floofgens.net · Operated by Bordssalt · Last updated: 2026-11-12

Too Long, Didn't Read

We collect only the bare minimum amount of information that is necessary to protect the service against abuse. We do not sell your information to third parties, and we only use it as this document describes.

1. Who we are

This Privacy Policy explains how Bordssalt, a Swedish non-profit association (ideell förening) with its seat in Gothenburg, Sweden ("we", "us"), handles personal data on floofgens.net (the "Website"). We are the data controller under the EU General Data Protection Regulation (GDPR) for the personal data described here. We have not appointed a data protection officer.

"Personal data" means any information that can identify you directly or indirectly, such as your email address, IP address or username.

You can reach us about anything in this policy at contact@floofgens.net.
The Website is only for people who are 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please tell us and we will act on it.

2. What we collect and why

We collect only what we need to run the Website.

Account data. When you register, we store your username, email address, a hashed password (we never store your password in readable form), your settings and the IP addresses you use. We use this to create and secure your account, to let you log in, and to contact you about your account or about moderation decisions. We use your email only for account messages such as confirmation, password reset and moderation notices, never for marketing. Your username is shown publicly next to what you post. Legal basis: contract (Article 6(1)(b) GDPR).

Content and activity. Uploads, tags, descriptions, comments, forum posts, notes, wiki edits, votes, favorites and similar activity connected to your account. Uploads, tags, comments, forum posts, notes and wiki edits are public and linked to your username, and where the Website is open to visitors without an account, they are visible to the public. Do not post personal data you do not want to be public. With each new contribution we store the IP address it came from, so that we can act on abuse or illegal content (Article 6(1)(f) GDPR). Uploads must be approved by our staff; an upload that has not been approved within 30 days is removed automatically. Content imported from the previous site carries no IP addresses.

Metadata in uploaded files. Files can contain embedded metadata, such as EXIF data or AI generation settings (prompts, models, parameters). As explained in our Terms of Use, this metadata is kept as part of the post: it is public and can be searched. Please remove anything you do not want to share before uploading. If your upload contains personal information by mistake, we will remove the metadata on request.

Private messages. Private messages are stored together with the sender's IP address and are visible only to the sender and the recipient. Our staff may read a message only when it is reported or when it is needed to investigate abuse.

Favorites, votes, blacklists and saved searches. On an adult art site, your favorites, votes, blacklisted tags and saved searches can reveal personal preferences, including sexual preferences. This is a special category of data under Article 9 GDPR, so we treat it with extra care. Favorites and votes are private by default and become visible to others only if you choose to make them public. We use this data only to provide the features you use; we do not analyze it, build profiles from it or share it with anyone. By making your favorites public, you choose to make this information public yourself (Article 9(2)(e) GDPR).

Technical data and server logs. When you visit the Website, our servers and Cloudflare record technical data: IP address, date and time, the page requested, referrer, browser and operating system. We use this to keep the Website running and secure, to find and stop abuse, spam and attacks, to enforce bans, and to fix errors (Article 6(1)(f) GDPR). We do not combine it with other data.

Bot check at signup. At signup we use Cloudflare Turnstile to check that you are a human and not a bot. Turnstile processes your IP address and technical browser signals and sends them to Cloudflare. This protects the Website from spam and automated abuse (Article 6(1)(f) GDPR).

Account emails. Confirmation and password reset emails are sent through Mailgun, using its EU region. Mailgun receives your email address and the content of the message only to deliver it (Article 6(1)(b) GDPR).

Reports, takedown requests and moderation records. When someone reports content or sends a takedown request, we process the report, the information in it (including the sender's name and email address if they gave them, and any proof of rights) and our decision. We need this to handle the request, to meet our duties under the EU Digital Services Act and to defend legal claims (Article 6(1)(c) and (f) GDPR). We keep records of moderation actions, such as the reason for a removal, the account concerned and any appeal. To block re-uploads of removed files we store file fingerprints (hashes) of them.

Illegal content. If content is removed because it is or may be illegal, we keep a record of it (post ID, uploader account, IP address, time and file fingerprint) so that we can report it and cooperate with the authorities (Article 6(1)(c) and (f) GDPR). The file itself is not kept.

Information about artists and creators. We keep artist and creator pages with names, handles and links to their public profiles, so that works can be attributed correctly. This information comes from public sources or from users (Article 6(1)(f) GDPR). If a page is about you, you can ask us to correct or remove it, or object to it, at contact@floofgens.net.

Staff applications. If you apply to join our staff, we process the answers you submit only to decide on your application (Article 6(1)(b) GDPR).

Contacting us. If you email us, we store your message and contact details to answer it (Article 6(1)(f) GDPR, or (b) if it concerns your account).

Cookies. We use only cookies that are strictly necessary for the Website to work: your login session, "remember me", your acceptance of the Terms of Use, and your display settings. We do not use advertising or tracking cookies, and we use no analytics, so no cookie banner is needed under chapter 9, section 28 of the Swedish Electronic Communications Act (2022:482). You can block or delete cookies in your browser, but logging in will then not work.

What we do not do. We do not sell personal data, we do not show ads, we do not use analytics, tracking or social media plugins, and we do not use your data to train AI models. The Website loads no content from third-party domains other than Cloudflare.

3. Legal bases

Under the GDPR we rely on the following:

Contract (Article 6(1)(b)): to provide your account and the features you use under our Terms of Use.
Legitimate interests (Article 6(1)(f)): to keep the Website secure, to prevent abuse, spam and ban evasion, to moderate content, to enforce our Terms of Use and to handle disputes. We have weighed these interests against your rights and we keep the data we use for this to what is necessary.
Legal obligation (Article 6(1)(c)): to meet requirements in law, for example the EU Digital Services Act and Swedish rules on illegal content, and to answer lawful requests from authorities.
Consent (Article 6(1)(a)): only where we ask for it explicitly. You can withdraw it at any time without affecting earlier processing.
Data you make public yourself (Article 9(2)(e)): where you choose to make favorites or votes public.

