Privacy Policy

1. What we collect

When you create an account

• Email address, username and display name.
• Your password, stored only as a one-way hash; we cannot read it. If you turn on two-step verification we store its secret key.
• Anything you add to your profile: bio, profile and cover images, pinned post.

When you use the site

• Sign-in sessions: a short device description (for example “Chrome on macOS”, not your full browser string), the IP address, and when the session started and was last used. You can see and end these in Settings.
• Your activity: likes, reactions, comments, follows, collections, saved searches, blocks, notifications and reports you file.
• Private messages: stored so they can be delivered. Moderators read a conversation only if it is reported. The site owner may read a conversation for moderation and safety; every read is logged.
• Impressions: which posts were shown to which account. Creators see these only as totals, never as a list of viewers.
• Watermark codes: when you view a post while signed in, the copy you receive carries a code tied to your account and that post. We use it only to find the source of a leaked copy when a creator reports one.
• Server logs: IP address, requested page, time and browser type, kept for a short period for security and rotated automatically. Rate limiting holds IP addresses in memory for a few minutes.

When you post

• The files and text you upload.
• Your declaration that everyone shown is 18 or older and consented. We do not collect or store dates of birth or identification documents; the declaration is yours and your responsibility only. See the 2257 statement.

When you contact us or send a notice

Your name, email and what you tell us, including copyright notices and their tracking numbers.

2. Why we use it

• To run your account and deliver the site: sign-in, feeds, messages, notifications.
• To keep people safe: moderation, handling reports, preventing abuse and fraud, and tracing leaked copies.
• To meet legal duties: age and consent records, responding to lawful requests, and reporting child sexual abuse material to the authorities.
• To show creators how their posts perform, as totals.

Where the law asks for a legal basis (for example the GDPR), we rely on the contract with you (running your account), our legal obligations (records and reports), and our legitimate interest in keeping the site safe. We do not use your information for advertising.

3. Cookies and browser storage

We only use what the site needs: the cookies below are either strictly necessary to run the site or preferences you set yourself, and none is for advertising or tracking. There are no advertising or analytics cookies: visits are counted by Plausible Analytics without cookies, from an anonymous daily hash that can’t identify you, and Cloudflare Web Analytics measures how fast pages load, also without cookies.

• longsesh_session: keeps you signed in (up to 30 days).
• longsesh_age_ok: remembers that you confirmed you are 18 or older.
• longsesh_access: remembers the access code while the site is in closed testing.
• longsesh_hidden_tags: the tags you chose to see less of.
• longsesh_orientations: who you want to see (straight, lesbian, gay, trans), if you picked.
• longsesh_seen: when you last opened the categories you follow, for the “new” counts.
• longsesh_picks and longsesh_onboarded: the categories you picked on your first visit, and that you answered or skipped that question.
• longsesh_more and longsesh_hidden_creators: categories you asked to see more of, and creators you hid from your feeds (listed under Your feed on the Categories page).
• longsesh_quiet and longsesh_display: your quiet hours for badges, and display choices (text size, motion, true black, autoplay, data saver).
• longsesh_taste: the kinds of clips you have been watching (categories and tags, with a weight each), so your feeds lean your way. It lives in your browser and goes with each page request; we don’t keep it on our side. Clearing your cookies resets it.
• longsesh_viewed: short marks for the last 100 clips whose view was counted from this browser, so a clip counts one view from you, not one per visit (a day).
• longsesh_seed: a random number for this visit, so the shuffle is new each time.
• longsesh_mode: for the site’s staff only, whether they see the site in admin or user mode.
• longsesh_shown: short marks for the clips already shown to you in the last week, so the feed doesn’t repeat them (a preference, kept in your browser).
• longsesh_join, longsesh_claim and longsesh_joined: necessary while you apply as a creator or sign up. They keep your place in the form for up to an hour (longsesh_claim, longsesh_join) or tell the next page, for ten minutes, that you just signed up (longsesh_joined). They hold no personal details.
• ls_pending: necessary. A ticket for the one action (save, like, follow, rate) you asked for before signing in, so it happens once you are in. It expires after five minutes and is used up at once.
• ls_creator_ref: a creator’s referral code, kept for 30 days when you open a creator’s invite link, so a later sign-up is credited to them. It is not an advertising or tracking cookie, and you can clear it at any time.
• ls_clip_kept, ls_money, longsesh_2step_later and longsesh_admin_theme: for the site’s staff only (a form kept for two minutes, a protected money session, the “set up two-step later” choice, the panel’s colour theme). Visitors never receive them.

