Privacy policy

1. Who is responsible for your data?

Young & Naughty B.V., a company established in the Netherlands and registered with the Dutch Chamber of Commerce under number 88574423, is the controller of the personal data described in this notice.

You can contact us about privacy or exercise your rights at team@youngnaughty.net. Our registered details are also available from the Dutch Trade Register.

This notice is for website visitors, players who report bugs, and end users who connect Patreon to access rewards. Creator, developer, and project-management data is handled under the applicable working relationship or agreement and is outside this notice.

2. Information we process

When you visit the website

Cloudflare receives technical request information needed to deliver and protect the website. This can include your IP address, requested URL, date and time, browser and device information, network information, approximate location, and security signals. We use Cloudflare’s standard aggregate visitor and page-view figures. We do not use this information to build advertising profiles.

For a download request, Cloudflare provides the country and, where available, region associated with the request. We use this transiently to apply legal distribution restrictions. Our application does not save that location with your account or download count.

Information stored in your browser

• Adult-content warning acknowledgement: yn-adult-content-acknowledged-v2 is a flag stored only in your browser after you acknowledge the warning, state that you may legally view adult material, and agree to our Terms of service. The flag contains no identity or timestamp and is not sent to or stored by us on our servers or with your account. We do not ask for or store your date of birth.

This acknowledgement remains in local storage until you clear this website’s data. If storage is unavailable, the acknowledgement may last only for the current page. The display language is selected through the page URL, not local storage.

When you sign in with Patreon

Patreon provides the narrow identity and membership information needed to identify you and determine your rewards. We receive your Patreon user ID, vanity name or full name, campaign memberships, membership status, and currently entitled tier information, including tier titles, identifiers, and amounts.

We retain only an internal user identifier, your Patreon user ID, the display name shown in the interface, and project-specific reward records with grant and expiry dates. Membership and tier details are used to calculate those rewards but are not otherwise retained as a copy of your Patreon account. The access token used for ordinary end-user login is not persisted.

Sessions and downloads

After login, we set an essential yn_session cookie. It is HTTP-only, Secure, SameSite=Lax, and expires after 24 hours. The server stores a one-way hash of the random session token, not the token itself. Temporary OAuth security records expire after ten minutes.

When an authorized download link is issued, we add one to an aggregate daily count identified only by project, release version, and file label. We do not include your user ID, Patreon ID, IP address, or location in that count. Protected files are made available through a short-lived Cloudflare R2 link.

When you contact us or report a bug

If you contact us by email or Discord, we process your account or contact details, message, and any information you choose to include so we can respond.

A bug report may include diagnostic information such as a stack trace, software and device details, logs, screenshots, and a save file. Save files contain information about your progress and choices and may include a character name; if you used your real name as a character name, the save file will therefore contain it. Diagnostic information may also incidentally contain personal data. Please avoid including information that is not needed to investigate the issue.

You may send a bug report by email or Discord or, where a release provides the option, upload it directly from the release. We use the report and its attachments to reproduce, track, and resolve the issue. Reports may be copied into our private Trello issue tracker.

3. Why we process information

We do not use personal data for marketing, advertising, cross-site tracking, behavioral profiling, or sale. We do not share personal data for cross-context behavioral advertising.

4. Who receives information?

We disclose information only as needed to operate the service:

• Cloudflare provides network delivery, security, Workers computing, D1 database storage, R2 file storage, and basic traffic measurement. See Cloudflare’s privacy policy.
• Patreon independently operates the login and membership service. Information you provide directly to Patreon is governed by Patreon’s privacy policy. Patreon sends us information only after you choose to connect your account.
• Microsoft provides Microsoft 365 email when you contact us. See Microsoft’s privacy statement.
• Discord provides the communication service when you contact us or report a bug through Discord. Discord independently handles your Discord account and service activity under Discord’s privacy policy.
• Atlassian provides Trello, which we use as a private issue tracker for bug reports and associated diagnostic material. See Atlassian’s privacy policy.
• Professional advisers, courts, regulators, law enforcement, or other parties may receive information where reasonably necessary to establish or defend rights, protect people or the service, or comply with law.

We do not permit service providers to use our customer data for their own advertising.

5. International processing

We are based in the Netherlands and configure our primary Cloudflare D1 and R2 storage for the European Union. Cloudflare operates a global network, and Cloudflare, Patreon, Microsoft, Discord, or Atlassian may process information in countries outside the European Economic Area.

Where required, transfers are protected by an adequacy decision, the EU Standard Contractual Clauses, participation in an applicable data-transfer framework, or another lawful safeguard. You may contact us for information about the safeguard applicable to your data.

6. How long do we keep information?

• Your login session is valid for no more than 24 hours, and OAuth security records are valid for no more than ten minutes.
• We automatically delete your internal account, Patreon identifier, display name, sessions, and project-specific reward records one calendar month after your last dated reward or access perk expires. If your account has never had a perk, we instead delete it one calendar month after your last Patreon login. The month allows time for membership reporting delays, corrections, and renewed access. A non-expiring project access perk prevents this automatic deletion while it remains assigned. You may ask us to delete eligible account data earlier.
• Browser preferences remain until you clear this website’s local data.
• We delete ordinary correspondence when the enquiry has been handled. Deletion from a provider’s backups and recoverable systems may take additional time under that provider’s service-retention processes.
• We may retain a bug report, including relevant correspondence, stack traces, logs, screenshots, and save files, in Trello for up to one year after the issue is marked resolved. We then delete the report and associated diagnostic material unless we need to retain narrowly necessary information for one of the reasons below.
• Aggregate download counts may be retained indefinitely because they do not identify or single out a person.

We may retain narrowly necessary information for longer where law requires it or while needed for a legal claim, security investigation, or unresolved dispute. We then delete or anonymize it when that need ends.

7. Your rights

Depending on the law that applies to you, you may ask us to:

• confirm whether we process your personal data and provide access to it;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to processing;
• provide data you gave us in a portable format; and
• withdraw consent at any time where processing is based on consent.

Email team@youngnaughty.net to make a request. We may ask for information reasonably necessary to verify that the account is yours. Deleting or restricting account data may prevent us from verifying your rewards or providing protected downloads.

You may also complain to your local data-protection authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens.

8. Automated checks

The service automatically compares Patreon membership information, active reward records, release rules, and request location to decide whether a protected file can be offered. These checks are necessary to operate downloads and are not used to profile you for advertising. If you believe a result is wrong, email us and a person will review it.

We do not otherwise use solely automated decision-making intended to produce legal or similarly significant effects about you.

9. Adults only

This website publishes and provides downloads for adult-oriented creative works, including story-led interactive works, some of which contain highly sexually explicit scenes. Access is strictly limited to adults who may legally view and obtain that material where they live. This factual description is not intended to limit our catalogue to a particular medium or genre or to assign the projects to any particular legal classification, which may vary by jurisdiction. We do not knowingly provide accounts or protected content to minors. The adult-content warning asks visitors to acknowledge that they may legally view the material; it does not verify age, and we do not ask for or store a birth date. If you believe a minor has provided us with personal data, contact us so we can remove it.

10. Security and changes

We use proportionate technical and organizational safeguards, including encrypted connections, hashed session and gift-code secrets, short-lived download links, and access controls. No internet service can guarantee absolute security.

We may update this notice when the service or law changes. We will publish the revised notice here, change its effective date, and provide a more prominent notice when a change materially affects how we use personal data.

11. Contact