Privacy policy
Last updated:
This page describes searches, preferences, entry security and anonymous operational monitoring in the current findthatporn service.
Searches and technical data
Searches and filters go to the catalog service by POST. The app does not automatically change the page URL or log raw queries in application logs. If you explicitly choose Copy query link, the search text is included in the copied URL as q, without filters or access credentials. Opening it can put that text in browser history and expose it to recipients and hosting systems. Avoid sharing sensitive text.
Your browser connects to our hosting infrastructure, which necessarily receives your IP address and request information. Hosting security and operational logs may contain technical request data. We do not claim that requests are anonymous or that infrastructure retains no logs.
Anonymous operational metrics
Our servers send bounded operational events to a private collector for Prometheus and Grafana: page surface, entry/search outcome, HTTP status class, request duration, stable error code, search mode, result count and cache state. We also measure backend search stages, catalog freshness and host CPU, memory and disk. These count page loads, entries and searches, not unique people, visitor retention or provider playback. Custom metrics exclude search text, tags, source URLs, images, cookies, IP addresses and user/request identifiers.
This is server-side monitoring, without an added browser analytics beacon, tracking cookie or persistent visitor identifier. Prometheus keeps aggregate time series for up to 30 days with a 5 GiB cap; the size limit can shorten retention. Daily anonymous aggregate CSV exports are kept separately for longer-term trends, without raw events or visitor data. Cookie-free monitoring is not a claim that consent is never required or that legal requirements are settled.
Cookies and your language
site_language stores your selected language. age_confirmation records your adult self-declaration; it is not identity verification. eligible_session is the existing access-session cookie used where access authorization is required. These cookies support preferences and access, not an analytics feature.
Without a saved language choice, trusted IP-country metadata can suggest a language; browser Accept-Language is the fallback, then English. The app does not need precise location for this. You can override the choice with the language selector. Clearing cookies removes saved preferences and may require age confirmation or access authorization again.
Entry security and Cloudflare Turnstile
Cloudflare Turnstile loads on the entry screen before age confirmation to protect against automated abuse. Your browser connects to Cloudflare, which receives your IP address, browser information and request data under its own privacy policy (https://www.cloudflare.com/privacypolicy/). The app sends the challenge response to Cloudflare for server-side verification. This bot-protection check is not identity or age verification.
captcha_session is a signed, HttpOnly browser-session cookie that records a server-verified security check valid for up to one hour. It is not proof of your identity or age and does not replace access authorization. When the proof expires or the cookie is removed, you must complete the security check again, even if your adult declaration is still saved. age_confirmation remains valid for 30 days; site_language is saved for one year.
Third-party images and previews
After the adult self-declaration, server-verified CAPTCHA and required access authorization, permitted official provider embeds load automatically in search results. The provider’s frame may show its own poster and load media before you choose Play. These connections expose your IP address, browser information and normal request data to the provider, which may set cookies or use storage before Play under its own policies. Playback starts through the provider’s playback control. No provider media loads before entry. Following a source link also takes you to a separate service. We do not control those providers’ data practices.
Messages, choices and requests
If you email us, we receive your address and the information you include, and use them to handle your request. Copyright notices and counter-notices may be shared with the other party as explained on the DMCA page. Avoid sending unnecessary sensitive data.
Use the contact below for privacy questions or requests about data you have supplied. Describe the relevant request without sending passwords or identity documents unless a justified need has been explained. Applicable rights depend on your circumstances and local law; we do not promise a response deadline or deletion of data controlled by another provider.