Privacy Policy

1. Information We Collect

We collect the minimum information needed to operate Thronly. Specifically:

• Anonymous voting: a hashed device fingerprint (derived from screen properties, user-agent, IP, and a server-side salt) used to enforce one vote per battle per device.
• Account data (registered users only): email address, hashed password (bcrypt), and account-related preferences (favorites, opt-in flags, badges).
• Session data: a signed HttpOnly session cookie (30-day TTL) and a long-lived signed device-token cookie used for fraud prevention.
• Uploaded images (registered users only): photos you choose to submit for inclusion in a creator gallery, plus the file's metadata (size, dimensions, upload timestamp). See §11.
• Operational logs: request timestamps, route, status code, hashed fingerprint, and rate-limit counters. We do not log raw IP addresses in long-term storage; IPs are used transiently for rate-limiting and are hashed before persistence.

2. Use of Information

We use the data above solely for:

• Maintaining the integrity of the voting system (rate-limiting, fraud prevention);
• Account authentication, password recovery, and account-related notifications;
• Tracking affiliate link clicks to measure platform performance;
• Basic, self-hosted analytics to improve user experience;
• Battle matchmaking optimization;
• Creator ranking calculations;
• Aggregate trend analysis.

3. Tracking and Cookies

We use local storage and essential cookies. We do not use third-party tracking cookies for advertising purposes.

• Self-hosted, privacy-focused analytics (no third-party data sharing).
• Affiliate links contain tracking parameters from our partner networks. These networks may set their own cookies upon click-through.
• localStorage stores age-verification status and voting integrity state.
• A signed HttpOnly thronly_session cookie (registered users only) and a signed long-lived thronly_device cookie (all visitors, fraud-prevention purpose) are set on first interaction.

4. Third-Party Links

Thronly contains links to third-party creator profiles (e.g., OnlyFans, Fansly). We are not responsible for the privacy practices or content of these external sites.

5. Contact

For privacy-related inquiries, contact us at [email protected].

6. Affiliate Partner Data Sharing

When you click an affiliate link, the destination platform receives standard referral data (referrer URL, timestamp). Thronly does not share email addresses, account identifiers, or other personally identifiable information with affiliate partners. We receive anonymized conversion data without personal user identification.

7. Creator Data

Creator profiles are compiled from publicly available sources including open community databases, publicly accessible performer directories, and official studio APIs. Platform statistics such as rankings, win rates, and battle records are generated exclusively by Thronly based on community votes. Creators may request complete removal of their profile and all associated data at any time via [email protected]. Data includes: name, profile images, platform links, ranking statistics, and AI-generated biographical text.

8. AI-Generated Content

Thronly uses AI to generate creator biographies based on publicly available information and platform statistics. These texts are clearly compiled from factual data and do not represent opinions or endorsements.

9. Data Retention

• Voting data and battle results: retained indefinitely for ranking integrity (anonymous fingerprints only — no personal data).
• Account data: retained while the account is active; deleted within 30 days of an account-deletion request (see §10).
• Uploaded images: retained while displayed on the platform; rejected uploads are deleted from disk immediately on rejection. Removal requests are processed within 24 hours.
• Self-hosted analytics: 12 months.
• Operational logs: 30 days.

10. GDPR / International Users

Users in the European Union and similar jurisdictions have the right to access, correct, or delete their personal data. Anonymous visitors can exercise most rights by clearing browser localStorage. Registered users and uploaders may request a data export or full deletion via [email protected]. Image-removal requests can additionally be sent to [email protected].

11. Image Moderation & Identity Verification

To keep the platform safe and free from impersonation, every user-uploaded image passes through an automated pipeline before public display:

• NSFW classification using a local NudeNet model — explicit content is rejected and deleted.
• Face detection using a local OpenCV YuNet model — uploads with no detectable face or with a group composition are rejected.
• Identity verification using a local OpenCV SFace model — the upload is compared against existing approved images of the same creator. The numeric similarity score is stored on the image record (a single decimal value) and used to decide approval. Borderline cases are queued for manual operator review.

All moderation models run locally on Thronly infrastructure. No image, embedding, or biometric template is shared with third parties. Face embeddings are computed transiently during the comparison and are not retained as a persistent biometric template; only the upload itself and the moderation decision (approve / reject / pending, plus the similarity score) are stored. Upon image deletion (whether by the uploader, by the depicted creator, or by removal request), the source file is deleted from disk and the associated moderation metadata is removed within 24 hours.

If you believe an image of you was uploaded without your consent, please email [email protected]; we will remove the image within 24 hours of verification.