Privacy Policy

Last updated 3 August 2026

WhatsThatPorn has no accounts, no logins and no tracking pixels. This page describes the little we do process.

What we collect

A hashed IP address. When you post a comment, submit to the Identify board, like a scene, or click through to a studio, we store a SHA-256 hash of your IP combined with a secret salt. We never store the address itself, and the hash cannot be reversed to recover it. It exists to enforce rate limits and to detect spam, nothing else.
Scene likes. A like adds one to a public counter on that scene. Alongside it we keep a single row pairing your hashed IP with that scene, for one purpose: stopping the same person liking it a thousand times. Those rows are deleted after 90 days. The list of what you have liked is not part of this - it is kept in your own browser and never sent to us, which is why it disappears if you clear your browsing data.
What you type. Comments, Identify posts, the nickname you choose. Supplying a real name is neither required nor expected.
Outbound clicks. Which scene was clicked and which studio it went to, so we know what the index is useful for.
Server logs. Standard web-server request logs, retained briefly and rotated.

What we do not collect

No advertising or analytics trackers. No cross-site profiling. No email address, no payment details, no account. We do not sell or share data with brokers.

Legal basis

Under the GDPR, our basis is legitimate interest (Article 6(1)(f)): keeping an anonymous, unauthenticated site usable requires abuse prevention. A hashed IP is the least identifying way we found to do it. Hashed identifiers remain personal data, which is why they are covered here.

Third parties

Cloudflare sits in front of the site for TLS, caching and DDoS protection, and processes request metadata as part of that.
Studio CDNs.Images and preview clips load from the studios’ own servers, so your browser contacts them directly and they see your IP and user agent. Their policies govern that, not ours.
Affiliate networks. Following an outbound link takes you to a studio or its affiliate network, which may set its own cookies.

Retention

Comments and Identify posts remain until removed. Click records are aggregated. Rotating our IP salt permanently severs every existing hash from the address it came from.

Your rights

If you are in the EU, UK, or a US state with comparable law, you may request access, correction, deletion, or restriction of processing. Write to [email protected].

One honest limitation: because we hold only a salted hash and no account, we usually cannot tell which records are yours. Quote the comment or post you mean and we will remove it.

Children

This site is for adults. It is not directed at anyone under 18, and we do not knowingly process their data. It is labelled RTA and can be blocked by any standard parental filter.

What we collect

A hashed IP address. When you post a comment, submit to the Identify board, like a scene, or click through to a studio, we store a SHA-256 hash of your IP combined with a secret salt. We never store the address itself, and the hash cannot be reversed to recover it. It exists to enforce rate limits and to detect spam, nothing else.

Scene likes. A like adds one to a public counter on that scene. Alongside it we keep a single row pairing your hashed IP with that scene, for one purpose: stopping the same person liking it a thousand times. Those rows are deleted after 90 days. The list of what you have liked is not part of this - it is kept in your own browser and never sent to us, which is why it disappears if you clear your browsing data.

What you type. Comments, Identify posts, the nickname you choose. Supplying a real name is neither required nor expected.

Outbound clicks. Which scene was clicked and which studio it went to, so we know what the index is useful for.

Server logs. Standard web-server request logs, retained briefly and rotated.

Third parties

Cloudflare sits in front of the site for TLS, caching and DDoS protection, and processes request metadata as part of that.

Studio CDNs.Images and preview clips load from the studios’ own servers, so your browser contacts them directly and they see your IP and user agent. Their policies govern that, not ours.

Affiliate networks. Following an outbound link takes you to a studio or its affiliate network, which may set its own cookies.

Your rights

If you are in the EU, UK, or a US state with comparable law, you may request access, correction, deletion, or restriction of processing. Write to [email protected].

One honest limitation: because we hold only a salted hash and no account, we usually cannot tell which records are yours. Quote the comment or post you mean and we will remove it.