Privacy & GDPR Policy

This Privacy and Data Protection Policy ("Policy") explains how personal data is collected, used, and protected through nsfwhen.com ("Site", "Service") in compliance with the European Union General Data Protection Regulation (GDPR), the United Kingdom Data Protection Act 2018 (UK GDPR), and the Turkish Law on the Protection of Personal Data No. 6698 (KVKK).

1. Data Controller

Pursuant to Article 4(7) of the GDPR and applicable data protection legislation, the Data Controller responsible for your personal data is:

Name / Representative: Yunus Emre Altanay
Service: NSFWhen (nsfwhen.com)
Data Protection Contact Email: y.emrealtanay@gmail.com

2. Personal Data We Collect

NSFWhen strictly adheres to the principle of data minimization, collecting only information necessary to operate the index:

Account Information: Username (pseudonym/handle), email address, salted cryptographic password hash (bcrypt), interface locale preference (tr/en), and preferred film genres.
Community & Contribution Data: Timestamp entries (start/end seconds), content categories, clean film claims, community verification votes, reputation scores, and badge milestones. (Note: Scene entries contain zero free-form commentary or narrative.)
Technical & Operational Data: IP address, browser/device information (User Agent), access logs, and strictly necessary session cookies.
Age Declaration: The 18+ confirmation is stored strictly on your local device (localStorage) and is not ingested into your account profile on our servers.

Data We Never Collect: We host no explicit images, clips, or videos. We never collect biometric data, payment information, or special category data.

3. Purposes and Legal Grounds

Your personal data is processed under the following lawful bases established in GDPR Article 6:

Performance of Contract (Art. 6(1)(b)) Account creation, authentication, dispatch of email verification links, and delivery of core site features. Legitimate Interests (Art. 6(1)(f)) Platform integrity, abuse prevention, rate limiting, anti-spam protections, editorial moderation, and community reputation scoring. Legal Obligation (Art. 6(1)(c)) Investigating copyright notices and fulfilling statutory disclosure obligations where required by law.

4. Cookies and Local Storage

NSFWhen employs no third-party tracking, profiling, or behavioral advertising cookies. We use only strictly necessary technologies:

Session Cookie: Encrypted cookie maintaining your authenticated state and CSRF attack prevention.
Browser Local Storage: Client-side storage for the 18+ declaration state and film catalog view settings (grid/rows/cards).

5. Third-Party Service Providers

Personal data is never monetized or sold. Data is shared only with trusted infrastructure providers supporting operations:

The Movie Database (TMDb): Film titles and posters are queried via TMDb API. User personal data is never transmitted to TMDb.
Hostinger: Secure cloud servers hosting the encrypted database and application files.
SMTP Service: Secure dispatch of account verification emails.
Legal Authorities: Formal disclosure upon receipt of enforceable judicial warrants.

6. Open License (CC BY-SA) and Anonymization

Scene marks and clean confirmations contributed by users form part of a public reference index published under the Creative Commons Attribution-ShareAlike (CC BY-SA) license. Upon account deletion:

Direct personal identifiers (email, password hash, personal profile) are permanently expunged.
Submitted timestamp metrics remain in the film index in strictly anonymized form to preserve public utility and index integrity.

7. Data Retention

Account data is retained for the duration of your membership. Upon account deletion or termination, personal identifiers are purged or anonymized within 30 days. Operational log files are cleared on a rolling cycle (maximum 180 days).

8. Your Data Protection Rights

Under the GDPR, UK GDPR, and KVKK, you possess the following rights:

Right to Access: Inquire whether we process your data and receive a copy thereof (GDPR Art. 15).

Right to Rectification: Request correction of inaccurate or incomplete records (GDPR Art. 16).

Right to Erasure ("To be Forgotten"): Request deletion of personal records (GDPR Art. 17).

Data Portability: Obtain a structured copy of your contributed records (GDPR Art. 20).

You also hold the right to lodge a complaint with your competent supervisory authority (such as the Information Commissioner's Office (ICO) in the UK, the KVKK in Turkey, or an EU Data Protection Authority).

9. Age Limit (18+) and Minors

The Service is intended solely for adults aged 18 and over. We do not knowingly collect or solicit personal information from individuals under 18. If we discover that a minor has registered without verifiable parental authorization, we promptly delete the account.

10. Contact and Data Requests

To exercise your statutory rights or submit questions regarding privacy practices:

Data Protection Inquiries: y.emrealtanay@gmail.com
Representative: Yunus Emre Altanay
Requests are processed without fee within 30 days.