Privacy policy

The controller of the personal information described here is the operator of this service, 18plus.vg ("we", "us"), reachable by email at abuse@18plus.vg.

This policy covers this site only. It does not cover any site we link to.

This service is for adults. We do not knowingly collect personal information from anyone under 18. If we learn that a minor has an account, we delete the account and its data.

• Account data: username, email address, a password hash (never the password itself), account state and quotas, the terms version you accepted with its timestamp, and the IP address you signed up from.
• Session data: a random session cookie so you stay signed in, kept alongside the IP address and last-seen time for security.
• Uploaded content: the files you upload and their metadata (size, dimensions, duration, date, which album they belong to, public/unlisted/private).
• Server logs: IP address, time, method and path for requests that matter — sign-ins, admin actions, rate-limit hits and abuse reports. These exist so we can investigate abuse and keep the service running.
• Reports and messages you send us: the content of a report or contact message, and your IP address when you file it.

Where the GDPR or similar law applies, our bases are performance of a contract (running your account), legitimate interests (security, abuse prevention, running the service), consent (where you gave it) and legal obligation.

• To create and run your account, store your content and serve it to whoever you shared it with.
• To keep the service secure and to investigate abuse, spam, scraping and illegal content.
• To comply with the law, including responding to copyright notices, lawful requests and child-safety obligations.
• To reply to you when you contact us.

• Hosting, storage and email providers that run the service for us, under contract and only so they can host it.
• Law enforcement, regulators and courts where we are legally required to, or where we believe there is a genuine risk to a person's safety (child safety in particular).
• A copyright complainant, where the law requires us to pass a takedown notice on to the account holder who uploaded the material.
• Nobody else. We do not sell personal information, and we do not run third-party advertising or analytics trackers on this site.

• Account data and content: until you delete them, and then for a short tail in backups and caches before they age out.
• Audit and security logs: kept long enough to investigate abuse and to satisfy legal obligations, then deleted or aggregated.
• Copyright notices, abuse reports and their outcomes: kept as a record of strikes against repeat infringers, and to show that we dealt with a report.
• Data we are legally required to preserve (for example material reported for child safety or a legal hold) is kept for as long as the obligation lasts.

Subject to the law that applies to you, you can ask for a copy of your personal information, ask us to correct it, ask us to delete it, object to or restrict certain processing, and complain to a regulator. Australians can complain to the Office of the Australian Information Commissioner (OAIC); people in the EU/UK can complain to their local supervisory authority.

To exercise any of those rights, email abuse@18plus.vg. We may need to verify that the account is yours. We aim to answer within 30 days.

We set one first-party session cookie when you sign in (and a short-lived one for two-factor confirmation). No advertising cookies, no cross-site tracking, no third-party embeds on public pages.

Passwords are stored only as salted hashes, the data directory is access-controlled, and media requests are authorisation-checked per space. That said, no system is perfectly secure: keep your own copies of anything you cannot afford to lose, and tell us straight away if you think your account is compromised.

Questions about any of this, or a takedown: abuse@18plus.vg.

We may update this policy; the current version is shown on this page. Material changes will be flagged on the site.