Privacy Policy

1. Controller

The current controller is the fades.site development team while the final legal operator, address, registration, and tax status are confirmed. That identity is still a launch blocker, so this notice does not claim a final registered legal entity or a completed regulatory filing. Contact: info@fades.site. Erasure and abuse reports: abort@fades.site. Include the collage URL or 10-character key if you have one.

Suggestions and news: Telegram: suggestions & news. Messaging via Telegram is subject to Telegram's own privacy policy and fades.site only sees what you send there. Erasure and abuse reports still go to abort@fades.site.

2. What we process and why

We process only what the service needs to generate, gate, and then delete a collage.

• Photographs and optional details (first name, last name, age, location, socials) you submit. An iPhone HEIC or HEIF photo is turned into a JPEG in your browser before upload. The optional blur brush bakes the areas you paint into the photo; the unblurred original is not uploaded, and the brush does not detect faces. Purpose: generate a randomized collage. Once that image is generated, the source photographs and those detail fields are deleted. Only the composed collage image is kept until the collage expires or is removed. When object storage is configured, that finished image is stored under a random key in Neon object storage or, when the app runs on Cloudflare Workers, in a private Cloudflare R2 bucket in the EU jurisdiction (Cloudflare, Inc., US, is the processor), and a viewer who is allowed to open the collage receives a short-lived link instead of the image bytes. A public-pool image may stay in the host CDN and browsers for at most about 10 minutes. Private and priced images are not put in the shared CDN cache, but the viewer's own browser may keep its copy until the link expires (at most about 10 minutes). If that storage is not configured, the finished image stays in the database until the collage is deleted. Legal basis: performance of a contract (Art. 6(1)(b)), or your request to take steps before a contract if you have not paid.
• Collage metadata (public hash, private key, payment status, discoverability, expiry, view count). When a private copy is created, the database column session_token stores that same private key again. It is not a browser cookie, not a login, and not a way to recognise you on a later visit. Purpose: access control, public-pool rules, automatic deletion. Basis: Art. 6(1)(b).
• Hashed network identifier (SHA-256 of the request IP). Purpose: coarse rate limits and abuse signals only. It is not the key that deletes, upgrades, or shows creator tallies. Those actions use the browser owner session described below. Non-VIP rate-limit rows are kept for 1 hour. The 18+ confirmation hash is kept for 1 hour. A shared or carrier-grade NAT address can collide with someone else; the hash is not proof of who you are. Basis: legitimate interests (Art. 6(1)(f)) in keeping the service usable. A VIP pass bought now is attached to the browser owner session, not this hash (Art. 6(1)(b)). A pass bought earlier may stay on this hash until a session from this network links it once; after that link the hash no longer carries VIP. We do not store the raw IP. A new IP is a new hash.
• Upload network check. At upload the connection address is checked in memory against a public list of VPN, proxy and data-center ranges. It is not stored or logged. Only the hashed connection is stored, as before.
• 18+ entry confirmation (the same SHA-256 network hash, the time you confirmed, and a 1-hour expiry). Purpose: skip the adults-only page on later visits from this connection until the 1-hour row expires. This is a self-declaration. It is not an identity check and it does not prove age. Basis: legitimate interests (Art. 6(1)(f)) in keeping the service limited to adults, and your request to enter. The raw IP is not stored. This browser also gets a first-party httpOnly cookie (fades_age) holding only the expiry and a signature tied to that hash, so the check does not need the database until it expires (1 hour). The page is shown again when no unexpired row exists. You can ask for the row to be deleted at abort@fades.site; the daily purge also deletes expired rows.
• Collage of the Day votes (the hashed IP, the collage hash, the UTC day, and the owner-session hash). Purpose: let visitors cast one vote per collage per hashed IP per UTC day, up to 3 votes (10 with VIP). The daily cap and the one-vote-per-collage rule count on the hashed IP, so a new browser session does not reset them. A vote is not a view and does not change the view counter. Basis: legitimate interests (Art. 6(1)(f)) in a daily featured collage, and the uploader's choice to enter. The raw IP is not stored. The daily purge counts the finished UTC day's votes once, keeps the winning collage hash for the next UTC day, and deletes the vote rows. Opting out stops new votes and takes the collage off the homepage. Deleting the collage, or Purge all my media, deletes its votes. You can ask for your vote rows to be deleted at abort@fades.site.
• Collage of the Day win notice (this browser only). fades.cotdWinChecked is session storage for this tab session and records one check per visit. fades.cotdWinSeen is local storage and holds the collage key already announced, until this site's browser data is cleared. Neither key stores an IP address or other personal data.