When a clip starts, plays on, finishes or is skipped, the site adds one to that clip’s counts, to rank clips. Nothing about who watched is sent or kept with it. A click on a creator’s link elsewhere adds one to that creator’s daily count the same way.

Your watch history, the “pick up where you left off” card, the spot you stopped at inside a video, your recent searches, your play queue, player settings like sound and speed, and the session timer are kept in your browser's own storage (local storage). They are never sent to us, and clearing them in History or in your browser removes them for good.

The local storage entries all start with longsesh:. The main ones:

• longsesh:history and longsesh:last-post: what you watched, and the clip the “pick up where you left off” card shows.
• longsesh:positions: where you stopped inside each video.
• longsesh:taste: this device’s copy of the kinds of clips you watch, which keeps the longsesh_taste cookie up to date.
• longsesh:seen: the clips Session has already shown you, so it never repeats one. When Session asks for more clips it sends this list along, only to leave those clips out; we don’t store it.
• longsesh:one-screen and longsesh:multi-columns: whether Session opens on one screen or several, and how many.
• longsesh:queue, longsesh:recent-searches, longsesh:volume, longsesh:sound and longsesh:speed: your play queue, your recent searches and the player’s settings.
• longsesh:age-ok and longsesh:orientation-ok: that you confirmed you are 18 or older, and that you chose to see a page outside your orientation setting.

4. Who else handles it

We share information only with services that help run the site, under contract:

• OVHcloud: servers and database, located in Quebec, Canada.
• Cloudflare: sits between you and our server to keep the site fast and protected from attacks. It sees your IP address and the pages you request, as any such network does, and measures page speed without cookies.
• bunny.net: stores and delivers images and videos from servers in several countries so they load quickly.
• Proton: our email, when you write to us, and the emails we send you: a link to reset your password, and, if you follow creators or categories, a weekly email of what’s new from them, which one click at its end turns off.
• When they are introduced: an age-assurance provider (to verify age where the law requires it) and a payment processor (for paid features). This page will name them.

We also disclose information when the law requires it, to report child sexual abuse material, or to protect someone from serious harm. Because some providers operate outside Canada, your information may be processed in other countries under their laws.

5. How long we keep it

• Account information: while your account exists.
• Sign-in sessions: until you sign out, end them in Settings, or 30 days pass.
• Server logs: a short period, rotated automatically.
• When you close your account we delete or anonymise your information within 30 days, except what the law or safety requires us to keep: age and consent records for posted material, moderation and enforcement records, and copyright notices. Backups roll over within a limited time.

6. Your choices and rights

You can edit your profile, end sessions and block people or tags yourself. You can also ask us to give you a copy of your information, correct it, close your account and delete it, or withdraw consent where we rely on it. Write to hello@longsesh.com from the email on your account; we answer within 30 days.

Depending on where you live you may have further rights, and you can complain to the Office of the Privacy Commissioner of Canada or your local data protection authority.

7. Security

Connections are encrypted, passwords are hashed, media files are served only after an access check, and only moderators can see age and consent records. No system is perfectly secure; if a breach puts you at real risk of significant harm we will tell you and the regulator as the law requires.

8. Minors

The site is for adults only. We do not knowingly collect information from anyone under 18; if we learn that we have, we close the account and delete it, apart from records we must keep to report abuse.

9. Changes and contact

We will post changes here with a new effective date. Privacy questions: hello@longsesh.com. By post: Longsesh Media Inc., 997 Seymour St., Vancouver, BC V6B 3M1, Canada.