Privacy Policy
Last updated: July 8, 2026
Browsing needs no personal data; accounts and subscriptions do
You can use every discovery feature of the Site without an account and without giving us any personal information. We do not require registration to browse, and we do not link your browsing to your identity.
We do collect personal data when you choose to use certain features: creating a member account, joining the Partner Program, applying as a model, subscribing to the newsletter, Telegram alerts, or push notifications, or submitting a profile removal request. Each is described below, with what we collect, why, the legal basis, and how long we keep it.
What we collect and why
Member accounts. When you register we collect your email address and a password (stored encrypted). We keep technical account records: confirmation and sign-in tokens, when you accepted these policies, your time zone and language preference, and when you last signed in. Legal basis: performance of a contract (providing your account). Kept for the life of the account and deleted within 30 days of closure, except records we must keep longer by law.
Age verification and the partner platform. When you create or link a viewing account with our partner platform through the Site, we generate a technical identifier that lets the partner platform recognise your account, and we store the state of your account there (for example whether card-based age verification is complete) together with an encrypted access token that lets the Site show you member features such as the in-page player. We never see or store your card details or verification documents; verification happens on the partner platform's systems and we receive only the result. Where independent age verification applies, the verification provider processes your data under its own privacy policy and sends us only a pass or fail. Legal basis: performance of a contract, and compliance with legal obligations relating to age assurance.
Purchases and commission. The Site does not process payments. The partner platform notifies us when a referred account signs up or spends, including the amount and currency, so that we can account for our commission and pay Partner Program shares. These records are pseudonymous on our side (a technical identifier and a click reference, plus your account link where you registered through the Site). Legal basis: legitimate interests (operating an affiliate business and paying partners); retained for 6 years as accounting records.
Click and attribution data. When you click a join link we record the click with the page it came from, campaign values, your device type, coarse location derived from your IP address (country, region, city, postal district), and one-way hashes of your IP address and browser signature used for fraud and bot detection. We do not store your raw IP address with the click. Legal basis: legitimate interests (measuring which pages convert, crediting partners, preventing click fraud).
Search queries. We log the text of searches together with country and device type, to improve search and spot unmet demand. Search logs are not linked to accounts or identities.
Newsletter. Subscribing stores your email address, the IP address and browser used to subscribe (as proof of consent), and your confirmation. We use double opt-in: no email is sent until you confirm. Legal basis: consent; you can withdraw it any time via the unsubscribe link in every email. Unsubscribed addresses are kept on a suppression list so we don't email you again.
Telegram alerts. Subscribing stores your Telegram chat ID and, where available, your username, together with the performers you follow. Nothing else from your Telegram profile is collected. Blocking the bot or unsubscribing deletes the subscription. Legal basis: consent.
Push notifications. Enabling push stores the anonymous subscription endpoint and keys issued by your browser, your chosen digest hour, and the performer or tag you followed. No account is required and we cannot identify you from a push subscription. Turning off notifications in your browser deletes it. Legal basis: consent.
Partner Program. Partners provide account details as above, plus verification data (the profile ownership check), commission ledger entries, payout references, and, where connected, a Discord server ID or X handle for the promotional tools. Payment for payouts is arranged directly and any bank or payment details are used only to remit. Legal basis: performance of the Partner Program Terms; ledger and payout records kept 6 years as accounting records.
Model applications. Applying through goonbuds.com/models/apply creates an account and an application record we submit to the partner platform on your behalf. Legal basis: taking steps at your request before entering a contract.
Profile removal requests. The profile removal form collects a performer handle, contact email, and optional reason, used solely to process and verify the request. Where identity verification is required, a government-issued ID image may be submitted by email; it is reviewed by a single operator, used solely for verification, and deleted within 30 days. Removal request data is deleted once the request is resolved. Legal basis: legal obligation (right to erasure) and legitimate interests (preventing fraudulent takedowns).
Error and security logs. Server logs and our error-monitoring service may capture your IP address and browser details when something goes wrong. Used solely to fix faults and protect the Site. Legal basis: legitimate interests; logs are short-lived.
Cookies and local storage
We use only first-party cookies. None is an advertising or cross-site tracking cookie.
| Name | Purpose | Duration |
|---|---|---|
| _gb_app_session | Site functionality and, if you sign in, your session (strictly necessary) | Session |
| age_gate | Remembers that you confirmed you are 18 or over | 1 year |
| gb_attr | Stores the campaign tag (UTM values) from the link you arrived on, so the right marketing source is credited | 30 days |
| gb_ref | Set when you arrive through a partner's referral link; credits that partner if you sign up. First referrer wins; never overwritten | 30 days |
| gb_last_cam | Remembers the last performer page you viewed, so the join page can show the right cam | 24 hours |
| _gb_sid | Opaque, randomly generated identifier set when you click a legacy join link, used to attribute that click to a visit | 1 year |
The attribution cookies (gb_attr, gb_ref, _gb_sid) exist so that conversions are credited to the right marketing source or partner; they hold no personal data and are not used to profile you across sites.
