Privacy Policy

Last updated: October 30, 2026

This policy explains what personal data the operator of Nudzy (“we”) processes when you use nudzy.net and its subdomains (the “Service”), why, with whom it is shared and what rights you have. Questions and requests: support@nudzy.net.

1. Data we process

Visitors without an account

• 18+ confirmation: stored only as a cookie on your device for 30 days; nothing is recorded on our side.
• Language: if you choose a language, it is stored in a cookie for one year.
• View counting: to count album views once per day, signed-out visitors get a random cookie that expires at midnight (UTC). Stored views contain only a keyed hash of it, never your IP address.
• Abuse protection: a keyed hash of your network address (your IP address, for IPv6 its first half) is used as a rate-limit key and deleted after at most two days. These keys are not stored with views or accounts. We do not store raw IP addresses.
• Usage statistics: after you confirm the 18+ notice, we set a cookie (nudzy_aid) with a random identifier that is valid for 395 days (about 13 months) and is not extended. With it we record which kinds of pages are opened (for example “album page” or “tag page”, not which album or tag), how a visit started (the type of referring site, for example “search engine”, the referring domain, and campaign parameters in the link), the first page of a visit, whether a video was played, and actions such as saves, likes, follows and sign-ups. We store your device type, operating system, language, country (derived from the network, not your IP address) and whether you use Nudzy as an installed app. We do not store your IP address or your full browser identification. Before you confirm the 18+ notice we only count that the notice was shown, without an identifier.
• Your choice: if your browser sends a Global Privacy Control or Do Not Track signal, we set no identifier, record no usage statistics and do not load Google Analytics. You can also switch off our usage statistics for this browser here:
• Saving without an account: albums you save without an account are stored only in your browser (local storage, as a list of up to 200 album identifiers). To show them on your Saved page, your browser sends these identifiers to us; we use them only to answer that request and do not store them. When you sign in or create an account, the saved albums are added to your account and removed from your browser.
• Offline page and installing Nudzy as an app: on public pages your browser stores a service worker and a small offline page, which is shown when you have no connection. They do not cache albums, photos or videos. The prompt to add Nudzy to your home screen remembers on your device how often you visited and whether you dismissed it.
• Bot protection: some forms (sign-up, sign-in, password reset, reports) use Cloudflare Turnstile, which processes technical data about your browser to tell people and bots apart.

Account holders

• Account data: email address, username, display name, bio, profile picture, preferred language, a hash of your password (never the password itself), second-factor and passkey data, and the date your email was confirmed. If you sign in with Google, we receive your email address from Google; we do not store your Google name or profile picture.
• Sessions: for each sign-in we store when it happened, how you signed in and your browser/device description, so that you can see and end your sessions. Session cookies keep you signed in for up to 30 days; a “known device” cookie (up to 180 days) helps protect your account against password guessing.
• Activity: your likes, saves and follows, and — to avoid repeating posts in the For You feed — the posts you have seen in the last 7 days. For usage statistics, signed-in visits are linked to a keyed hash of your account identifier, not to your account itself.
• Followed tags: the tags you follow, to show new posts in Following and in the weekly email.
• Weekly email (optional): if you switch it on in your settings, we send a weekly email with links to new posts from the creators and tags you follow, only when there are new posts. It contains titles and links, no images. Each link contains a campaign parameter, so we can count visits from these emails (not who opened them). You can switch it off in your settings or with the one-click link in every email.
• Uploads: the photos, videos, titles, descriptions and tags you upload. We remove embedded metadata (for example EXIF location data) from the photos and videos we publish. With each upload we store your confirmation of the upload rules, with the time, your language and a keyed hash of your network address.
• Safety and moderation records: moderation decisions, reports concerning you or your content, warnings, strikes, and risk signals used to prioritise reviews (kept for up to 180 days), as well as an audit log of staff actions and a security log.

People who send reports

Reports can be sent without an account. For copyright notices and some other reports we ask for your name, email address and, for copyright notices, your postal address and phone number, because the law requires them; we store them with the case. In copyright cases, information from a notice or counter notice may be shared with the other party as described on the DMCA / Copyright page.

2. Why we use your data

• to provide the Service and your account (performance of our Terms);
• to keep the Service safe and lawful: moderation, abuse and fraud prevention, handling reports, enforcing our Terms, and reporting apparent child sexual abuse material to NCMEC or the authorities where required by law;
• to send you service emails (for example email confirmation, password reset, confirmations of reports and notices when your content is taken down) and, only if you switch it on, a weekly email about new posts you follow;
• to measure how the Service is used and improve it (Section 3);
• to finance the Service with video advertising on album pages (Section 4);
• to comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal data. We do not use your account data to build advertising profiles; the advertising on album pages is delivered by ExoClick as described in Section 4.