4. Who has access to your data

Our staff. Our volunteer staff can see the data they need for moderation and administration. They are bound by confidentiality. IP addresses and email addresses are never shown publicly or in our API, and only administrators can search them.

Service providers. We use a small number of service providers (processors). They handle data only on our instructions and under data processing agreements that meet GDPR requirements. We do not sell your data or share it for advertising.

Worldstream B.V. (Netherlands): server hosting. All content and account data is stored on servers in the Netherlands.
Hetzner Online GmbH (Germany): storage of encrypted backups.
Our technical partner (Germany): operates and maintains the servers on our behalf.
Cloudflare, Inc. (USA): all traffic between your browser and our servers passes through Cloudflare's network, which delivers the Website, filters malicious traffic (DDoS protection) and runs the bot check at signup (Turnstile).
Mailgun Technologies, Inc. (USA, EU region): sends account emails (confirmation and password reset).

Transfers outside the EU/EEA. Cloudflare and Mailgun are US companies. Transfers to them are protected by the EU-US Data Privacy Framework and Standard Contractual Clauses. All other data is stored within the EU/EEA.

Authorities and legal claims. We may disclose data where the law requires it, for example to police or other authorities, or where it is necessary to establish, exercise or defend a legal claim. We may report clearly illegal material, including suspected child sexual abuse material, to the authorities.

Links to other services. We link to our Discord server and social media accounts. These are plain links, so no data is sent when you load the Website. If you join or contact us there, the platform's own privacy policy applies. Messages you send us there may be used to answer your request.

Others. We do not share your data with advertisers or data brokers. If the association is ever reorganized or wound up, we will make sure that any transfer of the Website respects this policy.

5. How long we keep data

Account data (email, profile text, avatar, settings, favorites, saved searches, direct messages. API keys): until you delete your account. After that it is removed, except where we must keep something for a legal reason or for an ongoing dispute.
IP addresses linked to an account: 1 year after last use, to detect ban evasion and abuse. This record is kept for the same period even after you delete your account.
Former usernames: 1 year after the change or account deletion.
IP addresses on contributions: 90 days. If a contribution is part of a moderation case, we may keep the related IP addresses for up to 1 year.
Server logs: 14 days.
Error logs: 1 year.
Backups: 30 days. Deleted data may remain in backups until they expire.
Content you posted: uploaded media and comments are part of the Website's archive and stay until our staff remove them, as described in our Terms of Use.
Private messages: kept as long as the recipient’s account exists. After you delete your account, the messages you sent stay in the recipients.
Votes: for as long as the post they relate to stays on the Website. After you delete your account, they stay under your anonymous ID.
Moderation records: a record of a post (such as tags, uploader and the reason for removal) is kept for moderation purposes, and files of removed content are permanently deleted after 6 months unless needed for an appeal or legal dispute. Clearly illegal material is destroyed immediately; only the record described under "Illegal content" above is kept, until the authorities' investigation is closed. We review these records at least once a year and delete them when they are no longer needed. File fingerprints used to block re-uploads and records about bans and repeated violations are kept for as long as they are needed to prevent abuse.
Reports, takedown requests and appeals: 1 year after the case is closed (including any appeal), or longer if a legal dispute is ongoing.
Staff applications: 6 months after the decision.
Emails you send us: until the matter is closed, unless we must keep them longer.

When you delete your account, we remove your email address, profile text, avatar, settings, favorites, saved searches and API keys, and rename the account to an anonymous ID. What stays:

Content you posted stays on the Website under that anonymous ID, and your username is replaced by it. This is also stated in our Terms of Use.
Your votes stay linked to the anonymous ID so that vote counts remain correct.
Private messages you sent stay in the recipients' inboxes unchanged, because they also belong to the recipient's conversation. They may still show your former username in the text.
Moderators can still see your former username for 1 year, to enforce bans.

If you want votes or specific content removed as well, contact us at contact@floofgens.net.

6. Your rights

Under the GDPR you have the right to:

get confirmation of whether we process data about you, and a copy of it (access);
have incorrect data corrected (rectification);
have your data erased in the cases the law provides for (erasure);
restrict our processing in certain cases;
object to processing that we base on legitimate interests;
receive the data you gave us in a common format, where processing is based on contract (portability).

You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We will then stop unless we have compelling legitimate grounds, or need the data to establish, exercise or defend legal claims.

To use these rights, write to contact@floofgens.net. We may need to verify that the request really comes from you, for example by asking you to write from the email address linked to your account. We answer within one month. This period can be extended where the law allows, and we will tell you if so.

Please note that your rights are not unlimited. Content you have posted on the Website is public and part of a shared archive, and we cannot always remove it, for example where it is needed for moderation records, for legal reasons or to protect others' rights. We assess each request individually and explain our decision.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se.

7. Security

We protect your data with technical and organizational measures, including HTTPS (TLS) encryption of all connections, hashed passwords, encrypted backups, restricted staff access and regular updates of our systems. No online service can be completely secure. If a data breach affects you in a way that the law requires us to report, we will notify you and the authorities as required.

8. Changes to this policy

We may update this policy when our practices or the law change. The current version is always on this page, and the date at the top shows when it was last updated. We will announce significant changes on the Website before they take effect.

9. Contact

Bordssalt, Gothenburg, Sweden
Privacy questions, requests and complaints: contact@floofgens.net