Your For You Page (saved performers and tags), your age-gate confirmation, and interface preferences are stored in your browser's local storage and stay on your device. When you load the FYP we check which of your saved performers are live; we do not store or log your selections server-side or associate them with your identity. Clearing browser data resets them.
Analytics
We use Plausible, a privacy-focused, cookieless analytics service, to measure aggregate page traffic. It does not set cookies, does not collect personal data, does not track you across other sites, and does not build a profile of you.
Special category data
This is an adult discovery platform, so the fact that someone uses it could itself suggest information about their sexual life, which UK GDPR treats as special category data. We design the Site to minimise this: browsing is anonymous, your saved interests live in your browser rather than on our servers, our analytics are aggregate and cookieless, and we do not build interest profiles of identified individuals or use browsing activity to draw inferences about any person's sexuality or preferences.
Where you create an account or subscription, the data we hold (an email address, notification choices) is processed with your explicit consent, given when you sign up, and only for the purposes in this policy. We never sell or share it, and we do not use it to infer or record anything about your sexual life beyond the bare fact of your subscription choices.
Performer data
Performer profiles are sourced from authorised partner feeds and used for discovery, ranking, editorial and promotional purposes, including AI-assisted profile copy generated only from data the partner platform supplies, short promotional clips of public streams, and promotional posts on social channels. We do not collect personal data about performers beyond what the partner platform makes available through its authorised feeds, and we maintain protections that exclude flagged performers from capture and promotion.
If you are a performer and have concerns about data displayed on your profile, contact [email protected], or use the profile removal form. For data held by the source platform, contact them directly.
Who processes data for us
We share personal data only with service providers acting under our instructions:
- Cloudflare (content delivery and security, US/global)
- Plausible Analytics (aggregate, cookieless analytics, EU)
- Mailpace (transactional and newsletter email, UK/EU)
- Bunny CDN (video delivery for promotional clips, EU/global)
- Honeybadger (error monitoring, US)
- Our partner platform, ICF Technology, Inc. (cam services, billing, age verification; an independent controller for what happens on its platform, under its own terms)
- An AI text-generation API provider (produces editorial copy from performer feed data; no visitor or member personal data is sent to it)
- Telegram, Discord, and X (where you connect those channels, each under its own privacy policy)
Where independent age verification is introduced for a jurisdiction, the specialist verification provider will be listed here before it goes live.
International transfers
We are a UK company and are subject to UK GDPR. Some providers above process data outside the UK, including in the United States. Where they do, transfers are protected by appropriate safeguards: the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, together with each provider's technical measures.
How long we keep data
| Data | Retention |
|---|---|
| Account data | Life of the account, deleted within 30 days of closure |
| Commission, payout and transaction records | 6 years (accounting law) |
| Click and attribution records | 24 months, then deleted or fully anonymised |
| Search logs | 12 months |
| Newsletter subscription | Until you unsubscribe (address then held on the suppression list) |
| Telegram / push subscriptions | Until you unsubscribe, block, or revoke |
| Profile removal requests | Until resolved; ID images deleted within 30 days |
| Error logs | 90 days |
Security
We implement reasonable technical and organisational measures to protect our systems against unauthorised access, alteration, disclosure, or destruction, including encryption of sensitive tokens at rest and TLS in transit. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security, but we take our obligations seriously and review our practices regularly.
Who we are
This policy explains how we handle personal data on goonbuds.com (the "Site"). The data controller is , a UK limited company (company number ), registered at . For privacy questions or to exercise your rights, contact [email protected].
Your rights
Under UK GDPR (and, where it applies, EU GDPR), you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent. Contact [email protected] and we will respond within one month. We may need to verify you are the account or subscription holder before acting.
You also have the right to complain: first to us directly (we acknowledge complaints within 30 days), and to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.
California and other US states. We are a small UK company and do not meet the thresholds that make the California Consumer Privacy Act and similar state laws apply to us. We honour their spirit regardless: we do not sell or share personal information, and residents of any US state may use the rights channel above.
Children
The Site is strictly for adults 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has accessed the Site or provided data, contact us immediately at [email protected] and we will delete it.
Policy changes
We may update this policy to reflect changes to our practices or legal requirements. For minor changes, updates are posted on this page with a revised effective date and take effect immediately. For material changes, those that meaningfully affect your rights or how we handle data, we will provide at least 30 days notice before the change takes effect, by posting a prominent notice on the Site and, where you hold an account, by email where appropriate.
Contact
For privacy-related questions or to exercise your rights, contact us at [email protected].