Privacy Policy

Last updated: October 20, 2026

This policy explains what personal data the operator of Nudzy (“we”) processes when you use nudzy.net and its subdomains (the “Service”), why, with whom it is shared and what rights you have. Questions and requests: support@nudzy.net.

1. Data we process

Visitors without an account

• 18+ confirmation: stored only as a cookie on your device for 30 days; nothing is recorded on our side.
• Language: if you choose a language, it is stored in a cookie for one year.
• View counting: to count album views once per day, signed-out visitors get a random cookie that expires at midnight (UTC). Stored views contain only a keyed hash of it, never your IP address.
• Abuse protection: a keyed hash of your network address (your IP address, for IPv6 its first half) is used as a rate-limit key and deleted after at most two days. These keys are not stored with views or accounts. We do not store raw IP addresses.
• Bot protection: some forms (sign-up, sign-in, password reset, reports) use Cloudflare Turnstile, which processes technical data about your browser to tell people and bots apart.

Account holders

• Account data: email address, username, display name, bio, profile picture, preferred language, a hash of your password (never the password itself), second-factor and passkey data, and the date your email was confirmed. If you sign in with Google, we receive your email address from Google; we do not store your Google name or profile picture.
• Sessions: for each sign-in we store when it happened, how you signed in and your browser/device description, so that you can see and end your sessions. Session cookies keep you signed in for up to 30 days; a “known device” cookie (up to 180 days) helps protect your account against password guessing.
• Activity: your likes, saves and follows, and — to avoid repeating posts in the For You feed — the posts you have seen in the last 7 days.
• Uploads: the photos, videos, titles, descriptions and tags you upload. We remove embedded metadata (for example EXIF location data) from the photos and videos we publish. With each upload we store your confirmation of the upload rules, with the time, your language and a keyed hash of your network address.
• Safety and moderation records: moderation decisions, reports concerning you or your content, warnings, strikes, and risk signals used to prioritise reviews (kept for up to 180 days), as well as an audit log of staff actions and a security log.

People who send reports

Reports can be sent without an account. For copyright notices and some other reports we ask for your name, email address and, for copyright notices, your postal address and phone number, because the law requires them; we store them with the case. In copyright cases, information from a notice or counter notice may be shared with the other party as described on the DMCA / Copyright page.

2. Why we use your data

• to provide the Service and your account (performance of our Terms);
• to keep the Service safe and lawful: moderation, abuse and fraud prevention, handling reports, enforcing our Terms, and reporting apparent child sexual abuse material to NCMEC or the authorities where required by law;
• to send you service emails (for example email confirmation, password reset, confirmations of reports and notices when your content is taken down);
• to measure how the Service is used and improve it (Section 3);
• to finance the Service with video advertising on album pages (Section 4);
• to comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal data. We do not use your account data to build advertising profiles; the advertising on album pages is delivered by ExoClick as described in Section 4.

3. Analytics

On public pages we use Google Analytics 4 (Google) to understand how the Service is used, for example which pages are visited. Google Analytics sets its own cookies (such as _ga) and processes information about your device and browser and your interactions with the Service on Google's servers, which may be in the United States. Google Analytics is not used on the staff (admin) area. You can block these cookies in your browser or use Google's browser add-on to opt out of Google Analytics (tools.google.com/dlpage/gaoptout). Google's privacy policy: policies.google.com/privacy.

4. Advertising

To finance our video offering we use advertising services from ExoClick (EXOCLICK, S.L.). Cookies and technical data (for example the IP address) are processed to deliver and limit advertising.

On album pages, after you confirm the 18+ notice and press play on a video, your browser may load a short video advertisement (at most about once every five minutes per browser) from ExoClick's ad server (s.magsrv.com) and from the servers of advertising partners and advertising networks to which ExoClick passes the request, as well as from the advertiser's or ExoClick's content delivery networks. These partners can change at any time. ExoClick and the advertisers and advertising partners involved receive, among other things, your IP address, information about your browser and device, the page you are on and whether and how you interacted with the advertisement. ExoClick sets cookies on your device, for example c-tag (about one day), __uvt (up to two years) and zone-cap-… (limits how often an advertisement is shown; short-lived). The names and lifetimes are set by ExoClick and may change. No advertising is shown in the For You feed or in the staff (admin) area.

You can block these cookies in your browser settings or use an ad blocker; the Service then works without the advertisement. ExoClick's privacy policy: exoclick.com/privacy-policy. Confirming the 18+ notice before you enter the Service also means that you have taken note of these Terms and this Privacy Policy.

5. Service providers

We use the following providers to run the Service. They process data on our behalf, only as needed for their service:

• InterServer — server hosting (United States).
• Backblaze B2 — storage of uploads, original files and backups (United States).
• Bunny.net — video encoding, image and video delivery (CDN).
• Cloudflare — network delivery, security and bot protection (Turnstile).
• Resend — sending service emails.
• ExoClick — video advertising on album pages (Section 4).
• Google — optional sign-in with Google, and Google Analytics (Section 3).

Your data is therefore processed mainly in the United States. We also disclose data where required by law or to protect the safety of any person, for example to NCMEC or law enforcement.

6. How long we keep data

• Rate-limit and view-deduplication keys: at most 2 days.
• Posts you have seen in the For You feed: 7 days.
• Accounts whose email address was never confirmed: deleted after 7 days.
• Risk signals used to prioritise reviews: up to 180 days.
• Database backups are encrypted and kept for up to 30 days.
• Deleted content and accounts: they stop being visible immediately. We currently keep the account record (including email address and username) and the related moderation, report and security records after deletion, so that we can handle reports, enforce bans and meet legal obligations. Copies of reported content and related records are kept as long as a case is open, as long as required by law (for example after a report to NCMEC) and as long as needed to establish, exercise or defend legal claims. You can ask us to erase data we no longer need (Section 7).

7. Your rights

Depending on where you live, you may have the right to access your data, to correct it, to have it deleted, to restrict or object to its use, to receive a copy in a portable format, and to withdraw consent you have given. You can change most account data and delete your account in your settings. For anything else, contact us via support@nudzy.net. We may need to confirm your identity first, and some data must be kept for the reasons in Section 6. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.

8. Security

We protect data with encryption in transit, restricted access for staff with two-factor authentication, signed and expiring links for media, and logging of staff actions. No system is perfectly secure; if you find a vulnerability, please tell us via support@nudzy.net.

9. Adults only

The Service is only for adults (18+). We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account and act as described in our Terms.

10. Changes

We may update this policy. The “Last updated” date shows the current version; for material changes we will notify registered users by email or on the Service.