Privacy

This is the whole of it. nwty.me runs no advertising, no analytics service, no tracking pixels and no social plugins, nothing here is passed to anybody for their own purposes, and nothing about you is sold. Nobody's data is used to make an automated decision about them, and there is no profiling.

Who is responsible

tbd, tbd, tbd. See the imprint. For anything on this page, write to hello@nwty.me. The site is small enough that it has no data protection officer, and is not required to have one.

Visiting the site

The web server keeps the usual access log its provider writes: the address requested, the time, the response, the browser's user agent and the IP address it came from. That is what makes it possible to find a fault or notice an attack, and it is kept on the legal basis of a legitimate interest in the site working at all (Art. 6 (1)(f) GDPR). It is held for a short period by the hosting provider and then overwritten; it is not combined with anything else here and is not used to work out who anybody is.

The session cookie keeps you signed in from one page to the next: it carries nothing but a random identifier, is not readable by any script, and is gone when you log out. Your light-or-dark preference is stored in the browser itself and never sent to us. Neither needs consent, because without them the site cannot do the thing you asked it to (§ 25 (2) no. 2 TDDDG).

There is one more, nwty_person, and it exists so that we can tell how many different people visit rather than only how many visits there are. It is a random number, generated on your first page and kept for twelve months. It is not worked out from your address, your browser or anything else about you, it says nothing about you, it is never sent anywhere but here, and no script on the page can read it. All it is ever used for is counting: the same number seen on two days means one person rather than two. We rely on a legitimate interest in knowing whether the site is reaching anybody (Art. 6 (1)(f) GDPR). Deleting your cookies removes it, and you will simply be counted as somebody new next time.

Your account

Registering stores your name, username, email address, and your password as a hash that cannot be turned back into the password, together with the invite code you arrived on and who handed it out. It is processed to give you the account you asked for (Art. 6 (1)(b) GDPR). Without those details there can be no account; everything else on the site is optional.

The email address is confirmed by a link, and after that it is used for account matters and moderation notices. It is never published, never sold, and never used for anything you did not ask for. The day you last signed in is noted, which is what the site uses to work out whether you are still around.

What we send you

Mail from this site is about your account: confirming your address, resetting a password, telling you a submission was approved or sent back, telling you an account was suspended. Those are part of running the account you asked for (Art. 6 (1)(b) GDPR).

Two of them are reminders rather than answers: one if a profile is left unfinished after a couple of days, one if you have not been here for a fortnight. Each is sent once, they are sent on a legitimate interest in a network whose members are actually there (Art. 6 (1)(f) GDPR), and you can tell us to stop at the address above and they will stop. Notices inside the site, including the occasional announcement to everybody, work the same way and can be read on your notifications page.

Your model profile

Everything you put into a profile (the name, the story, the tags, the links, the images) is stored so it can be shown on the site, and once approved it is public and can be found by search engines. Images are held on the server in the sizes needed to display them. Submissions are read by moderators before they go live, and the notes they leave are kept with the submission, as are the earlier versions of it.

A profile usually presents a generated model rather than you — and where it presents a real person, that is a claim a moderator has checked and the profile says so on every picture. What you choose to put into it is up to you, and anything in it that identifies a real person, including you, is there because you put it there. If a profile carries something about somebody else, you need their agreement; see the content guidelines.

Where a profile links to a Spotify or Apple Music artist page, the identifier out of that link is sent to those services once to ask what the artist is called, and the answer is stored here. Nothing about you or about whoever is reading the page goes with the question.

If you apply to join

The application form stores what you write in it: your name, your email address, what you said about yourself and about your model, and the public profiles you pointed us at. It is processed to answer you, which is what you asked for by sending it (Art. 6 (1)(b) GDPR). Nothing in it is published anywhere, and the only mail that comes of it is the answer.

An application that is still waiting is kept until it is answered. Once it has been answered, either way, it is kept for 90 days and then deleted. A yes has become an account by then and a no has been sent, and what is left is somebody's name and two paragraphs sitting in a table for no reason anybody could give. Write to the address above if you would rather it went sooner.

Reach figures

Visits to a model page are counted so the model can see how their profile is doing. A visit is stored as the profile, the moment, the site the visitor came from if the browser said so (the host only, never the full address), and a key derived from the request that changes every day: enough to tell one visit from the next, not enough to recognise anyone tomorrow. No IP address and no device details are kept with it. A like is stored the same way, so that the same visitor cannot like the same profile twice in a day. Legitimate interest in showing members what their work is doing (Art. 6 (1)(f) GDPR).

Leaving for another site

Links a model publishes lead away from nwty.me. Following one is a decision you make: the page in between says so, and nothing about you is sent along with it, not even which page you came from. What the site at the other end does is covered by their privacy notice, not this one.

Who else touches it

The site and its mail run on servers at STRATO AG, Pascalstraße 10, 10587 Berlin, Germany, under a data processing agreement, and the backups of its database stay on those same servers. Typefaces are loaded from Bunny Fonts (BunnyWay d.o.o., Slovenia, inside the EU), which sets no cookies and does not log requests, though your browser does connect to it to fetch the font. Nothing is transferred outside the European Union, and nobody else receives anything.

How long it is kept

Account and profile data stay for as long as the account exists. Closing an account takes it and its profile off the site at once and keeps everything for 30 days, so that logging back in undoes it; after that it is deleted for good, images included. Reach figures belong to the profile and go with it. Backups are kept in rotation and the oldest are removed as new ones are made, so a copy of something deleted disappears with the backup that held it. Server logs are kept for the short period the hosting provider retains them. Where the law requires something to be kept for longer, a record of a report about unlawful content for instance, it is kept for that long and used for nothing else.

Children

This site is for adults. Nobody under 18 may open an account or use it, and no data is knowingly processed about anybody under that age. An account found to belong to a minor is closed and its data deleted.

What you can ask for

You have the right to know what is stored about you (Art. 15), to have it corrected (Art. 16), to have it deleted (Art. 17), to have its use restricted (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where anything is ever done on the basis of consent, you can withdraw that consent at any time, without affecting what was done before. Write to hello@nwty.me and you will get an answer.

You have the right to object at any time, on grounds relating to your particular situation, to processing carried out on the basis of a legitimate interest.

You can also complain to a data protection supervisory authority: in Germany, the one for the state where the operator is based, or the one where you live.