Privacy Policy

1. Scope and who this applies to

This policy applies to the NovaAdult website, its video, shorts and comment features, and any related apps or interfaces we provide (together, the “Service”). By using the Service you confirm that you are at least 18 years old, or older if the legal age for adult content where you live is higher. If you do not agree with this policy, please do not use the Service.

We operate the Service as an individual project and do not publish the operator’s personal name or residential address on this page. You can reach us using the contact method in section 16.

2. Information we collect

The table below lists the categories of personal information we have collected in the past 12 months, using the categories defined in the California Consumer Privacy Act. Where a category says “no sale”, we have not sold it and have not shared it for cross-context behavioral advertising.

We do not collect your real name (unless you choose to enter it as a display name), postal address, phone number, government ID, date of birth, payment card data, precise geolocation or biometric information. We do not run third-party analytics or tracking pixels.

IP addresses. Your IP address is processed by Cloudflare and our hosting infrastructure to deliver pages, protect against abuse and rate-limit sign-in attempts. Server logs of the hosting stack may contain IP addresses for a limited period.

3. How we use information

• Provide, maintain and secure the Service: accounts, sign-in, uploads, playback, comments, subscriptions and favorites.
• Enforce the 18+ restriction, upload permissions and visibility settings (public, unlisted, private, groups).
• Personalize what you see (recommended videos and shorts) based on what you and similar viewers watch.
• Count views, likes and other statistics shown to creators and administrators.
• Show advertising clips and limit how often you see them.
• Detect, prevent and respond to fraud, abuse, security incidents and violations of our rules.
• Comply with legal obligations and respond to lawful requests.

We do not use your personal information for automated decisions that produce legal or similarly significant effects, and we do not sell it.

4. Cookies, Do Not Track and Global Privacy Control

We use a small number of first-party cookies that are needed to run the Service:

• Session cookie (mt_session) — keeps you signed in; HttpOnly, valid for up to 30 days or until you sign out.
• Visitor cookie (mt_visitor) — a random identifier used to count views once per day and to limit ad frequency, also for visitors without an account.
• Age confirmation cookie — remembers that you confirmed you are 18 or older so we do not ask again on every page.

We do not use advertising or analytics cookies of our own. If a third-party advertising network is enabled (see section 5), that provider may set its own cookies or use similar technologies subject to its privacy policy. You can block or delete cookies in your browser settings, but the Service will not work properly without the session cookie.

Do Not Track (CalOPPA). Browsers offer a “Do Not Track” signal, but there is no common standard for responding to it. We do not track you across other websites or online services over time, so the practical effect is the same whether or not the signal is on.

Global Privacy Control. We do not sell personal information or share it for cross-context behavioral advertising, so an opt-out preference signal such as Global Privacy Control does not change how we handle your information. If that changes, we will honor the signal before doing so.

5. Who we share information with

We disclose personal information only as described here. We do not sell personal information for money or other valuable consideration, and we do not knowingly sell or share the personal information of anyone under 16.

• Service providers. Companies that host, deliver, secure and store data on our behalf (section 6). They may use the information only to provide services to us.
• Other users and the public. Your username, display name, profile picture, public videos, comments and subscriber counts are visible to others according to the settings you choose. Do not post information you want to keep private.
• Advertising. Ads before videos are usually clips uploaded by us. If an administrator switches on a third-party advertising network (for example ExoClick or JuicyAds), that network may receive limited technical information (such as IP address, browser and device details and the page context) to deliver and measure ads. Where that happens, it may count as “sharing” under some state laws, and you have the right to opt out (section 16).
• Audience measurement (no cookies). We run our own copy of Umami on the same servers as this site. It records the page you opened, the referring site, and general device and country information. It sets no cookies, does not store your IP address, and creates no profile that could identify you or follow you across sites. The data stays on our servers and is not shared. Because of that, it runs without asking for consent; you can still switch it off with the “Do Not Track” setting of your browser.
• Google Analytics. The Google Analytics tag is present on every page, but it runs in Google’s Consent Mode: until you choose “Accept all” in the cookie banner, every storage category is set to “denied”, so no cookies are set, no advertising identifier is used and no profile is built. In that state Google still receives a basic, non-identifying signal that a page was viewed, together with your IP address, which Google uses only to derive an approximate location and then discards. After you accept, Google Analytics works normally, may set cookies and receives your IP address, browser and device details and the pages you view. You can withdraw your choice at any time via “Cookie settings” in the footer.
• Legal and safety. When required by law, court order or valid legal process, or to protect the rights, safety and property of users, us or others.
• Business transfers. If the Service is transferred or merged, information may transfer to the successor, which must honor this policy.