• Open-session count (a random token kept in this browser's local storage and shared by its tabs, plus a SHA-256 hash of that token and the time of the last check-in). A new random token replaces it after 30 minutes without a check-in. Purpose: show how many visitors used the site in about the last 30 minutes, how many visits started in about the last 24 hours (extra tabs, reloads, and page changes during a visit are not counted again), how many collages were released into the public pool in about the last 24 hours, how many unique public-pool views were recorded in about the last 24 hours, and how many unique public-pool downloads were recorded in about the last 24 hours. The 24-hour figures are hourly totals only. They do not include private, priced, or unreleased collages. A public view and a public download are each counted once for each visitor on each collage. Repeat opens and repeat downloads, and private, priced, admin, and creator opens, are left out. The raw token, the IP address, the collage id, and any payment or account identifier are not stored with them. The hash can single out one browser during a visit and for about 30 minutes after it. Basis: legitimate interests (Art. 6(1)(f)) in an accurate occupancy figure. It is not used for advertising and it does not recognise you on a later visit.
• Payment references (wallet address used for the invoice, amount in sats, confirmation state). Purpose: verify a Bitcoin payment and unlock a private collage, a visitor-paid creator collage, or a VIP pass. A visitor-paid creator collage is paid in two parts (the creator's share straight to the creator's wallet, the platform fee to this site) and also stores the creator wallet, the USD price, both exact amounts, both transaction ids, and when each part arrived. The creator's wallet address is shown to the visitor on the pay page so the visitor can pay it. An operator admin open does not create that row. An operator admin can view those stored creator wallets and recorded cuts, grouped by wallet. That list is not public. Basis: Art. 6(1)(b) for the payment, and legitimate interests (Art. 6(1)(f)) for the admin reconciliation of the recorded share. On-chain data is public on the Bitcoin network; we do not control that layer. This site never holds, sends or forwards the creator share. This site does not yet provide a full, identity-linked merchant receipt; it keeps the payment record, internal purchase confirmation, and minimal consent record only as needed to match the purchase to the collage or invoice. A sales ledger keeps the USD amounts for each settled sale (gross, the platform fee, VAT on that fee, and the net). It stores no IP address and no session. Confirmed visitor payments and cuts are kept for 1 year from confirmation, then deleted by the daily purge. The internal purchase confirmation and the consent record are each kept for 1 year from confirmation or from the consent timestamp, then deleted by the same daily purge. A record where only one of the two parts arrived is kept for 1 year. Unpaid quotes are deleted after 24 hours. Deleting the collage does not delete those rows early. A copy of the transaction can remain on the Bitcoin network and in processor backups.
• Payout wallet (optional Bitcoin address you save in the session panel). Purpose: receive visitor payments for your priced creator collages directly (the address is shown to those visitors on the pay page), and let the operator pay referral rewards or tag-creator shares by hand; the site never sends Bitcoin automatically. It is stored with your browser session while that session exists, shown to you masked, and visible in full only to an operator admin in the payout list. It is deleted when you clear it, when you purge the session, or on request. Basis: Art. 6(1)(b).
• Referrals (optional). Your session can get a random referral code. A new browser that opens a referral link stores which code brought it, linked to its session hash, and gets a first-party httpOnly ref cookie (fades_ref, the 8-character code only) for 30 days; the cookie is deleted when that browser makes its first collage, which is the counted action. A referral counts only if that browser's hashed network differs from the referrer's, so the referrer's hashed network (an HMAC hash, never the raw IP) is stored with the referrer's code and deleted with it when the session is purged. The reward for a counted referral is a small VIP-day or extra-views credit, not money. Only a settled paid purchase (VIP, private collage, or tribute) counts; visits never do. A conversion record (both session hashes, product, USD amount, reward, and the referrer payout wallet when a cash reward is owed) is kept for 1 year, then deleted by the daily purge, so manual payouts can be reconciled. Purging the session deletes its code and link records. A tag-creator share record (tribute id, tag id, the creating session hash, USD amount, share, and payout wallet) is kept the same way for 1 year. Basis: Art. 6(1)(b). See Referrals.
• Invoice pricing context: before payment, the site displays the configured USD price and tells you that the exact Bitcoin amount comes from the mempool.space spot rate when the invoice opens plus a unique satoshi tail. The invoice-opening timestamp is shown with the active payment window and stored with the pending invoice. No tax is calculated in the interface.
