Cookies and storage
Last updated:
This notice describes app cookies, server-side operational monitoring and external connections. Copy query link puts your search text in a URL only when you choose that action; it does not share access cookies. There is no in-app cookie-consent settings panel.
Anonymous operational metrics
Our servers send bounded operational events to a private collector for Prometheus and Grafana: page surface, entry/search outcome, HTTP status class, request duration, stable error code, search mode, result count and cache state. We also measure backend search stages, catalog freshness and host CPU, memory and disk. These count page loads, entries and searches, not unique people, visitor retention or provider playback. Custom metrics exclude search text, tags, source URLs, images, cookies, IP addresses and user/request identifiers.
This is server-side monitoring, without an added browser analytics beacon, tracking cookie or persistent visitor identifier. Prometheus keeps aggregate time series for up to 30 days with a 5 GiB cap; the size limit can shorten retention. Daily anonymous aggregate CSV exports are kept separately for longer-term trends, without raw events or visitor data. Cookie-free monitoring is not a claim that consent is never required or that legal requirements are settled.
Cookies set by the app
These cookies support language, adult self-declaration, bot protection and authorized access:
- site_language — saves your language choice for one year; browser scripts can read it.
- age_confirmation — saves your adult self-declaration for 30 days; HttpOnly, so browser scripts cannot read it. It does not verify identity or age.
- captcha_session — a browser-session cookie for bot-check proof; its cryptographic proof expires after one hour. HttpOnly.
- eligible_session — a signed access-session cookie issued when the configured access conditions are satisfied; valid for at most one hour. HttpOnly. It does not verify identity or age.
Before entry and automatic previews after entry
Cloudflare Turnstile loads before entry for bot protection. Cloudflare receives your IP address, browser information and challenge-related request data under its own privacy policy. This is not age or identity verification.
Provider media does not load before entry. After entry, the official XVideos preview players for authorized results visible on screen load automatically, before you press Play. The provider receives request data, your IP address and browser information, and may use cookies or other storage under its own policy. Autoplay is explicitly denied, but this does not prevent the provider connection or the loading of posters or other media before playback. Catalog titles retain their original wording rather than being translated by the language setting.
Consent is a separate question
Confirming you are 18 is not cookie consent. Choosing playback does not by itself guarantee that all applicable consent requirements have been met. Whether a specific security or requested-function cookie qualifies for a legal exception depends on its use and the applicable law; third-party tracking or advertising is not automatically exempt.
Controls available in your browser
Use browser settings to block or clear cookies and site data, including third-party cookies where supported. Clearing app cookies resets saved language or access confirmations and may require another security check; blocking them can prevent access.
Not pressing Play does not prevent the provider player from loading or connecting. To avoid provider connections, avoid opening catalog results or block provider resources in your browser; blocking cookies alone does not block network requests. This does not prevent the earlier Cloudflare connection. There is no separate in-app consent-management or analytics opt-out control. Contact us with questions about this notice.