6. Hosting and third-party services (Oracle Cloud, Cloudflare, more)

NovaAdult is hosted on Oracle Cloud Infrastructure and its traffic is routed through and protected by Cloudflare. These providers process your information (including IP addresses and request data) on our behalf. Their handling of information is governed by their own policies, which you should read and which apply to you in addition to this policy:

• Oracle Cloud (infrastructure hosting, servers, databases and object storage): Oracle Privacy Policy
• Cloudflare (DNS, content delivery, DDoS and security services): Cloudflare Privacy Policy
• Telegram (used as additional storage for video files): Telegram Privacy Policy. Files stored there are stored under our control and are only delivered through our Service according to each video’s visibility.
• Advertising network (only if enabled, for example ExoClick or JuicyAds): ExoClick Privacy Policy, JuicyAds Privacy Policy
• Analytics (only with your consent, Google Analytics): Google Privacy Policy

By using the Service you acknowledge that you must also comply with, and are subject to, these providers’ terms and privacy policies to the extent they apply to your use of the infrastructure that delivers the Service. We are not responsible for the practices of third parties.

7. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the following rights, subject to verification and legal exceptions:

• Right to know what personal information we collect, use, disclose and share, including the categories listed in section 2, the sources, purposes and recipients, and to receive a copy of the specific pieces of information we hold about you.
• Right to delete personal information we collected from you, with certain exceptions (for example to complete a transaction, keep the service secure or comply with law).
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information; see section 5 regarding advertising networks.
• Right to limit the use and disclosure of sensitive personal information. We use sensitive information only to provide the Service you request (section 9) and therefore do not offer a separate limit link.
• Right not to be discriminated against for exercising these rights.

How to exercise them. Submit a request using section 16. We will confirm receipt within 10 business days and respond within 45 days (extendable once by another 45 days where reasonably necessary). To protect you, we may need to verify your identity by matching details to your account, for example by asking you to send the request from the email address on the account or to sign in. You may use an authorized agent; we may ask for proof of authorization.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

Minors in California (Bus. & Prof. Code § 22581). The Service is for adults only; see section 10.

Information about your rights is also available from the California Privacy Protection Agency.

8. Rights under other US state privacy laws

Residents of Colorado, Connecticut, Delaware, Florida (where applicable), Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and of other states with similar laws, may have the right to:

• confirm whether we process your personal data and access it;
• correct inaccuracies and delete personal data you provided or that we obtained about you;
• obtain a portable copy of the personal data you provided to us;
• opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects — we do not sell personal data or use it for such profiling;
• withdraw consent you have given for processing of sensitive data;
• appeal our decision if we refuse your request.

To make a request, use section 16. If we decline a request we will explain why. You can appeal by replying to our decision with the word “Appeal” and any details; we will respond in writing within the time your state’s law requires (generally 45–60 days), and if your appeal is denied you may contact your state attorney general.

Nevada. Nevada residents may opt out of the future “sale” of covered information. We do not sell covered information as defined by Nevada law.

9. Sensitive information and adult content

Because NovaAdult hosts adult content, records of what you watch, favorite, comment on or search for can reveal sensitive information about your sex life or sexual preferences, which many state laws treat as sensitive data. We handle this data carefully:

• we use it only to run the Service and to rank recommendations for you and similar viewers;
• we never sell it and never share it for advertising or with data brokers;
• you can remove items from your activity by deleting your comments, favorites and subscriptions, or by deleting your account (section 16);
• administrators can see aggregate statistics and, where needed for moderation and security, individual activity records.

By using the Service and its personalization features you consent to this limited use. You may withdraw consent by stopping use of the Service or deleting your account.

