Privacy policy

Tekken Outfits (tekken.fit) is a fan-made, non-commercial project run by a private individual in Sweden. There is no company behind it, no advertising and no payments. For data-protection purposes that individual is the controller of the data described below, reachable at privacy@tekken.fit.

Browsing and downloading need no account, and we collect nothing about you for them beyond the server logs described further down. Everything else follows from something you chose to do.

• Account. If you sign up with an email address, we store that address and a hashed password — we never see or store the password itself. If you sign in with Google or with Discord, we receive your email address, your name and your profile picture from that provider; no password is involved.
• Profile. Your display name, your bio and your avatar. All three are public.
• Outfits you upload. The .tko file itself, the preview image the game stored inside it, and the outfit's name, description, character and item list, which are read out of that file. If you add a banner image to one of your outfits, we store that too. All of it is public.
• Activity. Which outfits you liked, and which outfits you downloaded while signed in. Downloads by signed-out visitors are not recorded at all.
• Technical logs. Our hosting and database providers keep ordinary server logs — IP address, browser user agent, requested URL, timestamps — which we use to keep the site up, to enforce upload rate limits and to deal with abuse.

This is a sharing site, so most of what an account holds is meant to be seen: your display name, avatar and bio, every outfit you upload with its name, description, preview and banner, and your like and download activity on an outfit. Anyone can read all of it, signed in or not.

So treat those fields as public writing. Do not put your real name, your address, your email or anything else you would not post in a forum thread into a display name, a bio, an outfit name, a description or a banner image.

• To run the service — signing you in, showing your profile and your outfits, serving downloads, counting likes and downloads. Legal basis: performance of our agreement with you when you create an account, and our legitimate interest in operating the site for everyone else.
• To send account email — sign-up confirmation, password resets, email-change confirmations. These are the only emails we send. There is no newsletter and no marketing mail. Legal basis: performance of our agreement with you.
• To keep the site safe — rate limits, moderating banner images before they go live, removing content that breaks the Terms, and investigating abuse. Legal basis: our legitimate interest in a working, non-abusive site.

We do not sell or rent your data, we do not share it with advertisers, and we do not use it to profile you. The site runs no analytics, no advertising and no error-tracking or session-recording tools. Our fonts are served from our own domain, so simply loading a page does not tell any third party that you visited.

We set cookies for one thing: keeping you signed in. They are set when you log in and cleared when you log out. There are no tracking, advertising or analytics cookies, which is why the site has no cookie banner — none is required for cookies that are strictly necessary to provide a service you asked for.

We use a small number of providers to run the site. They process data on our behalf, under their own privacy terms:

• Supabase — database, authentication and file storage (your account, profile, outfits and uploaded files). Privacy policy
• Vercel — hosting; serves every page and keeps the request logs mentioned above. Privacy policy
• Resend — delivers the account emails, so it processes your email address and the contents of those messages. Privacy policy
• Google — only if you choose to sign in with Google, in which case Google tells us your email, name and profile picture and knows that you signed in here. Privacy policy
• Discord — only if you choose to sign in with Discord, in which case Discord tells us your email, username and avatar and knows that you signed in here. Privacy policy

Some of these providers may process or back up data outside the EU/EEA. Where they do, they do so under their own data-processing terms and the standard contractual clauses those terms incorporate.

• Account, profile and uploads: for as long as your account exists.
• An outfit you delete: removed straight away — the entry, the .tko file, the preview image and any banner.
• A banner a moderator rejects: deleted, not archived. It is never shown publicly in the meantime.
• Server logs: kept on our providers' own retention schedules, typically a matter of weeks.

Under the GDPR you can ask us to give you a copy of your data, to correct it, to delete it, to hand it over in a portable format, to restrict what we do with it, or to object to processing we base on a legitimate interest. Most of this you can also just do yourself: your display name, bio and avatar are editable on your profile page, and any outfit you uploaded can be deleted from its page.

Email privacy@tekken.fit for anything else. We will answer within one month. If you think we have handled your data badly you can also complain to a data protection authority — ours is the Swedish Integritetsskyddsmyndigheten (IMY), and you can equally go to the authority in the EU country where you live.

You can delete your account from your profile page. That removes your profile and every outfit you uploaded, together with their files, preview images, banners, likes and download records — it cannot be undone, and your username becomes available again. You can also email privacy@tekken.fit and we will do it for you.

We may update this page as the site changes. The date at the top always says when it last changed, and we will say so on the site if a change materially affects what happens to your data.

Questions about this policy, or about your data: privacy@tekken.fit.