Privacy Policy

01Data We Collect

1.1 Unregistered Visitors

You can read the first chapter of any story without an account and without us collecting any personal data. We record a pseudonymous event (a chapter view) in an internal event log for content performance purposes. This event contains no user identifier, IP address, or device fingerprint — only a timestamp, a story ID, and a chapter number.

1.2 Registered Accounts

When you create an account, we collect and store the following:

1.3 Reading Activity & Taste Preferences

When you are logged in, chapter views generate a pseudonymous event in our internal analytics log. These events are used to derive taste preferences — a decaying weighted average across content tags that powers your recommendations. The preference score naturally fades over time, so your early reads do not permanently define what you see. This preference data is never exported, sold, or used for advertising.

Critically, reading activity is logged at the event level only — we record that a chapter was read, not the identity of who read it. The mapping between your account and any preference score exists only on our servers and is never transmitted externally.

1.4 AI-Generated Content & Prompts

Prompts you submit to the AI generation system and the resulting Generated Content are stored as part of your story data. Prompts are used to produce your content and are not used to train any AI model, shared with third parties, or logged to any external service. See Section 5 for details on our AI infrastructure provider.

1.5 Comments

Comments are moderated by an AI system before posting. Moderation occurs server-side in real time. Comment content is not sent to any external logging pipeline or used for AI training. Moderated comments that are blocked are discarded and not retained.

1.6 Technical Log Data

Our infrastructure may generate standard server logs containing IP addresses, request paths, and timestamps for security, debugging, and abuse prevention purposes. These logs are retained for a maximum of 30 days and are not used for any profiling or analytics beyond operational necessity.

02How We Use Your Data

We use the data we collect only for the following purposes:

• Authentication. Your email address is used to deliver magic links that sign you in. We do not use your email for marketing without your explicit consent.
• Service delivery. Account data, subscription status, and content are used to operate the Platform and provide you with access to the features you have paid for.
• Recommendations. Pseudonymous taste preference data is used to surface relevant stories. This processing happens entirely on our servers and does not involve any external profiling service.
• Content moderation. Comments are passed through an AI moderation layer before publication. This processing is real-time and server-side; no content is retained after the moderation decision is made.
• Billing. Payment data is processed by our payment provider. We retain transaction records for legal and accounting purposes.
• Platform integrity. Technical log data is used to detect abuse, prevent unauthorized access, and debug issues. Logs are not used for behavioral profiling.
• Legal compliance. We may process and retain data where required by applicable law, including responding to valid legal process.

We do not use your data to serve advertising, to build behavioral profiles for sale, or to train AI models.

03Data We Do Not Collect

For the avoidance of doubt, UncutFiction does not collect, process, or retain any of the following:

• Device fingerprints or cross-site tracking identifiers
• Precise or approximate geolocation data
• Browsing history outside of uncutfiction.com
• Social graph data or contacts
• Behavioral data sold or licensed to advertising networks
• Biometric data of any kind
• Government-issued identification numbers (except where age verification is legally required — see Section 10)
• Passwords (we use magic link authentication — no password is ever created or stored)

04Cookies & Local Storage

4.1 What We Use

UncutFiction uses a minimal set of first-party session tokens necessary for authentication. When you sign in via magic link, a session token is stored in your browser to keep you logged in. This token is first-party, HttpOnly, and Secure — it is not accessible to JavaScript and is not transmitted to any third-party domain.

4.2 What We Do Not Use

We do not use third-party cookies, advertising cookies, analytics cookies, or any tracking pixel. There are no cookies shared with Google, Meta, or any advertising or analytics network. We do not use cookie banners because there is nothing to consent to beyond the session token required to operate the service.

4.3 Local Storage

We may use browser local storage for functional preferences (such as display settings) that improve your experience. This data stays in your browser and is never transmitted to our servers or any third party.

05Third-Party Services

UncutFiction uses a small number of third-party infrastructure providers to operate the Platform. These providers are data processors acting on our behalf — they do not receive your data for their own purposes and are contractually bound to handle it in accordance with our instructions.

We do not use Google Analytics, Meta Pixel, Mixpanel, Segment, Amplitude, or any behavioral analytics service. We do not integrate with any advertising network or data broker.

06Data Retention

6.1 Account Data

Your account data is retained for as long as your account is active. When you request account deletion, your personal data (email address, username, preferences) is deleted within 30 days, subject to exceptions in Section 6.3.

6.2 Content

Stories and comments you publish are retained until you delete them or request account deletion. After account deletion, content published under a pseudonymous username may be anonymized and retained for platform integrity rather than deleted, unless you request full removal at the time of account deletion.

6.3 Legal Retention

Certain data may be retained beyond your account deletion where required by law — for example, transaction records for tax and accounting purposes (typically 7 years) or abuse logs where legally required. Retained data is isolated, not used for any other purpose, and deleted as soon as the retention obligation expires.

6.4 Server Logs

Technical server logs are retained for a maximum of 30 days and then automatically purged.