10. Age restriction and children (COPPA)

The Service is intended only for people who are 18 years of age or older (or older, where the legal age for adult content in your country or state is higher, for example 19 or 21). We do not direct the Service to children and do not knowingly collect personal information from anyone under 18, and in particular not from children under 13 (COPPA). Accessing adult content requires confirming that you are at least 18 (or the higher legal age where you live), and some content also requires an approved 18+ access on your account. If you believe a person under 18 has provided us with personal information, contact us (section 16) and we will delete it promptly.

Parents and guardians can use device-level parental controls and filtering software. The Service labels itself as adult content (RTA label) so that such tools can block it.

11. Retention

• Account data is kept while your account exists and deleted or anonymized after you ask us to delete it, subject to legal exceptions.
• Sessions expire after up to 30 days.
• Viewing events, likes, comments and similar activity are kept while your account exists so the Service works and recommendations stay useful; anonymous visitor records are kept in aggregated form for statistics.
• Uploaded videos and images are kept until you or an administrator delete them.
• Security and server logs are kept for a limited period needed for security and troubleshooting.
• We may keep information longer where the law requires it or to resolve disputes and enforce our rules.

12. Security and breach notification

We use reasonable technical and organizational measures: encrypted connections (HTTPS), salted password hashing, short-lived signed URLs for video files, access checks on every video request and restricted administrator access. No system is completely secure. If a breach affects your personal information, we will notify you and the authorities as required by applicable state laws.

13. Where information is processed

The Service is hosted on Oracle Cloud and delivered through Cloudflare’s global network, so your information may be processed and stored in the United States and in other countries where these providers operate. Laws in those places may differ from the laws where you live.

14. Content you post

You control the visibility of your uploads (public, unlisted, private or shared with groups). Public content can be viewed, copied and indexed by search engines; we cannot control what others do with it. Only upload content you have the right to share and that complies with the law and our rules; do not upload content showing minors or content of people who have not consented.

15. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows the current version. If we make material changes, we will post a prominent notice on the Service before they take effect where the law requires it.

16. How to contact us and exercise your rights

To make a privacy request (access, deletion, correction, opt-out, appeal) or ask a question about this policy, contact us through the administrators of this site. Please include the username of your account and what you would like us to do, and state that you are making a “privacy request”. We do not require you to provide a real name or postal address to make a request.

You can also delete many items yourself: remove comments, favorites and subscriptions in the interface, and delete your videos in “My videos”.

Back to NovaAdult.

17. EU, EEA, UK and Swiss residents (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR (or the UK GDPR / Swiss FADP) applies in addition to the rest of this policy. The controller is the operator named in the legal notice.

• Purposes and legal bases: providing your account and the video service (Art. 6(1)(b) — contract); security, abuse prevention, moderation and legal compliance (Art. 6(1)(f) — legitimate interests, and Art. 6(1)(c) — legal obligation); age and access checks; advertising cookies and device hints for ad delivery (Art. 6(1)(a) and § 25 TTDSG / ePrivacy — only with your consent, which you can withdraw at any time via “Cookie settings” in the footer).
• Sensitive data: viewing history and searches on an adult site can reveal information about your sex life. We process them to provide the service and personalized recommendations and do not use them for advertising or share them with advertisers. Where the law requires explicit consent for this, we treat your use of personalized features while signed in as that consent, which you can withdraw by deleting your history/account or writing to us.
• Recipients: hosting and security providers (Oracle Cloud, Cloudflare), Telegram (if used for storage), and — only with consent — the ad networks (ExoClick, JuicyAds). They act as processors or independent controllers under their own policies.
• Transfers outside the EEA: the site is hosted on infrastructure in the United States or other third countries. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses.
• Retention: account data until you delete the account; security and access logs for a short period (generally up to 90 days); abuse reports and moderation records as long as needed to defend legal claims and meet legal duties; consent and age-confirmation records for the duration of the account plus the limitation period.
• Your rights: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent, and the right not to be subject to solely automated decisions with legal effect. Write to us using the contact details in section 16. You can also complain to your local data-protection authority.
• Children: the service is only for adults. If we learn that a minor has an account we delete it.