Privacy Policy

01 Scope and controller

This policy explains how HogTok handles personal information when you visit HogTok, watch content, submit a creator recommendation, contact us, or hold a creator or advertiser account. HogTok is the data controller for that information.

HogTok is an adults-only platform. Everything here assumes you are 18 or older. We do not knowingly collect information from anyone under 18, and we do not build profiles of minors.

02 Information we collect

Information you give us

• Creator account data — name or stage name, handle, email address, password (stored only as a salted hash), biography, social links, avatar and cover images, category selections, and the identity and age-verification material our staff record when a profile is approved.
• Content you upload — photos, videos, titles, descriptions, category tags, and the technical metadata attached to those files. Uploaded files are stored on our own infrastructure, not on a third-party content network.
• Recommendations — if you use the Submit Hog form, the details you enter there (typically a creator's name and links). That form is provided by a third-party form service, which processes what you type under its own privacy policy.
• Correspondence — emails, removal requests, copyright notices and support messages, including any attachments and the information needed to verify them.
• Advertiser data — business contact details, billing information and the creatives supplied for a campaign.

Information collected automatically

• Server logs — IP address, date and time, the page or media requested, the response status, the referring page and your browser's user-agent string. These are generated by our web server and application and are used for security, abuse prevention and diagnosing faults.
• Age-gate state — a single cookie recording that you confirmed you are an adult, so you are not asked on every page.
• Advertising measurements — when a sponsored placement is served we record an impression, and when it is clicked we record a click. These counters are tied to the campaign, not to a profile of you.
• Feed state — the randomised watch feed uses a per-visit shuffle. It does not create a persistent behavioural profile of what you watch.

We do not ask for, and do not want, special-category data such as health information, political opinions or biometric identifiers. Please do not send it to us.

03 Cookies and local storage

We keep cookies to a minimum and use no advertising-tracking cookies of our own. The cookies you may encounter are:

• Age verification — remembers that you confirmed you are 18+. Without it you would be asked on every single page. It is a first-party, HTTP-only cookie with a limited lifetime.
• Session and security — issued to signed-in staff and creators so the admin panel works, and to protect forms against cross-site request forgery.
• Preference — small first-party values that remember interface choices where the site offers them.

Third-party services we embed — such as the recommendation form — may set their own cookies once loaded. Those are controlled by the provider, not by us, and are subject to that provider's policy. You can block or delete cookies in your browser at any time; blocking the age-verification cookie will mean confirming your age on each visit, and blocking session cookies will stop the admin panel from working.

04 How we use information

We use personal information to operate the platform and to keep it lawful and safe. Specifically, to:

• Serve pages and media, including signing media URLs so files cannot be hot-linked or scraped in bulk.
• Create, verify, publish and administer creator profiles, and to check that every listed creator is an adult.
• Host, transcode and deliver uploaded content, and generate thumbnails and previews.
• Enforce the age gate and our terms, detect abuse, investigate reports and prevent fraud.
• Respond to removal requests, copyright notices and law-enforcement requests that are validly made.
• Measure whether advertising placements are served and clicked, and invoice advertisers.
• Diagnose faults, monitor performance and improve the directory and the watch feed.
• Send service messages — for example, a security notice or a material change to these policies.

We do not sell personal information, and we do not rent or trade email lists. We do not use your viewing history to build an advertising profile, and we do not run third-party behavioural retargeting on this site.

05 Legal bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract for providing the service to creators and advertisers; legitimate interests for security, abuse prevention, fraud detection, service improvement and the operation of the age gate, balanced against your rights; legal obligation for records we must keep, including age-verification and §2257 records, and for responding to valid legal requests; and consent where we ask for it explicitly, such as optional communications. You can withdraw consent at any time without affecting processing that already happened.

06 Who we share with

We share personal information only where there is a reason to, and only the minimum necessary:

• Service providers — hosting and infrastructure, email delivery, error monitoring and the third-party form provider used for creator recommendations. They act on our instructions and are bound by confidentiality.
• Payment and billing providers — for advertisers and any paid creator feature. Card details are handled by the payment provider; we do not store full card numbers.
• Legal and safety — where we are required by law, court order or a valid regulatory request, or where disclosure is necessary to investigate suspected criminal activity, to protect a person from serious harm, or to establish or defend a legal claim. Reports concerning minors or non-consensual imagery are escalated.
• Professional advisers — lawyers, auditors and insurers, under duties of confidence.
• Successors — if the business is sold or merged, information may transfer to the successor, subject to this policy.

