Privacy Policy

Draft, 2026-10-22. Items in [brackets] still need to be filled in. Review with legal counsel before publishing.

HankySpanky ("we") is operated by [company name, organisation number, address], Sweden, which is the data controller for the personal data described here. Contact: [privacy email].

What we collect

  • Account data: nickname, email address, password (stored hashed), gender you register as, date of birth.
  • Profile data you choose to add: photos, videos, location, relationship status, body details, orientation, kinks, free-text presentations, diary posts and forum posts.
  • Communication: messages, likes, friend requests and blocks.
  • Technical and log data: IP address, username, the pages and actions you request, time and browser type. Every request to the site is logged this way.
  • Payment data: handled by Stripe. We store your Stripe customer number, your plan and its status, and when you asked VIP to start. Card details stay with Stripe; we never see them.
  • Reports: when you report something, we store your report, your IP address and a copy of the reported content as evidence. The reported member is not told who reported them.

Sensitive data

Information about your sex life and sexual orientation is special category data under the GDPR (Article 9). We only process it because you give explicit consent when you register. You can withdraw that consent at any time by removing the information from your profile or deleting your account.

Why we process data and on what legal basis

  • To provide the service and your account: performance of our contract with you.
  • Sensitive profile information: your explicit consent.
  • Security, abuse prevention, enforcing our rules and keeping logs: our legitimate interest in a safe service.
  • Keeping original uploads and logs as evidence, and answering lawful requests from the police: our legitimate interest and legal obligations.
  • Payments and bookkeeping: contract and legal obligation (Swedish Bookkeeping Act).

Uploaded photos and videos

We remove location and camera metadata (EXIF) from photos and videos before they are shown. We keep an unmodified original copy that only authorised staff can access, solely for handling abuse reports and lawful requests from law enforcement. Originals are deleted 12 months after you delete the file or your account, unless they are needed for an ongoing investigation.

Moderation and access to messages

Private messages are stored on our servers. Authorised administrators can open any private conversation to enforce our rules, investigate reports and abuse, and answer lawful requests from the police. An administrator must state a reason before opening a conversation, and every opening is logged with who did it, when, from which IP address and why. Messages are kept until the conversation's members delete their accounts, and for as long as needed for an ongoing investigation.

How long we keep data

  • Account and profile data: until you delete your account.
  • Request and audit logs with IP addresses: 12 months.
  • Original uploads: see above.
  • If you are banned we keep a one-way hash of your email address permanently to prevent re-registration, and block your IP addresses from registering for 7 days.
  • Payment records: 7 years as required by Swedish bookkeeping law.

Who we share data with

  • Other members see what you put on your profile, according to your visibility settings.
  • Service providers acting on our behalf: hosting [provider], email [provider], Stripe for payments.
  • The Swedish Police Authority when we receive a lawful request. See our Law Enforcement Cooperation page.

We do not sell your data and do not use third-party advertising or tracking. Our bot check runs on our own server.

Your rights

You have the right to access, correct, delete and export your data, to object to processing based on legitimate interest, and to withdraw consent. Contact [privacy email]. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.