Privacy Policy

1. What we collect

• Account data — your email address, username, password hash, and the settings you choose. If you sign in with Google or Apple, the identifier and email address that provider releases to us instead.
• Age and identity verification data — the documents and checks described in section 2.
• Payment data — handled by PAYMENT PROCESSOR, or by PayPal or Apple where you pay that way. We receive a token, the last four digits, the card brand, and the outcome. We never see or store your full card number.
• Activity — what you view and how far through it you get, what you subscribe to, purchase, tip, favourite, like, rate, review and search for, the messages you send and whether you have opened messages sent to you, and totals derived from all of it including what you have spent and how that compares with other members.
• Technical data — IP address, device and browser, sign-in history including the device and approximate location of each sign-in, and approximate location derived from IP, used for security, fraud prevention and legal geo-restrictions.
• Content and its records — anything creators upload, the verification records behind it, and data we derive from it including cryptographic hashes used to detect duplicates and known illegal material, and the location an upload came from.

Some of this is sensitive by any definition. What you watch on an adult platform can reveal your sex life or sexual orientation, and identity verification can involve biometric checks against a photograph. We treat both as special-category and sensitive personal information, we ask for your explicit consent before processing them, and you can withdraw that consent by closing your account.

2. Age and identity verification

Verifying that every user is an adult, and that every creator is who they say they are, is a legal requirement and the most sensitive processing we do.

Verification is carried out by AGE VERIFICATION PROVIDER. Where a government-issued document is required, it is submitted to them; we receive the result of the check and the minimum identifying data needed to tie it to your account, and we retain identity documents only where 18 U.S.C. 2257 obliges us to keep them. Records we are required to keep are held for RETENTION PERIOD and are accessible only to the custodian of records and to personnel with a specific need.

Several states that mandate age verification also limit or forbid retaining what was used to perform it. Where you access from such a state, verification data is discarded once the check returns, and nothing in the paragraph above is applied in a way that conflicts with that. CONFIRM PER-STATE RETENTION RULES WITH COUNSEL

3. Why we use it

• To operate the Service — accounts, access to content you have paid for, messages, and payouts to creators.
• To verify age and identity, which we are legally required to do.
• To detect fraud, chargeback abuse, account sharing and unauthorised access.
• To moderate content, including automated detection of prohibited material, with human review before any account is actioned.
• To recommend creators and content, and to rank creators in trending lists and leaderboards, using engagement, watch time, revenue, new content and follower growth.
• To send you service messages, and — if you asked for them when you signed up — offers. We may choose who to send an offer to based on how you have used the Service, including whether you have stopped using it.
• To comply with tax, accounting and law-enforcement obligations.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

4. What creators and other people can see

A creator you subscribe to or buy from sees your username, your subscription tier, when you subscribed, the tips and purchases you have made from them, the messages you send them, and whether you have read the messages they send you. They can mention your username publicly in their own posts. They do not see your legal name, email address, payment details, location, or what you do elsewhere on the Service.

Other members see your username where you have used it publicly — a comment, a review, a mention. Your spending, your rank, your library and your messages are yours alone; your rank is shown to you and to nobody else.

Creators are ranked publicly on the Service, and those rankings are calculated partly from revenue. A creator’s position is therefore a rough public signal about how they are doing. Creators are told this before they publish.

Search suggestions such as “people also searched for” are built from what everyone searches for in aggregate. They are never tied to an individual and are not shown to anyone as your search history.

5. Who else receives data

• Processors acting on our instructions — hosting, payments, age verification, identity providers where you use them to sign in, email and push delivery, error monitoring — each under contract and each limited to what their function requires.
• The National Center for Missing & Exploited Children and law enforcement, where we are required to report suspected child sexual abuse material. Those reports are mandatory, we cannot tell you about them, and we must preserve their contents for the period the law sets.
• Law enforcement or a court, where we are otherwise legally compelled. Where we are permitted to tell you, we will.
• A successor entity, if the business is sold, under the same commitments as this policy.

6. Cookies

We use cookies that are strictly necessary — sign-in, security, age-gate state, and remembering your preferences. We do not use advertising cookies or third-party tracking pixels. Analytics, where used, are limited to aggregate product measurement. CONFIRM ANALYTICS VENDOR

7. Automated systems and the right to a person

Automated systems screen uploads and flag content for review. Most of what reaches our moderators is put there by a machine rather than by a person, and the outcome can be the removal of content or the withholding of a payout.

No account is suspended or terminated, and no payout is permanently withheld, on an automated decision alone. A person reviews it first. If a decision goes against you, we tell you the reason, and you can contest it and ask for it to be looked at again by someone who was not involved the first time.

8. Messages we send you

Service messages — security alerts, billing notices, replies, changes to these documents — are part of holding an account and cannot be switched off while you have one.

Marketing and promotional messages are sent only if you asked for them. You can stop them at any time using the link in the message or by writing to PRIVACY EMAIL, and stopping them has no effect on your account.

9. How long we keep it

Account data is kept while your account is open. When you close it we delete or irreversibly anonymise your data within DELETION WINDOW, except for what we must keep: transaction records for tax and accounting, 2257 records for their statutory period, anything preserved because it forms part of a report to the authorities, and a minimal record of terminated accounts to stop them being recreated.

10. Your rights

Wherever you live, you can ask us for a copy of your data, correct it, delete your account, or object to a particular use. Write to PRIVACY EMAIL.

If you are in the EU or UK, you also have the rights granted by the GDPR, including portability, restriction of processing, the right not to be subject to a solely automated decision with legal or similarly significant effects, and the right to complain to your supervisory authority. Our legal bases are contract (operating the Service), legal obligation (age verification, records, tax) and legitimate interests (security and fraud prevention); for the special-category data described in section 1 we rely on your explicit consent under Article 9(2)(a), and where a legal claim requires it, Article 9(2)(f).

If you are in California, you have the rights granted by the CCPA/CPRA: to know, to delete, to correct, to opt out of any sale or sharing, to limit our use of sensitive personal information, and not to be discriminated against for exercising any of them. We collect sensitive personal information as that term is defined there — account credentials, government identifiers used for verification, and information that can reveal sexual orientation or sex life — and use it only to provide the Service, verify age, keep records the law requires, and secure accounts. We do not sell or share personal information as those terms are defined there.

11. Security

Data is encrypted in transit and at rest. Access to verification records and payment data is restricted to named personnel and logged. No system is perfectly secure. If a breach occurs we notify the relevant regulator within the deadline that applies to us, and we notify you where the breach is likely to put your rights, your finances or your safety at risk, or wherever the law otherwise requires it.

12. Nobody under 18

The Service is not available to anyone under 18 and we do not knowingly collect data from minors. If we discover an underage account we terminate it and delete the data, except what we must retain to report the matter.

13. Where we are and where data goes

We operate from PRIMARY JURISDICTION and use processors that may be located elsewhere. Where data leaves the EEA or UK it is transferred under Standard Contractual Clauses or an equivalent approved mechanism.

Two different appointments may be required of us in Europe, and they are not the same role: a data protection representative under Article 27 of the GDPR, and a legal representative under Article 13 of the Digital Services Act. Both are named below where they apply.

14. Changes and contact

We will post material changes here and notify you in the product before they take effect.

Contact: PRIVACY EMAIL. Postal address: REGISTERED ADDRESS. Data protection representative: EU/UK ARTICLE 27 REPRESENTATIVE, IF REQUIRED. Digital Services Act legal representative: EU ARTICLE 13 LEGAL REPRESENTATIVE, IF REQUIRED.