We never share creator identity or age-verification records with advertisers or other creators. Public profile information — stage name, handle, biography, social links, avatar, cover and published content — is, by design, public.

07 How long we keep it

We keep information only as long as it serves the purpose it was collected for, or as long as the law requires:

• Server logs — short rolling retention, typically weeks, unless preserved as part of a security investigation.
• Creator account and profile data — for as long as the account is active, then a limited period to allow restoration and to meet accounting obligations, after which it is deleted or anonymised.
• Age-verification and §2257 records — retained for as long as the associated content is published, and afterwards for the period required by applicable records-keeping law. These records are kept separately from public profile data and are not published.
• Removal and copyright notices — retained as a record of the action taken, so repeat infringers and repeat reports can be identified.
• Advertising counters — aggregate impression and click counts are kept for reporting and billing; they are not tied to an individual visitor.

Deleting content removes it from public view immediately. Copies may persist briefly in caches and backups, which are cycled on a fixed schedule.

08 Security

Media files are served through signed, expiring URLs rather than open static paths, so a copied link stops working. Access to the admin panel requires an authenticated staff account, passwords are stored as salted hashes, and administrative actions are logged. Data in transit is encrypted with TLS in production. Access to age-verification and records-keeping material is restricted to staff who need it.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify affected people and the relevant authority as the law requires. If you believe you have found a vulnerability, please report it to [email protected] rather than testing it against other users' data.

09 Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — a copy of the personal information we hold about you.
• Correction — fixing information that is inaccurate or incomplete.
• Deletion — erasing information we no longer have a lawful reason to keep.
• Restriction and objection — limiting how we use information, or objecting to processing based on legitimate interests.
• Portability — receiving the information you gave us in a structured, machine-readable format.
• Withdrawing consent — at any time, where consent is the basis.
• Non-discrimination — we will not degrade the service because you exercised a privacy right.

California residents have the right to know what categories of personal information are collected and disclosed, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" for cross-context behavioural advertising. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, but you may still submit a request.

To exercise any right, email [email protected]. We will verify your identity before acting — usually by confirming control of the email address on the account — and we respond within the timeframe the applicable law sets, normally 30 days. You may use an authorised agent. If we cannot fully comply with a request because of a legal retention obligation, we will tell you which obligation applies.

10 Children

HogTok is strictly for adults. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it and close any associated account. If you believe a minor has provided information to us, contact [email protected] immediately and we will act on it as a priority.

11 International transfers

Our infrastructure and service providers may process information in countries other than the one you live in. Where information protected by the GDPR or UK GDPR leaves the European Economic Area or the United Kingdom, we rely on an appropriate transfer mechanism — an adequacy decision, or standard contractual clauses with the recipient — together with technical and organisational safeguards. You can ask us for details of the mechanism used for a particular transfer.

12 Advertising and third parties

Sponsored placements on HogTok are served from our own platform. We count impressions and clicks per campaign; we do not pass your identity to advertisers, and we do not allow advertisers to run their own tracking scripts across our pages. If an advertiser's creative links out, the destination site's privacy policy applies from the moment you arrive there.

We honour browser signals where we can. Because we do not run cross-context behavioural advertising, there is no opt-out needed for it, but you can block third-party content with a browser extension without breaking the core site.

13 Changes

We update this policy when our practices or the law change, and we revise the "last updated" date at the top of the page. If a change materially affects how we use information we already hold, we will give notice by email to account holders or by a prominent notice on the site before it applies.

14 Contact and complaints

Privacy questions and requests go to [email protected]. If you are in the EEA or the UK and are not satisfied with our response, you may complain to your national data-protection authority or the UK Information Commissioner's Office.

Data controller

HogTok

Postal address

Available on request from [email protected]

Privacy contact

[email protected]