Privacy policy

Information needed for the service

We use information needed for age confirmation, language, authentication, saving privacy choices and preventing abuse. Identifiers for actions you choose, such as sign-in or posting, and connection information needed for security are separate from optional measurement. Cloudflare supports delivery and security checks; our databases and storage process authentication and enquiries. The discreet display setting uses an essential cookie containing only a binary choice, kept for 180 days. It is not linked to an account or viewing records. Revealed images are hidden again when you navigate.

Optional features and consent

Measurement, viewing history, recommendations and external players are off by default. We record and use data only for the purposes you accept. Consent for one purpose does not authorize another. Rejecting optional features does not prevent searching or ordinary account use.

• Usage measurement: Record page, search and link use for statistics.
• Viewing history: Save recently viewed listings so you can find them again.
• Recommendations: Use consented activity for recommendations and save tags you want to exclude.
• External players: Load video-service players and external thumbnails.

Saving and changing choices

You can save choices without an account; signing in synchronizes them with account preferences. We ask again when consent expires or the policy changes. Rejection or withdrawal stops the relevant recording and external connections, closes active players and clears optional browser records. Visits collected without consent are never repurposed as viewing history or recommendations.

External videos and links

Playing connects to an external service and shares your IP address and device information. Its cookies and policies may apply.

Before playback, you can permit only that video or separately allow future external players. Rejecting all optional features does not prevent later consent to one video. External images and players are not loaded before consent. Permission from rights holders and providers is checked separately from cookie consent. External sites apply their own policies after you follow a link.

Activities you choose

Comments, likes, ratings, shelves and follows are saved to carry out the actions you submit. Comments publicly show their text, optional display name, language and time. These explicit actions do not substitute for unconsented passive measurement. Using them for personalized recommendations also requires recommendation consent.

Retention, security, and your choices

Contact-form submissions are normally deleted within one year of receipt. We may retain them longer while a matter remains active or where legal duties or the protection of rights require it. Other data is retained according to its purpose and operational need, then deleted or replaced with aggregate information.

Access controls and transport protection are applied according to the nature of the data. HTML received by email is not executed or rendered in the administration interface. Use the contact form to request access, correction, or deletion of your contact data. A request may be limited where retention is required for legal or safety reasons.

Accounts and sign-in

We use your email address to create and manage your account. Passwords are one-way hashed with Argon2id; we do not store the original password. When you set, change, or reset a password, a breached-password check sends only the first five characters of its SHA-1 hash to the checking service. If that service is unavailable, we record that the check could not run and allow the password operation to continue; we do not record the password or hash. Email confirmation links expire after 24 hours and password-reset links after one hour. We store only a purpose-specific HMAC of each token. These links cannot sign you in. Confirmation is bound to the browser used to register; if you continue on another device, we also verify the pending password.

Notifications about new releases from followed creators are off by default. Work titles appear in notification emails only if you separately enable that setting. You can export information linked to your account as JSON from account settings. The export excludes passwords, session tokens, authentication secrets, and recovery codes. When you delete your account, we remove its email address, credentials, sessions, follows, notification settings, and account-linked activity from ordinary operating data. Every comment you posted remains as a blank record with its text and display name erased and a “Former member” label, whether or not it has replies. Records needed for safety, investigating violations, or legal duties may be retained with their links to the account, IP address, and device removed where possible. Encrypted backups may retain deleted data until scheduled expiry: daily copies for 7 days, weekly copies for 8 weeks, and monthly copies for 12 months. Account deletion does not rewrite existing backup copies.

Community features process agree or disagree votes on existing tags, proposed tag names and languages, support for proposals, and work ratings in four areas—story, visuals, situation, and satisfaction—each scored from 1 to 5. Public information is limited to agree/disagree totals for existing tags, support totals for approved proposals, the average and number of ratings for each area, and the names of approved proposals. Pending proposal names, individual votes, support, ratings, and proposer identity are not public. An approved proposal appears as a search candidate only after receiving at least five supports, and an administrator must separately confirm it for search. When you delete your account, we remove the account identity as well as your likes, watches, tag votes, proposal support, ratings, and pending or rejected proposals. Approved proposals remain as catalog proposal data, but we replace the proposer hash with a fresh, non-identifying hash that no longer links the proposal to your account.

To prevent old anonymous consent from recreating records after account deletion, we keep a separate security hash with no account association for 180 days, matching the consent lifetime. Scheduled cleanup removes it after expiry.

Creator applications and rights records

Creator applications and reports are received by email and the contact form. The owner reviews agreement emails, consent times and versions, rights evidence, and supplied text and images to manage publication. Private evidence is not displayed on the site. Location metadata is removed from images, which are published only after consent and rights checks.

Contact us to withdraw publication or request access, correction or deletion of personal information. Records needed to verify rights, investigate reports or meet legal obligations may remain after public access stops.

Listings viewed together

Only future visits with both viewing-history and recommendation consent contribute to these suggestions. A separate identifying hash removes duplicate subjects and listings. We retain at most 50 inputs per subject for up to 30 days, within the consent deadline. A pair appears only with at least five subjects; individual histories and subject counts are not public. We never backfill older history or unconsented records, or send this data to external AI services. Withdrawal, history deletion, account erasure and an identity change at sign-in invalidate the affected inputs and aggregates.

Creator data and embeds

We use applications, consent time and version, profile URLs, ownership and review records, submitted text and images, and aggregate activity to operate profiles. Codes are stored as hashes; pending information and images are accessible only to the owner and authorized staff. Image metadata such as location is removed before reviewed publication.

Loading an official player connects to the provider, whose privacy policy applies. Withdrawal stops public access. Account closure deletes personal applications, ownership evidence and supplied images from normal operating data. Published editorial articles may remain as desk content with the former author’s account association removed.