• Operator review. A signed-in site operator can open a specific collage to decide whether it is illegal or against these rules, then delete it, ban the hashed IP, or leave it. That includes a pending or paid private copy when the key or a report points at it. The operator can also mark a private collage paid without a chain check. Basis: legitimate interests (Art. 6(1)(f)) in moderating the service and, where a notice requires action, a legal obligation (Art. 6(1)(c)). The operator does not keep a second copy of the photographs.
• Minimal consent records (policy version, product/path, timestamp, and a reference to the collage hash or VIP invoice). Purpose: keep a privacy-preserving record of the user’s acknowledgement before a paid private collage, public release, or VIP purchase begins. Basis: the request to proceed with the chosen digital service and the need to demonstrate the consent signal in a dispute. The record does not store a name, email, password, photo, wallet address, or a full merchant receipt. The current implementation stores only the hash/invoice reference plus the hashed visitor IP. It is kept for 1 year, or until this browser session uses Purge all my media, whichever comes first.
• Tribute invoices (browser-session hash, Bitcoin address, amount, optional display name of up to 32 characters, transaction id when paid, and timestamps). Purpose: open and confirm a Bitcoin tribute to a tag and show recent donations. Basis: the tribute you asked for (Art. 6(1)(b)). The display name is optional and is shown on the tribute dashboard. No photograph is stored with it.
• Promo-link clicks (collage key and hashed connection). Purpose: count one click per connection on a creator promo link. Basis: legitimate interests (Art. 6(1)(f)) in showing that count to the creator. The raw IP is not stored.
• Included VIP premium collages (browser owner-session hash when the pass is on a session, otherwise the hashed connection, collage key, and the UTC day). Purpose: count how many included private collages this session has used today. Basis: the VIP pass you bought (Art. 6(1)(b)). The raw IP is not stored. The allowance reads only the current UTC day.
• Operational reliability events (an allowlisted event name, count, and timestamp). Purpose: diagnose invoice expiry, pending or confirmed payments, duplicate claims, and automatic purges. These rows do not contain a collage or invoice identifier, IP address or hash, wallet address, transaction id, report narrative, image, or private key. An exact timestamp can still be linked to another record during an incident, so we treat the events as potentially personal data when combined with other information. Basis: legitimate interests (Art. 6(1)(f)) in service reliability, fraud prevention, and payment troubleshooting.
• Abuse reports and review records (the reported collage key, report category, optional narrative, hashed reporter network identifier, timestamp, review or escalation status, review timestamp, and reviewer role). A narrative can contain sensitive information; hashes and timestamps can still relate to a person when combined with other records. Purpose: receive, assess, and escalate abuse reports. Basis: legitimate interests (Art. 6(1)(f)) in protecting people and operating the service, and where applicable a legal obligation (Art. 6(1)(c)). Do not include unnecessary personal information in a report.
• Creator-key application emails sent to info@fades.site. The message may include the sending address, a public creator name, public https links, a choice of public promo, priced opens, or both, a short text description, and the statements on the become-a-creator page. It is ordinary email. It is not written into the collage database. Purpose: decide whether to send a creator key. Basis: steps you asked for before a contract (Art. 6(1)(b)). Do not send a legal name, government ID, photograph, phone number, home address, date of birth, tax number, Bitcoin address, or seed phrase. The site does not delete that mailbox on a schedule. To ask for the email to be deleted, write to abort@fades.site and name the address you wrote from. A collage key does not locate that email.
• Admin audit events (the administrator's hashed connection, the action name, an optional collage key, short metadata such as a report id or a VIP pass id, and the time). Purpose: record a privileged action such as a deletion, a ban, a payment check, or a legal hold. Basis: legitimate interests (Art. 6(1)(f)) in accountability, and a legal obligation (Art. 6(1)(c)) where a notice requires a record. The dashboard shows the latest 100 events and does not show the stored hash. The raw IP is not stored.
• Banned connections (the hashed connection and, when known, the hashed session of the banned creator, and the time the ban was stored). Purpose: refuse later use from those hashes. Basis: legitimate interests (Art. 6(1)(f)) in stopping abuse. The raw IP is not stored. A shared network can collide, so the hash is not proof of one person.
• Country and region of your connection — provided by our host (Vercel) in a request header, used only on that request to decide whether the service is available where you are (some jurisdictions require verified age checks this service does not offer; those visitors see a "not available in your region" page). Not stored, not logged by us, not used for advertising or analytics. Legal basis: legitimate interest in complying with foreign age-verification laws (Art. 6(1)(f) GDPR).

Do not upload a photograph of anyone under 18, or a photograph that reveals someone's health. Explicit adult content is allowed only when the person shown posts it, or when the uploader has that adult's documented consent. The site does not check that consent before the collage is posted, and it does not store the consent document. A report that someone is under 18 deletes the collage immediately; its stored image is removed from photo storage (including Cloudflare R2) immediately. If a deletion fails, it is retried by the daily cleanup. If your photos were posted without your consent, use Report Misuse / Request Deletion on the collage and choose Request of removal, or email abort@fades.site. That report path is unchanged. We delete that collage when the request is verified, and otherwise when it expires. We do not treat faces as a recognition system. Looking at one reported collage is not a system for recognising faces.

Purchase confirmation: after chain confirmation, the service keeps an internal record of the product, configured USD price, exact satoshi amount, destination address, transaction id, confirmation time, and VIP expiry where applicable, for 1 year, then the daily purge deletes it. It is not linked to a name or email and is not currently delivered as a merchant receipt. The Bitcoin transaction can remain on the public chain.

Random selection of frames and details is not a decision with legal or similarly significant effects under Article 22.

3. People who did not upload (Article 14)

A collage can contain personal data of people who never used fades.site: faces, names, ages, locations, or social handles that another person uploaded. That data was not obtained from those people. Article 14 would normally require us to tell each of them who we are, why we hold the data, where it came from, who can see it, and how to object.

We do not send individual Article 14 messages. We usually cannot identify or contact the people in a frame. The uploader is anonymous. A collage image is usually kept for hours, or up to 24 hours for a priced creator collage. Some records in section 5 last longer. Building a contact list in order to notify them would mean keeping more data, for longer. Individual notice is therefore impossible or would involve disproportionate effort under Article 14(5)(b).

The appropriate measure in place of individual notice is this public policy, the Legal Notice, and deletion on request. If you recognise yourself or someone you represent in a collage, write to abort@fades.site with the URL or key. We will delete the collage. We do not need a copy of the photos.

Source of the data: another user of the site. Categories: the same photographs and optional details listed in section 2, to the extent they identify you. Recipients: the processors in section 4 and, if the uploader chose Release into Random Pool, any visitor who draws that collage from the public random pool. First disclosure to the public is that choice. A timer does not publish an unpaid collage. Paid collages are shown only to people who have the unique key. Storage periods are those in section 5.

The uploader's contract with us is not a legal basis for processing your data. Explicit adult content is allowed only when the person shown posts it, or when the uploader has that adult's documented consent. Uploaders are forbidden to submit anyone under 18, non-consensual intimate imagery, doxxing, or harassment. The site does not check that consent before the collage is posted. If such material reaches the service anyway, we do not rely on legitimate interests to keep it. We delete it when a verified request says it is there, and otherwise when the collage expires. If your photos were posted without your consent, use Report Misuse / Request Deletion on the collage and choose Request of removal, or email abort@fades.site. That report path is unchanged.

4. Who else sees the data

• Supabase (PostgreSQL, hosted in Frankfurt, EU, eu-central-1) hosts application records, including the short-lived open-session hash and the hourly session, public-collage, public-view, and public-download totals. Visitors see those integers. They do not see the hash. The admin dashboard does not list those rows. When object storage is configured, Neon object storage (or, on Cloudflare Workers, a private Cloudflare R2 bucket in the EU jurisdiction run by Cloudflare, Inc., US) holds the finished collage image. The database row then holds a random object key, not the image bytes.
• Vercel hosts the app; Cloudflare, Inc. (US) may also host it on Cloudflare Workers. There, Cloudflare Hyperdrive (the database connection service) carries the Worker's database queries and results to Supabase; its query cache is turned off. The image is removed from R2 immediately when the collage is deleted or removed. If a deletion fails, it is retried by the daily cleanup. An expired collage's image is deleted by the daily cleanup (00:00 UTC), or by the next daily run if that delete fails; that job also deletes R2 files under the collage prefixes that no longer have a collage row once they are more than an hour old, and R2 discards unfinished uploads after 1 day. A public-pool image may stay in its CDN and in browsers for at most about 10 minutes. Private and priced images are not put in that shared CDN cache, but the viewer's own browser may keep its copy until the link expires (at most about 10 minutes). Older media may still use Vercel Blob when that storage is configured. Those files are deleted with the collage. A daily job also deletes stored files under the collage prefixes that no longer have a collage row, once the file is more than an hour old.
• Third-party ad networks (ExoClick, BongaCams, and CrakRevenue) serve the ads shown on the site unless this network has an active VIP pass. Their scripts load in your browser and receive what any web request carries, such as your IP address and browser details, under their own privacy policies. They may set their own cookies. CrakRevenue banner images are served from fades.site itself, so showing a banner sends nothing to CrakRevenue; a click goes through a fades.site /go/ link that fades.site itself does not log (the host's request log may record the request), which forwards to a CrakRevenue tracking link that may set CrakRevenue or advertiser cookies and record the click for affiliate commission. A popunder may open a CrakRevenue page in a new window, and that page may set its own cookies; fades.site sends only a generic label such as fades-banner or fades-pop, not a user, collage, or session identifier. CrakRevenue's privacy policy is at www.crakrevenue.com/privacy. The kink guide pages under /kinks load no advertising or affiliate scripts and set no cookies; the host's request log may record the page address and IP address.
• mempool.space is queried for Bitcoin price and payment confirmation. We send invoice amounts and addresses, not your photos.
• Telegram, if you use the suggestions channel. Messaging via Telegram is subject to Telegram's own privacy policy and fades.site only sees what you send there. The site does not copy those messages into its database, and it does not send Telegram your photos or keys. When someone files a report, the site sends the operator's private Telegram group an alert with the report reason, a shortened excerpt of the report text (e-mail addresses, wallet addresses and IP addresses removed), the collage id and a link to the admin dashboard. It does not send the reporter's IP hash, photos, or keys. When a payment invoice is opened, that same group receives the invoice type, the plan name if there is one, and the USD amount. When that invoice is confirmed, it receives the type, the USD amount, and a link to the admin dashboard. Those payment alerts do not include a wallet address, transaction id, IP address, session or owner identifier, collage id, or any buyer identifier. If you link the companion bot with /link and your recovery code, its reply has a button that opens your session on another device; the code is in the part of the link after #, which browsers do not send to the server, and the /restore page removes it from the address bar. The bot stores only the hashed session id and the chat id.
• Visitors who hit the public random pool can see an unpaid collage that was released to that pool, including whatever frames and details the generator kept.
• Anyone with the unique key of a paid collage can see it until the 24-hour private window ends. The view counter does not apply to paid collages. A pending private copy, including its session_token, is not shown to ordinary visitors before payment confirms.
• A signed-in operator can open a named collage to check a report or other concrete reason to think it is illegal or harmful. That can include a pending or paid private copy. The operator can then delete it or, for an unpaid private copy, mark it paid. Marking it paid removes the linked public listing. It is not evidence that Bitcoin was received, and it is not a licence to browse the pool. No extra copy of the frames is stored for that check.
• An administrator can see 24-hour aggregate counts of operational reliability events. Raw event rows are not available through the dashboard and may be accessed only for necessary incident response. Testers and moderators cannot read them.
• A moderator with a valid moderator session can read the report queue and mark a report reviewed or escalated. Moderators cannot open collage media from this queue, delete content, ban creators, verify payments, complete VIP actions, read audit events, or administer roles. Report data must not be exported, copied, or used for a purpose other than handling the report.

Processors may store data in the EU or outside it, and US processors (such as Vercel and Cloudflare, Inc.) may access it from the United States, depending on region settings we do not fully control. Where a transfer outside the EEA occurs, it is incidental to using those hosted services. We do not offer a separate transfer addendum.

5. How long we keep it

• Paid private collages: until 24 hours after confirmation. The view counter does not burn a paid collage. Then the row, its files, and session_token are deleted.
• Pending private copies: created when you start payment on a collage that is already in the public pool. A collage posted with a creator key does not offer that payment or extra views. They hold the same frames plus session_token set to the private key. They are not shown to anyone until payment confirms. If you never pay, they are deleted 24 hours after the pay click, when that expired copy is opened, by the daily purge, or earlier if all 100 open payment slots are taken. In that last case the oldest unpaid private copy and its payment row are deleted so a new payment can start. The public pool listing, if there is one, is not removed by that rule. A deleted private copy cannot be restored. Confirmation resets the clock to 24 hours from that moment.
• Unpaid public-pool collages: until 24 hours after release, or until the creator's view limit is hit, whichever comes first. The view that reaches the limit deletes the collage in that request. Opening a collage after its expiry deletes it then. A payment lock still blocks that delete. Exception: a tagged public collage selected for a tribute milestone is kept until the end of the next UTC day after selection, without its view limit and without owner purge; after that, normal view limits apply again unless it is selected again. The limit is the range shown at creation. The configured standard range is 10 to 25 unique views. VIP uses 20 to 60. A creator key uses 1 to 100. A download is counted once per hashed connection. The creator tally (views and downloads) is shown on creator lock pages and kept until the collage is deleted. A creator-key collage may include one allowlisted https promo link and a creator tag. A promo link with no price is posted to the public pool after the creator confirms the details. A promo link with a private price requires a Bitcoin wallet; the creator confirms the link, price, and wallet and is not charged. The price is 5 to 99.99 USD, and the platform keeps 20%. That collage is not in the public pool. Each opener except an operator admin pays once. The collage ends at that paid-open limit or 24 hours after publishing. Each pool-view grant adds 10 views. Opening the promo link is counted once per hashed connection and the count is shown on the creator lock page. Each opener pays the creator's share straight to the creator's wallet and the platform fee to this site, as two Bitcoin payments. The site stores the payout address and never sends the share. The same ranges are shown before you continue. Collage of the Day is separate. The opt-in is on the photos step and starts unticked. While it is ticked, the page-views limit is not used. An entered collage is kept until 00:00 UTC at the end of its voting day, whatever its page views. You can still delete it or leave; leaving restores the normal 24-hour limit and the view limit. The winner is kept, and you cannot delete it or leave, until 00:00 UTC after its feature day. It is a homepage link, with no photo, for that day, and is then deleted. Vote rows are deleted after that daily pick.
• Abandoned drafts and expired sessions: bulk-deleted by a daily job at midnight UTC. Leaving a page does not publish a draft. The timer permanently deletes it.
• Payment grace lock: the first time a matching Bitcoin payment is seen in the mempool or on the payment webhook, purge is paused for 20 minutes, even if the collage timer has already ended. The lock ends when that window ends or the payment is claimed. Free purge skips a locked collage until then.
• Free erasure: Purge all my media deletes this session's collages, consent events, creator tallies, pending unpaid invoices for the deleted collages, and session-tagged rate events. It does not delete abuse reports, admin audit events, banned connection hashes, confirmed VIP records, operational events, database backups, or the Bitcoin transaction itself.
• Rate-limit events: the hashed IP is kept for 1 hour for a non-VIP session, or for the VIP upload window (1 hour) when that window is longer, then the daily purge deletes the row. Uploads are limited to 4 collages per hour. Random opens wait 1 minute. VIP uploads are 15 collages per hour, and VIP random opens wait 5 seconds. Free purge deletes rate-limit rows that were tagged with this browser session. It does not delete rows that only have a hashed IP, because that hash can belong to more than one person.
• Operational reliability events: up to 30 days. The admin dashboard shows aggregate counts for the latest 24 hours, and the daily purge deletes older raw event rows. If a legal obligation requires separate preservation, that copy must be documented, access-controlled, and removed when the hold ends.
• Open-session rows: deleted 30 minutes after the last check-in from this browser. The next presence request runs that delete, and the daily purge runs it again. Closing a tab does not send a separate request. There is no legal hold. An email cannot name the row, because it has no name, IP, or contact.
• 24-hour activity totals: an hour, a kind (session, public collage, public view, or public download), and an integer. Deleted when the hour started more than 24 hours ago. The next presence request runs that delete, and the daily purge runs it again for every kind. There is no legal hold and no collage id on the row. A public collage, a unique public view, or a unique public download that is later deleted still counts until that hour ages out. Private, priced, and unreleased collages are not added. Repeat opens and repeat downloads are not added.
• In-app abuse reports and their review or escalation records: 90 days from report creation, then the daily purge permanently deletes them. An administrator can apply a legal hold that pauses deletion; only the hold state and timestamp are stored, and the administrator must release the hold when preservation is no longer required. The moderator queue displays the latest 30 days, which is separate from the 90-day retention period. Backup retention remains a processor/deployment procedure rather than an application guarantee.
• VIP passes: the browser owner-session hash, the hashed IP recorded at purchase (invoice limits and passes not yet linked to a session), the package, the USD price, the satoshi amount, the transaction id, and the start and end times. Purging the session ends access immediately. Unpaid VIP invoices are deleted after the configured payment window (24 hours), or sooner if the payment-slot window is full. A confirmed pass is kept until 12 months after access ends, so a withdrawal or a payment dispute can still be checked, and is then deleted. We do not use it for advertising.
• Admin dashboard: it lists creator hashes from the last 24 hours. It does not create a new identifier.
• 18+ confirmations: 1 hour from the confirmation, then deleted by the daily purge or on the next lookup. Only the hashed connection is kept. A shared network can collide; the hash is not an identity.
• Promo-link clicks: the collage key and a hashed connection, one row per connection. The daily purge deletes that row 90 days after the click. There is no legal hold. The count shown to the creator uses the rows that are still stored. A backup copy, if the host keeps one, follows that host's own schedule.
• Tribute invoices: an unpaid or expired invoice, including its Bitcoin address and optional display name, is deleted by the daily purge 7 days after it expires. A paid tribute, including that display name, is deleted 1 year after confirmation. Purge from this browser session can remove an unpaid invoice immediately and a paid one 24 hours after confirmation. There is no legal hold. A past day's tag is marked inactive and is not deleted on that schedule. The site shows today's ranking and yesterday's ranking. The Bitcoin transaction can remain on the public chain.
• Purchase confirmations: 1 year from confirmation, then the daily purge deletes the row. There is no legal hold. Free erasure of a collage does not delete this row early. The Bitcoin transaction can remain on the public chain, and a database backup follows the host's own schedule.
• Consent records: 1 year from the consent timestamp, then the daily purge deletes the row, including the hashed connection. Purge all my media deletes this session's rows sooner. There is no legal hold.
• Included VIP premium collages: the session hash or hashed connection is deleted by the daily purge 1 year after the row is written. The day's allowance only reads the current UTC day. There is no legal hold. An email cannot name the row, because it stores no name or contact.
• Admin audit events: kept with no scheduled deletion. The application does not delete these rows and has no legal-hold flag on them. The latest-100 list is a display limit, not a retention period. Free erasure does not delete them. A request about one goes to abort@fades.site. A database backup follows the host's own schedule.
• Banned connections: kept with no scheduled deletion. The application does not delete the row and has no control that lifts the ban. The ban stays until the row is removed from the database. Free erasure does not delete it. A request about one goes to abort@fades.site.
• Telegram suggestions: fades.site does not store them, so this policy has no retention period for those messages. Messaging via Telegram is subject to Telegram's own privacy policy and fades.site only sees what you send there.
• Telegram companion: the chat id and the hashed owner token, removed on /stop or session deletion.

After deletion we cannot restore the collage. A public-pool image may stay in the host CDN and browsers for at most about 10 minutes. Private and priced images are not put in the shared CDN cache, but the viewer's own browser may keep its copy until the link expires (at most about 10 minutes). Blockchain records of a payment remain on Bitcoin independently of fades.site.

6. Cookies

fades.site itself sets no advertising or analytics cookie; the third-party ad networks in section 4 may set their own. Kink guide pages under /kinks load no ad or affiliate scripts and set no cookies. The popunder cap uses a first-party localStorage entry fades-pop-rotation that holds only two values, a timestamp and a network name, not personal data. Completing the ad step also sets two first-party httpOnly cookies, fs_gate_at (signed start of that step) and fs_open_pass (signed pass that expires after 2 hours). Both are tied to the hashed connection and hold no raw IP. CrakRevenue may set cookies when a banner or popunder page is opened. A confirmed VIP pass also stores only its access expiry in localStorage (fades-vip-until), a timestamp with no id or hash, so ads stay off until then if a later check does not answer. That entry is removed when the server says the pass is not active, or when the time has passed. Creating a collage or opening a random collage sets an httpOnly owner-session cookie. On HTTPS its name is __Host-fades_owner; otherwise fades_owner. It holds a random secret bound with a server HMAC, lasts 12 hours, and is the key for delete, creator tallies, release, and upgrade. The hashed IP is not enough for those actions. Opening a referral link as a new browser also sets the first-party httpOnly fades_ref cookie (the referral code only) for 30 days, deleted on that browser's first collage; it is not used for advertising or tracking across sites. The site records which public-pool collages it has already shown to that session (session hash and collage id) so Random collage does not repeat; those records are deleted when the collage is deleted, with Purge all my media, or by the daily purge once they are older than 30 days. A recovery code can restore the session, so a record can outlast one visit. Purge all my media, on this page, uses that cookie. It does not require a Bitcoin invoice or a stable IP address. Site operators sign in through Cloudflare Access; this sets a login cookie only on operator devices. Draft photographs stay in your browser storage until you submit or leave the flow. If you start a private payment and lose the tab, the browser also keeps a short-lived, tab-scoped pointer (this browser's session storage, not a cookie) so we can offer a "Resume private payment" link; it holds only the collage's public hash and a timestamp, expires after 24 hours or when payment confirms or is abandoned, is not sent to the server on its own, and never contains the private key. The database field session_token is not a cookie. It is a copy of the private collage key on that row, and it is deleted with the row. The open-session counter uses a separate local storage value in this browser: a random token and the time of the last check-in. It is not a cookie, so the browser does not attach it to requests. The server receives the token when a page loads, stores a hash, and deletes that hash about 30 minutes after the last check-in. After 30 minutes without a check-in the browser replaces the token with a new random one, so a later visit is not linked to an earlier one. You can remove it by clearing this site's browser storage. If you turn Auto on, this browser also stores that choice and a random tab id in local storage so only one tab advances. That id is not a cookie and is not sent to fades.site. The 24-hour totals for sessions started, public releases, unique public views, and unique public downloads are not a cookie. They are hour-and-count rows on the server.

The visitor's country (Vercel's x-vercel-ip-country header) is read per request only to choose region-specific ad banners (Redlights for Belgium/Netherlands); it is not stored or logged.

Full list

None of these hold your IP address. Clearing this site's cookies and storage removes them; Purge all my media also deletes the server data tied to the owner cookie.

7. Children

The service is intended for adults. Entry requires a self-declaration that you are 18 or older. That declaration is stored against the hashed connection for 1 hour and is not an identity or age verification. The service is not offered in jurisdictions that require verified age checks. Do not upload photographs of minors or personal data relating to children. If you believe we hold such data, write to abort@fades.site with the URL or key. We will delete it.

8. Your rights and request verification

You may request access, rectification, erasure, restriction, and objection to processing based on legitimate interests, and you may lodge a complaint with your supervisory authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données. You may also complain to the authority where you live. That includes people who did not upload the collage.

Email abort@fades.site with the public URL or 10-character key, whether you uploaded the material or are depicted in it, and the right you are exercising. An uploader can verify control with the private key or a still-valid creator session. A depicted person or representative should explain the connection to the material and provide only the minimum information needed to assess the request; do not send extra photographs or identity documents by ordinary email.

We use that information to find the relevant row without exposing another person's collage. We may ask for clarification or refuse a request that cannot be verified, while preserving a reported item only as long as necessary to assess it. A verified privacy or abuse request can lead to deletion of linked public and private copies, which cannot be undone or restored. The anonymous service may be unable to provide a copy of data or a response receipt if the requester does not supply a contact method.

Erasure of a live collage happens when we receive a URL or key at abort@fades.site. We delete that row and its files the same day if they still exist. The midnight purge only catches rows nobody reported. We cannot search by name. We do not need another photo of you. We cannot erase the Bitcoin transaction. Manifestly repetitive follow-ups after we have already confirmed deletion may be refused (Article 12(5)).

While a collage is still live, sending the key is also how you can receive a copy of what we hold (Article 20). After purge there is nothing to export.

Operational reliability events do not contain a person, collage, invoice, or network identifier, so we ordinarily cannot locate one from a requester's key or identity. If an event was correlated with other records during an incident, we assess rights requests against that combined evidence without disclosing another person's data. An open-session row is the same kind of lookup problem: wait about 30 minutes and the row is deleted. Closing a tab does not delete it sooner. We cannot find it from an email address. The 24-hour totals, including a public-view total and a public-download total, are the same: an hour and a count, with nothing to match to a person or a collage key.