6.5 Pseudonymous Event Data

Pseudonymous chapter view events (which contain no personal identifier) are retained indefinitely for content analytics. Because these events contain no personal data, they are not subject to deletion requests.

07Security

UncutFiction implements security measures appropriate to the sensitivity of the data we hold:

• All data in transit is encrypted using TLS 1.2 or higher.
• Session tokens are HttpOnly, Secure, and SameSite=Strict — not accessible to JavaScript and scoped to uncutfiction.com.
• Magic link authentication eliminates password-based attack vectors. No passwords are stored in our systems.
• Database access is restricted to server-side application code — no client-side database queries are permitted.
• Our infrastructure runs on Cloudflare Workers, which provides process isolation per request.
• We do not store payment card data — card handling is delegated entirely to our PCI-compliant payment processor.

No system is perfectly secure. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

08Your Rights & Choices

8.1 Access and Portability

You may request a copy of the personal data we hold about you at any time by contacting contact@uncutfiction.com. We will respond within 30 days. Data will be provided in a commonly used, machine-readable format where technically feasible.

8.2 Correction

You may update your email address or username directly from your account settings. For other corrections, contact contact@uncutfiction.com.

8.3 Deletion

You may request deletion of your account and associated personal data at any time by contacting contact@uncutfiction.com. Deletion will be completed within 30 days, subject to legal retention obligations described in Section 6.3.

8.4 Objection and Restriction

You may object to or request restriction of certain processing of your personal data. Where processing is based on legitimate interests (such as abuse prevention), we will assess your objection and respond within 30 days.

8.5 Withdrawing Consent

Where processing is based on your consent (such as use of the Platform), you may withdraw consent at any time by ceasing to use the Platform and requesting account deletion. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

8.6 Username Pseudonymity

Your username defaults to a randomized pseudonym (adjective-noun-xxxxxx). You may change this in your account settings. If you choose to use a real name or identifying username, that is your choice — UncutFiction will not prompt or pressure you to do so.

8.7 Transactional Email

We send transactional emails only (magic links, subscription receipts, account notices). If we ever introduce optional marketing communications, we will seek your explicit opt-in consent and provide a clear opt-out mechanism.

09Children

UncutFiction is an adult platform intended exclusively for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected personal data from a minor, we will delete it immediately and terminate the associated account. If you believe a minor has registered on the Platform, please contact contact@uncutfiction.com immediately.

UncutFiction complies with applicable child protection laws, including the Children's Online Privacy Protection Act (COPPA). As an adult platform that explicitly prohibits minor access, we take no knowing actions that would collect data from users under 13, and we maintain an 18+ age gate consistent with our Terms of Service.

10International Users & GDPR

10.1 Where We Process Data

UncutFiction LLC is based in Wyoming, United States. Our infrastructure is operated primarily through Cloudflare and Supabase, which may process data in data centers located in the United States and the European Union depending on routing and configuration. By using the Platform, you acknowledge that your data may be transferred to and processed in the United States.

10.2 GDPR (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access — to obtain a copy of your personal data (Section 8.1)
• Right to rectification — to correct inaccurate data (Section 8.2)
• Right to erasure — to request deletion of your data (Section 8.3)
• Right to restriction — to restrict certain processing (Section 8.4)
• Right to data portability — to receive your data in a machine-readable format (Section 8.1)
• Right to object — to object to processing based on legitimate interests (Section 8.4)
• Right to withdraw consent — at any time (Section 8.5)

Our lawful basis for processing your personal data is: (a) contract performance — to operate your account and deliver services you have subscribed to; (b) legitimate interests — for security, abuse prevention, and pseudonymous analytics; and (c) legal obligation — where required by law. You have the right to lodge a complaint with your local data protection authority if you believe we have handled your data unlawfully.

10.3 Age Verification and Sensitive Data

Use of an adult content platform may be treated as processing of sensitive data relating to sexual preferences in certain jurisdictions. By using the Platform and explicitly acknowledging the 18+ age requirement at registration, you provide explicit consent to this processing for the purpose of accessing the Service. You may withdraw this consent at any time by deleting your account.

10.4 Your Jurisdiction

Regardless of where you are located, it is your responsibility to ensure that accessing UncutFiction is lawful in your jurisdiction. UncutFiction does not tailor its data practices to meet the requirements of specific local laws beyond GDPR and US federal law, though we will cooperate with valid legal process from any jurisdiction.

11Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated Policy with a new effective date and, where the change meaningfully affects your rights, by sending an email to your registered address at least fourteen (14) days before the change takes effect.

Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy. If you do not agree to the changes, you must stop using the Platform and request account deletion before the effective date.

12Contact

For any privacy-related questions, data requests, or complaints, contact us:

We aim to respond to all privacy requests within 30 days. For EEA/UK users exercising GDPR rights, we will respond within the legally required timeframe (generally 30 days, extendable by a further 60 days in complex cases with notice).