Privacy Policy

Draft — not yet reviewed by a lawyer. This wording was written in-house and is accurate about how the site behaves, but it has not been checked by anyone qualified. Passages in [SQUARE BRACKETS] are decisions still to be made.

This explains what we hold about you, why, and for how long. It describes what the platform actually does, not what is convenient to claim.

Who is responsible

[CONTROLLER IDENTITY AND ADDRESS] is the data controller. Data protection enquiries: [DATA PROTECTION CONTACT]. [WHETHER A DATA PROTECTION OFFICER OR EU REPRESENTATIVE IS APPOINTED.]

What we hold

Account details — email address, display name, date of birth, and the type of membership you applied as.
Profile content — anything you choose to write, and the photographs you upload.
Identity documents — a photo ID and a verification photograph, held only while a decision is pending.
Technical records — sign-in attempts, and a log of age-gate confirmations. IP addresses in advertising and referral statistics are stored hashed, never in the clear.
Transactions — orders and tickets, where you buy something.

Identity documents

This is the most sensitive thing we hold, so it is handled separately from everything else:

Encrypted with AES-256-GCM the moment they arrive.
Stored outside the public web space, so no web-server misconfiguration can expose them.
Viewable only by a reviewer, and every viewing is recorded against that reviewer's name.
Destroyed as soon as a decision is made — approved or rejected. Only the verdict survives.

Honest limitation, stated plainly: the encryption key is held on the same server as the files. This protects against a stolen backup or a database dump. It does not protect against an attacker who obtains full access to the server itself.

Photographs

Every image is re-encoded when you upload it. That removes the EXIF metadata a camera writes into a file, including GPS coordinates — which for a photograph taken at home is your home address.

Orientation is read before the metadata is discarded, so this does not rotate your photographs.

Who can see what

Albums are private by default. You grant access to named members one at a time, and you can withdraw it at any moment.
Your email address and any other contact detail are never shown to another member.
Administrators have no route to your approved private albums. Moderators see only photographs awaiting a decision, and every such view is logged.
Nothing on this platform is visible to search engines.

Nothing is sent to third parties

We load no external fonts, no analytics, no advertising networks, no social widgets. Every third-party request would be a record, held by somebody else, that your browser was on an adult site. There are none.

Advertisers see only aggregate impression and click counts. They are never told who you are, and outbound clicks carry no referrer.

How long we keep it

Identity documents — until a decision is recorded, then destroyed immediately.
Confirmation and password-reset tokens — 30 days, then deleted automatically.
Sign-in attempts — 7 days.
Age-gate confirmations — [RETENTION PERIOD FOR THE AGE-VERIFICATION COMPLIANCE RECORD].
Your account and its content — until you delete it.
Administrative audit records — [RETENTION PERIOD]. These record staff actions and survive the deletion of a staff account by design.

Your rights

You can download everything we hold about you as a file from your account settings, at any time, without asking.

You can delete your account from the same page. Deletion is immediate and real: rows are removed, and photograph files are erased from disk. It is not a flag that hides you.

[ADDITIONAL RIGHTS, THE RIGHT TO COMPLAIN, AND THE RELEVANT SUPERVISORY AUTHORITY.]

Security incidents

[BREACH NOTIFICATION COMMITMENT AND TIMEFRAME.]

Changes

Material changes will be notified to the address on your account before they take effect.