Privacy Policy

Last updated 22 Aug 2026 · Data controller: UPFOLLOW, A RENSEIGNER · SIREN 850 073 172

What we collect

When you place a bid

The link you submit, the category, your description, and the amount. Payment itself happens on PayPal's side — we never see your card number. PayPal sends us back the e-mail address of the payer and a transaction identifier, which we keep as proof of payment.

When you create an account

Your name, e-mail address, and a hashed password. We cannot read your password.

When you upload a photo

The image is re-encoded on our server, which strips its metadata — including any GPS coordinates your phone may have written into it.

When you simply visit

We count visitors and clicks. To do that without identifying anyone, your IP address is hashed with SHA-256 and a secret key, and only that hash is stored. We cannot go back from the hash to your IP address, and we never store the address itself.

Cookies

Three cookies, no advertising or tracking cookie, no third-party analytics:

• session — keeps you logged in;
• XSRF-TOKEN — protects forms against cross-site request forgery;
• ofr_lang / ofr_theme — remember your language and light or dark mode.

All three are strictly necessary or purely functional, which is why no consent banner is shown.

Why we are allowed to do this

Bids and payments

Performance of the contract between you and us

Accounts

Performance of the contract

Visit and click counts

Legitimate interest in measuring the audience, with data reduced to an irreversible hash

Payment records

Legal obligation — French accounting law requires ten years

Reports and moderation

Legal obligation and legitimate interest in keeping the service lawful

How long we keep it

• Listings: as long as they are online, then 12 months
• Payment records: 10 years (accounting obligation)
• Accounts: until you delete yours
• Presence hashes: 24 hours
• Visit hashes: 6 months
• Reports: 3 years

Who else sees your data

• PayPal (payment) — PayPal Europe, Luxembourg
• OVH (hosting) — servers in France

We do not sell your data, and we do not share it for advertising purposes.

Your rights

You can ask for access to your data, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to privacy@onlyfansrank.lol — we answer within one month.

If you are not satisfied, you can complain to the CNIL, the French data protection authority (cnil.fr).

Security

The site runs over HTTPS. Passwords are hashed with bcrypt. IP addresses are only ever stored hashed. Access to the administration is restricted to named accounts.