3. Analytics

Nudzy's own statistics

We use the data described in Section 1 (“Usage statistics”) to understand how often visitors come back, which features they use and where visits come from, and to improve the Service. Detailed records are deleted in a nightly run once they are 7 days old; a summary per browser and day for 120 days; the record of when a browser identifier was first and last seen for up to 400 days after its last visit. After that only totals without any identifier remain (for example “visitors per day”). Staff accounts are not included. This data is processed on our own servers and not shared.

Google Analytics

On public pages we use Google Analytics 4 (Google) to understand how the Service is used, for example which pages are visited. Google Analytics sets its own cookies (such as _ga) and processes information about your device and browser and your interactions with the Service on Google's servers, which may be in the United States. Google Analytics is not used on the staff (admin) area. You can block these cookies in your browser or use Google's browser add-on to opt out of Google Analytics (tools.google.com/dlpage/gaoptout). Google's privacy policy: policies.google.com/privacy. Google Analytics is not loaded if your browser sends a Global Privacy Control signal.

4. Advertising

To finance our video offering we use advertising services from ExoClick (EXOCLICK, S.L.). Cookies and technical data (for example the IP address) are processed to deliver and limit advertising.

On album pages, after you confirm the 18+ notice and press play on a video, your browser may load a short video advertisement (at most about once every five minutes per browser) from ExoClick's ad server (s.magsrv.com) and from the servers of advertising partners and advertising networks to which ExoClick passes the request, as well as from the advertiser's or ExoClick's content delivery networks. These partners can change at any time. ExoClick and the advertisers and advertising partners involved receive, among other things, your IP address, information about your browser and device, the page you are on and whether and how you interacted with the advertisement. ExoClick sets cookies on your device, for example c-tag (about one day), __uvt (up to two years) and zone-cap-… (limits how often an advertisement is shown; short-lived). The names and lifetimes are set by ExoClick and may change. No advertising is shown in the For You feed or in the staff (admin) area.

You can block these cookies in your browser settings or use an ad blocker; the Service then works without the advertisement. ExoClick's privacy policy: exoclick.com/privacy-policy. Confirming the 18+ notice before you enter the Service also means that you have taken note of these Terms and this Privacy Policy.

5. Service providers

We use the following providers to run the Service. They process data on our behalf, only as needed for their service:

• InterServer — server hosting (United States).
• Backblaze B2 — storage of uploads, original files and backups (United States).
• Bunny.net — video encoding, image and video delivery (CDN).
• Cloudflare — network delivery, security and bot protection (Turnstile).
• Resend — sending service emails.
• ExoClick — video advertising on album pages (Section 4).
• Google — optional sign-in with Google, and Google Analytics (Section 3).

Your data is therefore processed mainly in the United States. We also disclose data where required by law or to protect the safety of any person, for example to NCMEC or law enforcement.

6. How long we keep data

• Rate-limit and view-deduplication keys: at most 2 days.
• Posts you have seen in the For You feed: 7 days.
• Usage statistics: detailed records until the nightly run after they are 7 days old; per browser and day 120 days; first/last seen of a browser identifier up to 400 days after its last visit; totals without identifiers indefinitely. The identifier cookie expires after 395 days (about 13 months).
• Followed tags and email settings: until you change them or delete your account.
• Accounts whose email address was never confirmed: deleted after 7 days.
• Risk signals used to prioritise reviews: up to 180 days.
• Database backups are encrypted and kept for up to 30 days.
• Deleted content and accounts: they stop being visible immediately. We currently keep the account record (including email address and username) and the related moderation, report and security records after deletion, so that we can handle reports, enforce bans and meet legal obligations. Copies of reported content and related records are kept as long as a case is open, as long as required by law (for example after a report to NCMEC) and as long as needed to establish, exercise or defend legal claims. You can ask us to erase data we no longer need (Section 7).

7. Your rights

Depending on where you live, you may have the right to access your data, to correct it, to have it deleted, to restrict or object to its use, to receive a copy in a portable format, and to withdraw consent you have given. You can change most account data and delete your account in your settings. For anything else, contact us via support@nudzy.net. We may need to confirm your identity first, and some data must be kept for the reasons in Section 6. You can switch off usage statistics for your browser on this page (Section 1), send a Global Privacy Control signal, and switch off the weekly email in your settings or with the link in each email. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.

8. Security

We protect data with encryption in transit, restricted access for staff with two-factor authentication, signed and expiring links for media, and logging of staff actions. No system is perfectly secure; if you find a vulnerability, please tell us via support@nudzy.net.

9. Adults only

The Service is only for adults (18+). We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account and act as described in our Terms.

10. Changes

We may update this policy. The “Last updated” date shows the current version; for material changes we will notify registered users by email or on the Service.