This policy explains what personal data The operators of is-totally.exposed (“we”, “us”) collects when you use is-totally.exposed and its subdomains (the “Site”), why, who we share it with, how long we keep it, and the rights you have. We are the controller of this data. You can reach us through the contact form.
The short version
- Everyone sees only a re-encoded copy of what you upload, with location, camera and other embedded metadata removed.
- We privately keep the original file you upload, with its metadata, and the IP address and browser it came from, so we can deal with abuse and legal requests.
- You can use the Site without an account. A cookie gives your browser an anonymous handle.
- We don’t sell personal data, don’t show ads and don’t use advertising or analytics trackers.
- We give data to authorities when the law requires it, and we report child sexual exploitation.
1. What we collect
| Data | When |
|---|---|
| The original photo or video file and its embedded metadata (for example date and time, camera or phone model and settings). We remove GPS and other location data from the original as soon as it is processed and don’t keep it. | Every upload |
| A stripped, re-encoded public copy and thumbnail, its caption, the room it’s in and a fingerprint (hash) of the file | Every upload |
| IP address and browser user agent | Stored with each upload; used briefly for rate limits and bot checks on other requests |
| A random anonymous identity and handle, and what that identity does: posts, likes, views, rooms created, reports filed, strikes and bans | On your first visit, and as you use the Site |
| Username, a hash of your password (never the password itself), optional email address, the date you accepted the Terms | If you register |
| Name, email, postal address, phone number, signature and statements | If you send a copyright notice or counter-notice |
| Anything you include in a report or in a message to us | If you report a post or contact us |
| Your age confirmation, stored in your browser | When you pass the 18+ notice |
Uploads may contain sensitive information, such as images of your body or information about your sex life, health or beliefs. You choose to make that public by posting it. Please don’t upload images of other people without their consent.
2. Why we use it, and our legal bases
- To run the Site: show posts, run rooms, timers, cooldowns, likes and rankings, keep you logged in, and run your subdomain. Legal basis: performing our contract with you (the Terms).
- To keep the Site safe and lawful: prevent spam and abuse, enforce the Terms and Content Rules, investigate reports, block known abusive files, ban repeat offenders, and defend legal claims. This is why we keep originals, their metadata and IP addresses. Legal basis: our legitimate interests in protecting the Site, its users and the people shown in uploads, and defending ourselves.
- To meet legal duties: report child sexual exploitation, handle copyright notices, answer valid legal orders and preserve data when lawfully asked. Legal basis: legal obligation, and our legitimate interests where a duty arises under another country’s law.
- To recover your account by email, if you gave one. Legal basis: contract, and your consent, which you can withdraw by removing the email.
We don’t use your data for advertising, don’t sell or rent it, and don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Who we share it with
- Everyone: public copies of posts, captions, handles, usernames, subdomains, likes, view counts and rankings.
- Service providers who host or help run the Site for us under contract, such as our server and storage providers and, if enabled, Cloudflare for bot checks.
- NCMEC and law enforcement, when we find or are told about apparent child sexual exploitation, including the original file, its metadata and the uploader’s IP address and account details.
- Authorities and courts, when we receive a valid legal order or must disclose by law, or when we believe in good faith that disclosure is needed to prevent death or serious harm. See our Law Enforcement Guidelines.
- The other side of a copyright dispute: when you send a counter-notice, we forward it, including your contact details, to the person who sent the original notice, as the DMCA requires. Copyright notices may be shared with the uploader.
- A buyer or successor, if the Site is sold or reorganized, under this policy.
4. Where it’s stored
Our servers may be located outside your country, including in the Republic of Moldova or another country we choose. Those countries may not have data protection laws equivalent to yours. Where the law requires it (for example for data from the EU, EEA, UK or Switzerland), we transfer data under appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Ask us for details.
5. How long we keep it
| Data | Kept |
|---|---|
| Public copies | Until the room’s timer or settings remove them, or until they are deleted or taken down |
| Original files with metadata, uploader IP and user agent | Indefinitely, including after the public copy is gone, because they are needed to answer abuse reports and legal requests that can arrive long after a post is gone |
| Material tied to a report of child exploitation, a legal request or an open copyright dispute | For as long as the law or the matter requires, even if it would otherwise be deleted |
| Fingerprints (hashes) of removed files, banned identities and banned IP addresses | Indefinitely, to stop the same material and people coming back |
| Accounts | Until you ask us to delete it, then up to 30 days, except what we must keep as above |
| Copyright notices and counter-notices, moderation logs | At least 3 years |
| Rate-limit and bot-check records | Minutes to days |
6. Cookies and browser storage
We only use what the Site needs to work. There are no advertising, analytics or cross-site tracking cookies.
| Name | What it does | Lasts |
|---|---|---|
vid | Your anonymous identity, so cooldowns, likes, rankings and your own posts work, shared across our subdomains | 400 days |
sid | Keeps you logged in, if you have an account | 60 days |
age-ok | Remembers that you confirmed you are 18 or older (also kept in local storage) | 1 year |
| Cloudflare Turnstile | If enabled, Cloudflare may set its own cookies or read device signals during the bot check before your first upload | Set by Cloudflare |
These are strictly necessary, so we don’t ask for consent to them. If you block them, you won’t be able to post, like or log in.
7. Security
We use encryption in transit, keep originals in private storage that only administrators can access, log every time an administrator opens an original, and hash passwords. No system is perfectly secure. If a breach affects you, we will notify you and authorities where the law requires.
8. Your rights
Depending on where you live (for example under the EU or UK GDPR, Moldova’s personal data protection law, or U.S. state privacy laws), you may have the right to access, correct, delete, restrict or object to our use of your data, to receive a copy of it, and to withdraw consent. To use them, write to us through the contact form and choose “Privacy or data request”.
- Anonymous users: we can only act on data we can link to you. Include the links to your posts and send the request from the browser you posted from if you can. We may ask for more information to confirm the data is yours, and won’t give one person’s data to another.
- We may refuse or limit a request where the law allows, for example where we must keep data for a legal obligation, a report of child exploitation, a legal claim, or to protect the rights of others.
- We will answer within the time the law requires, usually one month. We won’t treat you differently for using your rights.
- You can complain to your local data protection authority.
9. Not for anyone under 18
The Site is only for adults. We don’t knowingly collect data from anyone under 18. If you believe a minor is using the Site or appears in a post, use the report button on it.
10. Changes
We may update this policy. We’ll post the new version here with a new effective date and, for material changes, give notice on the Site.
11. Contact
The operators of is-totally.exposed. Privacy questions and requests: the contact form.