Privacy Policy

Last updated: 30 March 2026

This Privacy Policy explains how Deadwood Studio (“we”, “our”, or “us”), operator of DirtyNSFW.com, processes personal data in compliance with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDPGDD). Please read this policy carefully.

1. Data Controller

• Identity: Deadwood Studio
• Country: Spain
• Contact: david@deadwood.es

We do not have a statutory obligation to appoint a Data Protection Officer (DPO) at this time. For any privacy-related query, contact us at the email above.

2. Data We Collect — Anonymous Model

DirtyNSFW.com does not require registration and does not collect your name, email, or any directly identifying information. The following data may be processed:

• Anonymous device identifier (cookie “hp_player”): A randomly generated UUID stored in your browser for up to 12 months. Used to enable anonymous features (likes, gameplay scores). Under GDPR, a pseudonymous identifier is still considered personal data. It is never shared with third parties for advertising.
• IP address: Logged temporarily by our hosting infrastructure (Google Cloud / Firebase) for security and abuse prevention. Retained for a maximum of 30 days in server logs.
• Interaction data: Anonymous engagement events (image views, likes, gameplay scores) linked to the device identifier, not to any real identity.
• Content reports: If you submit a content report via the reporting tool, we store the hashed device identifier, the reason category, and any optional text you provide. This is processed under our legal obligation to handle illegal content (GDPR Art. 6(1)(c)).
• Analytics cookies (optional): If you consent, we use Firebase Analytics / Google Analytics to collect aggregated usage statistics. No individual profiling is performed.
• Advertising cookies (optional): If you consent, advertising partners (e.g., JuicyAds, ExoClick) may set cookies to serve relevant adult advertisements. These partners operate under their own privacy policies.
• Push notification subscription (optional): If you opt in to browser push notifications, we store a Firebase Cloud Messaging (FCM) token alongside a pseudonymous device identifier, your browser language and timezone, and a user-agent string. This data is used exclusively to deliver gallery update notifications and is never shared with advertising partners. You may unsubscribe at any time via the Settings page or your browser's notification controls. Legal basis: Consent (GDPR Art. 6(1)(a)).

3. Legal Basis for Processing (GDPR Art. 6)

4. Data Retention Periods

• Device identifier cookie: 12 months (refresh on active use). You can delete it at any time by clearing your browser cookies.
• Server / infrastructure logs (IP): Maximum 30 days, then automatically deleted.
• Anonymous interaction data (likes, scores): Retained indefinitely as aggregated statistics; the device identifier association is hashed and cannot be reversed.
• Content reports: Retained for a minimum of 6 months after resolution, as required by DSA Art. 17.
• Push notification subscriptions: Retained while the subscription is active (enabled = true). Automatically purged when you unsubscribe. You can also revoke permission in your browser notification settings.
• Cookie consent record: Stored locally in your browser for a maximum of 13 months, after which you will be asked to review your preferences again.

5. Cookies and Consent Management

We use a cookie consent banner that separates strictly necessary cookies from optional analytics and advertising cookies. You may withdraw consent at any time through the cookie settings panel. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Strictly necessary cookies (including the anonymous device identifier) do not require consent as they are essential to the Site's operation under Recital 47 of the ePrivacy Directive.

6. Sharing of Data

We do not sell, rent, or trade personal data. Data may be shared only with:

• Cloud infrastructure: Google Firebase / Google Cloud (EU data processing agreement in place).
• Advertising partners (JuicyAds, ExoClick), strictly subject to your consent.
• Law enforcement and regulatory authorities when required by applicable law (including mandatory CSAM reporting).

7. International Transfers

Our infrastructure is primarily hosted within the EU (Google Cloud Europe). Where data is processed outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions to ensure an equivalent level of protection.

8. Your Rights Under GDPR (Arts. 15–22)

As an EU resident you have the following rights. Note that because the Site is anonymous and we do not hold names or email addresses, some rights can be exercised only via the device identifier cookie value:

• Right of access (Art. 15): Request a copy of the data associated with your device identifier.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of data linked to your device identifier. Note: data already aggregated and de-identified cannot be reversed.
• Right to restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Request your data in a machine-readable format where technically feasible.
• Right to object (Art. 21): Object to processing based on legitimate interest at any time.
• Right to withdraw consent: Withdraw consent for optional cookies at any time via the cookie settings panel.

To exercise any of these rights, contact us at david@deadwood.es. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority:

• Agencia Española de Protección de Datos (AEPD)
  Website: www.aepd.es

9. Children and Age Restrictions

DirtyNSFW.com is intended exclusively for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data relating to a minor, please contact us immediately at david@deadwood.es and we will delete it without undue delay.

10. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Device identifiers are stored only in hashed form on our servers and cannot be reversed to reveal your identity. No security measure is 100% infallible.

11. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites and encourage you to review their individual privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by a revised “Last Updated” date at the top of this page. Your continued use of the Site after changes are posted constitutes acceptance of the revised Policy.

13. Contact

Deadwood Studio
Email: david@deadwood.es