Privacy policy
Last updated
This page describes exactly what this site stores, where it lives and how long it stays. It is written from the code, not around it: every retention period below is the number a scheduled cleanup job actually enforces.
Who runs this site
hornygram is the operator of this catalogue. Any question, complaint, copyright notice or deletion request goes to [email protected], which is a real mailbox read by a person. The site itself sends no email.
There are no visitor accounts
You cannot register here, and nothing on the site asks for your name, email address or phone number. Voting, saving favourites and confirming your age all work without an account, which is why none exists.
The single exception is the submission form: if you offer a bot or a channel for listing, you type in a Telegram username so we can reply, and that is stored with the submission.
What stays on your device
| What | Where | Why | How long |
|---|---|---|---|
| Age confirmation | localStorage | so the 18+ notice is shown once | until you clear your browser |
| Favourites | localStorage | the list of listings you saved | until you clear your browser |
| voter_id | signed httpOnly cookie | one vote per browser | 12 months |
| Cookie choice | localStorage | so the cookie bar is not shown again | 12 months |
| Unfinished submission form | localStorage | so a reload does not lose what you typed | until sent or cleared |
| draft_token | signed httpOnly cookie | finds your unfinished submission on the server | 30 days |
| Analytics cookies | cookie | only if you accept them in the cookie bar | per the analytics provider |
Your favourites never leave your browser: the server is not told what you saved, and there is no copy of that list anywhere else.
What is stored on our servers
| What | Data | Why | How long |
|---|---|---|---|
| A vote | listing id, voter_id, salted hash of your IP, hash of your browser string | one vote per browser, and the order of the catalogue | kept — votes are the ordering of the catalogue |
| A click on an outgoing link | listing id, time, salted hashes, referring page on this site, country | traffic statistics and abuse analysis | raw rows 30 days, then daily totals only |
| A report | reason, comment, salted hash of your IP | moderation | 12 months |
| A submission | what you typed in the form, payment data, refund address, salted hashes | publishing the listing, replying to you and refunding you | as long as payment records require |
| An unfinished submission | the fields you filled in, salted hash of your IP | restoring the form and contacting you about it | 30 days after the last change |
| Web server logs | IP address, browser string, requested address | diagnostics and security | 14 days |
IP addresses
No application record stores your IP address in readable form. Votes, clicks, reports and submissions store a salted hash: it cannot be turned back into an address, but it can be matched against itself, which is what abuse analysis needs.
There is exactly one exception, and it is better named than promised away: web server logs contain IP addresses in the clear, because every web server works that way and because an incident cannot be investigated without them. Those logs are deleted after 14 days. Saying "we never see your IP" would be untrue — your hosting provider, our network provider and these logs all see it.
Who else receives data
| Who | What they see | Why it is unavoidable |
|---|---|---|
| Our hosting provider | everything stored on the server | the site has to run somewhere |
| Our network and firewall provider | IP addresses and request headers for pages, anti-bot challenge data | filtering abuse and protecting voting |
| Our payment provider | the payment details of a submitter | accepting payment for a listing |
| Our media host | IP address when an image loads | serving images |
| Analytics | see the next section | measuring traffic |
Nothing is sold, and nothing is shared for advertising purposes.
Analytics
The primary counter is self-hosted on this site: no cookies, no data handed to a third party, no consent banner needed for it. It counts page views and where visitors arrived from, and nothing that identifies a person.
Third-party analytics, when enabled, loads only after you accept analytics cookies in the cookie bar. Decline and it never loads; the site itself works exactly the same either way.
Private submission status pages are excluded from analytics entirely, and they are sent with a policy that stops the address leaking to the next site you visit: the address contains your private token.
Your rights
Write to [email protected] to have your data removed. What can genuinely be deleted: a submission with your contact details and refund address, an unfinished submission, a report you sent.
A vote cannot be deleted on request, and we would rather say so than pretend otherwise: it is tied to a browser identifier, not to a person, so there is nothing to match your request against.
Changes
When this policy changes, the date at the top of the page changes with it. The date reflects the last change to the text, not the last time the page was rebuilt.