Privacy Policy

1. What we collect

• Account — your email address, a hashed version of your password (we cannot read it), and when the account was created.
• Membership — whether your membership is active and until when, and a link to manage it. Payments happen on our billing partner's checkout, processed by Stripe; your card details never reach our servers.
• Gift links — which account created or activated a gift link, and when.
• Uploads — the videos, titles, descriptions and performer suggestions you submit, linked to your account, and the result of our review.
• Support tickets — the topic, subject and messages of the tickets you open on the Help page, and our replies, linked to your account.
• Technical data — your IP address and basic request details in our server logs and in short-lived counters we use to limit abuse (for example repeated failed logins), and a session cookie that keeps you logged in. Your IP address is never stored in our analytics.
• Usage — which pages and videos are viewed, which searches are made, the site you came from, your country, device type, browser and operating system. This is measured by our own system, on our own servers, and tied to a random visitor identifier stored in a cookie (see Cookies), never to your account or your IP address.
• Copyright notices — the name, contact details and statements in any notice or counter-notice you send us.

Creating an account only needs an email address and a password; we do not ask for your name, address or date of birth. Two exceptions: our billing partner asks for your name and email on its checkout, and copyright notices must by law include your real name and contact details, which we keep with the notice. We do not knowingly collect data from anyone under 18.

2. Why we use it

• To run your account and your membership, and to show you the content you paid for.
• To keep the site secure: detecting abuse, limiting repeated attempts, investigating fraud.
• To review uploads and handle copyright notices and other legal requests.
• To answer you when you contact us.
• To understand how the site is used and improve it.

For users in the European Union, the legal bases are the contract with you (account and membership), our legitimate interests (security, measuring how the site is used, answering requests) and our legal obligations. Because this is an adult site aimed at gay men, having an account may reveal your sexual orientation; we process that only with your explicit consent, which you give when you create the account and can withdraw at any time by asking us to delete it.

3. Cookies

We set one session cookie as soon as you open the site. It keeps you logged in, protects forms against forgery and remembers a gift link you opened; it is essential and normally expires when you close your browser. We also set one first-party analytics cookie, ogs_v, for 12 months: a random identifier that lets us count unique visitors (plus a short-lived marker, ogs_new, for two days after it is created). It is not linked to your account and it is never sent to any third party. You can block or delete it in your browser settings and the site keeps working; requests that arrive without it are grouped into one visitor per day using a one-way hash of the date, your IP address and your browser signature, computed with a secret key kept only on our server, which cannot be turned back into your IP address. We do not use advertising cookies or any third-party analytics.

4. Who we share it with

• Billing — our billing partner and Stripe, to take payments and tell us whether your membership is active.
• Infrastructure — the hosting provider that runs the site and Cloudflare, which delivers videos and images and protects the site against attacks.
• Content delivery — fonts and scripts are loaded from Google (Google Fonts and Google-hosted jQuery) and from the Plyr CDN; like any website host, these services see your IP address and browser details on every page.
• AI description tools — when we write a video's description with an AI service, the video's title, tags, thumbnail and a few frames are sent to that provider; nothing about your account is.
• Email — our mailbox is hosted by Microsoft (Outlook.com), so anything you send us is processed there.
• Discord — if you join our server, Discord processes your data under its own privacy policy.
• Authorities — when the law requires it, or to respond to valid legal requests.

We do not sell your data, and we do not share it with anyone else for their own marketing.

5. How long we keep it

Account and membership data for as long as your account exists, and afterwards only what we must keep for accounting or legal reasons. Server logs and abuse counters for a short period. Detailed analytics records (page, video, referring site, country, device) for 180 days; after that only daily totals, which contain no identifiers, are kept. Upload files while they are on the site (a rejected file is deleted when it is reviewed); the title, description and review result of each submission for as long as your account exists. Support tickets and our replies for as long as your account exists. Videos you uploaded that were published stay on the site after your account is deleted unless you ask us to remove them. Copyright notices and the related correspondence as records of how we handled them.

6. Your rights

You can ask us to tell you what data we hold about you, to correct it, to delete it (including your whole account), to give you a copy, or to stop using it for a particular purpose. Write to us from the email address of your account and we will answer within a month. If you are in the European Union you also have the right to complain to your data protection authority.

7. Security

The site is served only over HTTPS, passwords are stored hashed, access to data is limited to the people who need it, and we never ask for your password. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.

8. Changes

We may update this policy. When the change matters we announce it on the site. The version published here is the one in force.

9. Contact

The data controller is the operator of onlygaystars.com, reachable at [email protected]; the legal entity and its address are provided on request. Questions or requests about your data go to the same address.