Privacy Policy

Last updated: 18 October 2026

This policy explains what personal data PhotoMode collects, why, and your choices.

Data we collect

• Account data: email address, username, display name, bio, avatar, and your date of birth (collected only to verify you are 18+; never displayed publicly).
• Registration details: optional note to moderators, time you accepted the Terms and Privacy Policy.
• Content you post: photos (metadata such as camera/GPS EXIF is stripped on upload), captions, backstories, fan fiction, tags, likes, bookmarks and reports.
• Technical data: IP address, user agent, and session cookies. IP addresses are used for security, rate limiting and abuse prevention. View counts use a salted one-way hash of your IP and browser (or your user ID) and are not stored in readable form.
• If you register as under 18: we store only a one-way hash of the email so it cannot be used to register, and we do not create an account.

How we use data

To run the Service: authenticate you via magic-link emails, manage approvals, display your public profile and Content, count likes and views, moderate and keep the Service safe, and respond to requests. We do not sell your data and do not use it for advertising.

Cookies

We use a single essential session cookie (pm.sid) to keep you signed in and protect forms from forgery. We do not use advertising or tracking cookies.

Sharing

Public content (profile, SFW photos, stories) is visible to everyone and may be indexed by search engines. NSFW content is excluded from search indexing. We share data with service providers who help us operate the Service: file storage and delivery (Cloudflare R2), email delivery (SMTP provider) and hosting. We may disclose data if required by law or to protect safety.

Retention

We keep account data while your account exists. Deleting content removes it from the Service and storage promptly; backups may persist for a limited time. Magic-link tokens expire after 15 minutes and are stored only as hashes.

Your rights

Depending on where you live (e.g. GDPR/UK GDPR/CCPA) you may have rights to access, correct, export or delete your data, and to object to or restrict processing. Contact [email protected] and we will respond within a reasonable time. You can edit your profile and delete your Content any time.

Security

We use encryption in transit, hashed tokens, rate limiting and access controls, but no system is perfectly secure.

Children

The Service is for adults only (18+). We do not knowingly collect data from anyone under 18; if you believe a minor has registered, tell us and we will remove the account.

Changes and contact

We may update this policy and will change the date above. Contact: [email protected].