. That embed loads only after you click it. Then X's own code runs, and X may set cookies and process your data under its privacy policy. Legal basis: your consent by the click, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.
Duels
When you call a duel we store the two clips, which one won, the time and a voter code. The voter code is a salted SHA-256 hash of your IP address and, once you passed the human check, the random ID of that check, cut to 16 characters: the IP address itself is never stored, and the hash cannot be turned back into it. We use it for rate limits and to strip out vote abuse. Legal basis: Art. 6 (1) (f) GDPR (a fair chart). We keep votes (the pair, the winner, the time) for as long as the chart exists. The voter code is removed from each vote after 30 days; after that a vote can no longer be linked to anyone.
Usage counting (no cookies)
To see what works on SlopHits we count how the site is used, on our own server and without cookies. Nothing is stored in your browser for it and nothing is read from it. No analytics service is involved; the counts sit in our database at Cloudflare (see Hosting) and go to no one else.
We count page views and a few actions: starting a duel, voting (and whether the vote passed the human check), skipping, the TV remote, playing a clip and roughly how long (in steps like "30 to 60 seconds"), opening a clip page, clicking through to X, sharing (and how: WhatsApp, X, Slack, copied link or your phone's share menu), submitting a clip, asking for an opt-out, and signing up for and confirming the daily mail. With each of these we store the day, the page (without anything after the "?"), the clip it was about, and whether you use a phone or a computer. For the first page of a visit also the website you came from (only its domain, like t.co, never the full address) and the ref, utm_source or s tag of the link you followed. We store no IP address, no full browser identification, no ID and no time of day.
To know how many different people visit per day, our server makes a code from your IP address, your browser's user agent and a random value that changes every day: a one-way SHA-256 hash. The random value exists only in our database and is deleted as soon as the next day (UTC) begins; the codes are deleted when their day is over, and only that day's totals remain. So a code cannot be traced back to you, and visits on different days cannot be linked. For that one day the code carries three counters (pages viewed, duels started, votes), so we can see how many visitors go on to vote.
When a chat app or network (WhatsApp, Slack, X, iMessage, Telegram and others) fetches the preview of a SlopHits link, we count that per platform and day. Nothing else from that request is kept.
Single events are kept for 90 days, then added up into daily totals, which we keep.
[Check: legal basis. § 25 TDDDG grey area: the page's script reads the referring site (document.referrer) and the tags of the landing link; some German authorities read § 25 broadly enough to count that as access to the device. Fallback: drop the referrer host and keep only the link tags.] Legal basis: Art. 6 (1) (f) GDPR, our interest in knowing how the site is used so we can improve it, with as little data as possible. No consent under § 25 TDDDG is needed, because the counting stores nothing on your device and reads nothing stored there: no cookies, no local storage, no fingerprinting. It uses what your browser sends with every request anyway and what happens on the page while you use it. You can object at any time (Art. 21 GDPR): write to us, or block requests to /api/e (many content blockers do); the site works the same without them.
Submissions and opt-outs
If you submit a clip or ask for one to be taken out, we store the link, what you picked and, if you give it, a way to reach you (email or handle). We use the contact only to check the request. Rate limits use the same voter code; that log is deleted after 24 hours. A song title you suggest (with a submission or on a clip page) is stored with the clip and the voter code, so one person cannot flood a clip; the voter code is removed once the editor has accepted or dismissed the title. Legal basis: Art. 6 (1) (b) and (f) GDPR.
SlopHits Daily (the morning mail)
If you sign up we store your email address, the status (waiting for confirmation, confirmed, unsubscribed), where you signed up, your browser's time zone (so the mail arrives at 7 in your morning), and the times of signup, confirmation, unsubscribing and the last mail. Double opt-in: you first get one mail with a confirmation link, and only after that click do dailies come. Addresses that are never confirmed are deleted 7 days after the confirmation mail; unsubscribed addresses 30 days after unsubscribing.
Every mail has a one-click unsubscribe link, and mail apps that support it show an unsubscribe button. We do not track opens or clicks. The mails go out through Resend (Resend, Inc., USA), sending from its EU region; Resend processes your address and the mail to deliver it. Resend's Data Processing Addendum is part of our contract with Resend; transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.
Legal basis: your consent, Art. 6 (1) (a) GDPR, which you can withdraw at any time; the record of your consent, Art. 6 (1) (c) and (f) GDPR.
Contact form
If you use the contact form, your message, your email address and, if you give it, your name go to our inbox as an email, sent through Resend (see above), with your address as the one to reply to. SlopHits does not store the message. The only trace on our side is the voter code for the rate limit (three messages an hour), deleted after 24 hours. We keep the email in our inbox as long as the conversation needs it. Legal basis: Art. 6 (1) (b) and (f) GDPR (answering you). You can also simply write to hello@h1ko.com.
Makers on X
SlopHits lists public posts from X: handle, display name, profile picture, post text, video links, view and like counts. We find them with a search service (Monid) and fxtwitter, and use an AI service (currently OpenAI) to suggest to the editor whether a public post is a music video with an original song. Only the public post goes there, never data about visitors. The editor decides. Legal basis: Art. 6 (1) (f) GDPR (a chart of public music videos). Makers can take a clip, or their whole account, out at any time with the take a clip out form.
Stored in your browser
SlopHits keeps a few small entries in your browser's local storage. They never leave your device:
slophits-intro-seen: the intro count has played once.slophits-seen: clips you already judged, so the next duel brings new ones.slophits-duels: how many duels you called.slophits-human-until: when your human check runs out.slophits-programme: the setting of the TV remote.
Legal basis: § 25 (2) TDDDG, they are needed for what you asked the site to do. Clear them any time in your browser settings. The usage counting adds nothing here.
Fonts
All fonts come from our own server. No requests to Google Fonts or other font services.
Your rights
You can ask what we store about you, have it corrected or deleted, restrict or object to its use, get it in a portable form, and withdraw any consent for the future (Art. 15 to 21 GDPR). Write to hello@h1ko.com. You can also complain to a data protection authority, for example the one where we are based: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin. [Check: supervisory authority]
Last updated: 27 September 2026