Privacy policy

What we collect

• Email address: to sign you in and contact you about your account, orders or a report you filed.
• Password hash: a one-way hash of your password. We never store the password itself.
• Age confirmation: the time you confirmed you are 18 or older and the method used (currently a date-of-birth self-attestation, with a reference id). The date of birth is checked when you enter it and is not stored.
• IP address hash: a salted one-way hash of your IP address, recorded when you sign in or download, and kept briefly when you file a report. It is used for rate limits and to spot account sharing and abuse. It cannot be turned back into your IP address.
• Orders: what you bought, the price, the status, and the BTCPay Server invoice id.
• Download log: which file you downloaded and when, so download limits work.
• Reports and requests: your email, the page, the reason and the details you give us.

No card data ever reaches this site. Bitcoin payments are made to a BTCPay Server invoice; we see the invoice id, amount and status, not your wallet keys. Card purchases happen on Fanvue, which handles its own payment data.

Why we use it

To run your account, deliver what you paid for, enforce the 18+ rule, prevent fraud, account sharing and abuse, handle reports about content and copyright, and keep the records the law or our payment providers require. We rely on performing our contract with you, our legitimate interest in keeping the site safe, and legal obligations.

Who processes it for us

• Cloudflare hosts and runs the site: Workers (the application), D1 (the database), R2 (file storage), Stream (video), KV (short-lived data such as rate-limit counters), Turnstile (the bot check on forms) and Access (sign-in protection for our admin area, which applies to staff, not members).
• Postmark delivers transactional email such as account, order and report messages.
• BTCPay Server creates and tracks the Bitcoin invoices for your payments.

These providers act on our instructions and only for these purposes. They may process data in the United States and other countries where they operate.

We do not sell your data

We do not sell, rent or trade your information, and we do not share it for advertising. We do not use advertising trackers or third-party analytics. We disclose information only to the providers above, or when the law requires it.

Cookies and local storage

• Session cookie: keeps you signed in. Removed when you log out, or after 30 days.
• Age gate cookie: remembers that you confirmed you are 18 or older at the entry screen, for up to a year.
• Turnstile: Cloudflare's bot check on forms may set its own short-lived data to tell people from bots.
• Theme preference: your light or dark choice, saved in your browser's local storage. It never leaves your device.

All of these are needed for the site to work. There are no advertising or tracking cookies.

How long we keep it

• Account details, age confirmation, orders and download logs: while your account is open, then only as long as tax, payment or legal record-keeping requires.
• IP hashes for report rate limits: about two hours.
• Sign-in sessions: until you log out or they expire.
• Reports and copyright notices: as long as needed to resolve them and keep a record of what was done.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete your account. Depending on where you live (for example California or the EU/UK) you may have further rights, such as to object or to complain to a regulator; we will honour them as the law requires and will not treat you differently for using them.

To make a request, email legal@example.com or use the contact form: choose "Other", enter /account as the page and say what you need. We confirm the request with the email on your account before acting. Deletion is handled by hand today, not from your account page, and we aim to complete it within 30 days. Deleting your account ends access to anything you bought; records we must keep by law are kept only for that purpose.

Children

This site is only for adults. No one under 18 may use it, and we do not knowingly collect information from anyone under18. If you believe a minor has an account, tell us and we will close it and delete its data.

Security

Data is sent over HTTPS, passwords are hashed, IP addresses are only stored as salted hashes, and files are served only to accounts that are entitled to them. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Changes to this policy

The date at the top of this page shows when this policy last changed. We will note significant changes on the site.

Contact

Privacy questions: legal@example.com, or the contact form. Postal address: