Privacy Policy

1. Who we are

XXXscroll operates XXXscroll at https://xxxscroll.com, including its Hentai Reels section at https://xxxscroll.com/hentai (together, the "Site"), and is the controller of the personal data described in this policy. One account system is used across the whole Site. Activity, purchases and content are recorded separately for the main site and for Hentai Reels.

Privacy questions and requests: [email protected].

This policy is designed to meet the requirements of major privacy laws worldwide, including:

• the EU and UK General Data Protection Regulation (GDPR);
• the California Consumer Privacy Act as amended (CCPA/CPRA) and other US state privacy laws;
• Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and similar laws.

Where a local law gives you more protection, that law applies.

2. The data we collect

a. Data you give us

• Account data: username, email address and password, which is stored only as a secure hash. Also your email verification and password-reset codes, display name, bio, avatar and banner, and site preferences.
• Creator verification data: if you apply to become a verified creator, we collect:
• your full legal name, date of birth and country;
• the type of ID document, with images of its front (and back, where applicable);
• a selfie holding the document;
• links to your other public profiles;
• your payout wallet: the public addresses of the crypto wallet you connect, the name of the wallet app, and the messages and signatures that prove you control each address;
• the IP address the application was sent from.
• Why we collect verification data: to confirm your identity and that you are an adult, and to keep the records the law requires. We keep your payout wallet addresses so that your earnings are paid only to a wallet you control. When your verification is approved, they are locked to your account and kept for as long as you can receive payouts, and afterwards as part of our transaction records. Connecting a wallet never gives us access to your funds, recovery phrase or private keys.
• Content: videos, images, captions, tags, comments, ratings and reports you submit.
• Payment data: the cryptocurrency, network, transaction hash, sending and receiving wallet addresses, amounts and timestamps of your deposits and Premium payments. We do not collect card or bank details. We also record your wallet balance, unlocks, subscriptions and, for creators, earnings.
• Communications: messages you send to support, legal, copyright or abuse addresses, and any attachments.

b. Data collected automatically

• Device and connection data: IP address, approximate country derived from it, browser and device type, user agent, language, referring page and timestamps.
• Security data:
• registration IP and login history (IP, user agent, country, time);
• session identifiers and a device/browser fingerprint used to secure sessions;
• proof-of-work challenge results;
• bot-detection signals, including reverse-DNS checks of crawlers;
• rate-limit counters.
• Usage data: pages and posts viewed, scrolling and playback interactions, categories chosen, likes, saves, follows, searches, and ad impressions and clicks.
• Cookies and local storage: see the Cookies Policy. Some preferences (for example whether you have seen the welcome screen or a hint) are stored in your browser's local storage in encrypted form.

c. Data from others

• Reports about you or your content from other users or rights holders.
• Results from our own content-moderation and hash-matching systems.
• Public blockchain data about the transactions you send us.
• Referral attribution if you sign up through an invitation link.

We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it, except data we must preserve to report suspected abuse.

3. Why we use your data and our legal bases

Each purpose is listed with its legal basis under the GDPR and UK GDPR.

• Creating and running your account, giving you the features you ask for, processing unlocks, subscriptions, Premium and wallet deposits, paying creator earnings. Legal basis: Performance of our contract with you.
• Verifying creators' identity and age, keeping records of the adults shown in content, and meeting legal reporting obligations. Legal basis: Legal obligation; legitimate interests in preventing exploitation.
• Moderating content: scanning uploads, hash-matching, filtering banned words, reviewing reports, quarantining and preserving illegal material. Legal basis: Legal obligation; legitimate interests in a safe platform; vital interests of victims.
• Securing the Site: session and device checks, fraud and bot prevention, rate limiting, ban enforcement, IP blocking. Legal basis: Legitimate interests in security and preventing abuse.
• Personalising your feed (categories, recommendations) and remembering preferences. Legal basis: Contract; legitimate interests.
• Analytics and improving the Site. Legal basis: Consent where required (for example for non-essential cookies); otherwise legitimate interests.
• Showing advertising and measuring it. Legal basis: Consent where required; otherwise legitimate interests.
• Sending service emails (verification codes, password reset, security and policy notices). Legal basis: Contract; legal obligation.
• Handling disputes, enforcing our Terms, and responding to lawful requests. Legal basis: Legal obligation; legitimate interests.

Sensitive data

The nature of the Site means your use of it may reveal information about your sex life or sexual orientation. Verification selfies and ID images may be treated as biometric or sensitive data in some places.

We process such data only where needed to provide the Site and meet our obligations, and only:

• on the basis of your explicit consent, which you give when you register or submit a verification application; or
• where the law otherwise allows.

You can withdraw consent at any time by closing your account. Records we must keep by law will remain.

Automated decisions

We do not use your data for decisions that produce legal or similarly significant effects on you based solely on automated processing. Automated moderation can flag or temporarily restrict content, and you can ask for human review under the Complaints & Appeals Policy.

4. Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising in exchange for money. We share data only with:

• Nobody else for running the Site. We run the systems that process your data ourselves. This includes account and login, media storage and delivery, content moderation and hash matching, payment verification, advertising, security and email. We do not hand your personal data to outside companies to process for us. If that ever changes, we will update this policy first. Any provider we use will be bound by a contract that only lets it use your data on our instructions and requires it to protect your data.
• Other users, to the extent you make content public: your username, display name, avatar, bio, public posts, comments and ratings. Creators can see which of their subscribers and buyers interact with them.
• Public blockchains. Cryptocurrency transactions are public by nature. We cannot change or delete data recorded on a blockchain.
• Authorities and safety organisations. We share data with law enforcement, regulators, courts and child-safety organisations such as NCMEC when the law requires it, to respond to valid legal process, or in good faith to protect someone from serious harm. We report suspected child sexual abuse material.
• Rights holders, to the extent required to process copyright notices. For example, we forward counter-notices to the complainant, as described in the Copyright & DMCA Policy.
• Successors, if all or part of our business is reorganised, merged or sold, under appropriate confidentiality.

5. International transfers

The servers we use to run the Site may be located in a country other than yours, so your data may be processed there. Where we transfer personal data out of the EEA, UK or Switzerland to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK equivalent, plus additional measures where needed.

6. How long we keep data

We keep personal data only as long as necessary for the purposes above:

• Account data: for as long as your account is open. After closure, we delete or anonymise it within a reasonable period, except as set out below.
• Security logs: login history, IP and session data are kept for a limited period, typically up to 12 months, unless needed for an investigation.
• Payment and transaction records: for as long as tax, accounting and anti-fraud laws require, typically up to 7 years.
• Creator verification and age/consent records: for as long as the creator's content is available and at least 7 years afterwards, or longer if the law requires.
• Content: until it is deleted. Removed content may be kept for a short time to handle appeals.
• Illegal content and related data: preserved under legal hold for the period required by law, or until the authorities confirm it is no longer needed.
• Moderation and enforcement records: kept to prevent ban evasion and repeat abuse for as long as reasonably necessary.

7. How we protect data

We use technical and organisational measures appropriate to the risk. These include:

• encryption in transit;
• hashed passwords;
• access controls and least-privilege access for staff;
• signed, time-limited media links;
• separate, restricted storage for verification documents.

No system is completely secure. If a personal-data breach is likely to put your rights at risk, we will notify you and the authorities as required by law.

8. Your rights

Depending on where you live, you may have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to processing, including processing based on legitimate interests and direct marketing;
• data portability;
• withdraw consent at any time, without affecting earlier processing;
• under US state laws, know, delete, correct, and opt out of sale, sharing and targeted advertising. We do not sell or share data as defined by those laws. We also honour Global Privacy Control signals where required;
• not be discriminated against for exercising your rights;
• complain to a data-protection authority in the country where you live or work, or where an alleged infringement took place.

How to exercise your rights

1. Email [email protected] from your account email.
2. We may need to verify your identity before acting.
3. We will respond within the time the law requires, normally one month, which can be extended where the law allows.

Some data cannot be deleted while we must keep it by law, for example:

• verification records;
• transaction records;
• preserved illegal content.

9. Children

The Site is strictly for adults (18+). It is not directed at children and must not be used by them. If you believe a minor has used the Site or appears in content, report it immediately using the report option on the content or by email to [email protected].

10. Changes to this policy

We may update this policy from time to time. We will post the new version with an updated date and, for material changes, give notice on the Site or by email.

11. Contact

For privacy requests and any other questions, email [email protected] with the subject "Privacy request".