Privacy Policy

Browsing NightCakes does not require an account. We store a flag in your browser's localStorage ("age_verified") to remember that you passed the age gate; it never leaves your device.

Accounts are private by design. You sign up with any username (an e-mail also works, but is not needed). We never store that name or e-mail in readable or decryptable form: we keep only a keyed one-way fingerprint of it, which lets us check your login but cannot be turned back into the name, and cannot be used to contact you. We also keep a salted hash of your password (never the password itself), a hash of your recovery code, your membership status, and whether an administrator has paused or closed the account. For each login session we keep a session cookie ("tl_session"), a device label such as "Chrome on macOS" and when it expires — no IP address. Expired sessions are deleted. Repeated login attempts are counted under a one-way hash, never your name or IP.

You can download everything we hold about you, or permanently delete your account, at any time from your Account page.

Where the law requires an age check (for example the UK, Australia, parts of the EU and several US states), the check is carried out by an independent age-assurance provider. We receive only the result — "over 18: yes" — never your name, date of birth, ID document or photo. We then set a cookie ("nc_age") holding only that result, how and where it was checked, and when; it is not linked to any account and we keep no record of the check.

To apply each country's rules we use the country (and, in the US, the state) that our network provider infers from your connection at the moment of each request. We do not store it.

When a signed-in member opens a video we record the time, the video and a device label such as "Chrome on macOS" (no IP address). We keep this for 180 days as proof of access if a payment is disputed, then delete it automatically. It is included in your data download.

Payments are handled by our payment processors (CCBill for cards, NOWPayments for crypto). Your card or wallet details go directly to them and never reach our servers. From their payment notifications we keep only the plan, amount, currency, status and the processor's reference; names, addresses, e-mails, IP addresses and card or wallet details they send are discarded. We have no account e-mail to pass on; the processor may ask for your details on its own payment page, under its own privacy policy. Card statements show the processor's billing descriptor.

The site is served through Cloudflare, which processes IP addresses and request metadata for security, caching and abuse prevention. Videos are stored and streamed on Cloudflare (R2 and Stream). We do not sell your data and do not set advertising or tracking cookies of our own. You can ask us to delete your account at the address below.

If advertising is shown, ad partners are third parties with their own privacy policies. When an ad loads, that partner may set cookies and receive your IP address and browser information. Ads are never loaded on login, account, membership or admin pages.

Questions about this policy can be sent to dmca@nightcakes.com.

Last updated 2026.