Privacy policy

This policy explains what personal information spicy.fm collects, why, who we share it with, how long we keep it and the choices you have. spicy.fm is run by Spicy FM LLC, a limited liability company organized in Nevada, USA ("spicy.fm", "we", "us"), which is responsible for your information.

We don't sell your personal information, and we don't show third-party ads.

What we collect

Information you give us

• Account details: email address, display name, handle, password (stored only as a secure hash), passkeys, two-factor authentication settings, language and the country you tell us you live in.
• Your content: posts, photos, videos, audio, live streams, messages, comments, wish lists, and anything else you upload or send.
• Support and complaints: what you write to us and any files you attach.
• Creators and co-performers: legal name, date of birth, photos of a government ID and a selfie for the identity check, consent records for everyone who appears in content, payout details, and tax forms.

Information collected when you use spicy.fm

• Sign-in and device information: when and from which browser and device you sign in, a device identifier kept in a cookie, and your IP address.
• Approximate location: the country and region your connection comes from, provided by our network provider. We use it to follow local laws (age checks, blocked places, sales tax) and to let creators block places.
• Activity: what you subscribe to, buy, like, save and watch, and when you were last active (others only see this if you allow it).
• Payments: what you bought and when, the amount and tax, and limited card details from our payment partners (such as card type, the last four digits, the issuing country and a fingerprint that lets us spot repeated use of the same card). We never see or store your full card number.

Information from others

• Payment partners tell us whether a payment went through, was refunded or was disputed.
• Identity and age check providers tell us whether a check passed, with the details needed to prove it.
• If you sign in with Google or X, they share your name and email address with us.

Why we use it

• To run spicy.fm: your account, content, subscriptions, purchases, messages, live features and payouts. (Performing our contract with you.)
• To keep people safe and follow the law: age and identity checks, consent records for everyone in content, record-keeping under 18 U.S.C. 2257, content screening, handling complaints, reporting child sexual abuse material to NCMEC, tax, and answering lawful requests. (Legal obligations, and our legitimate interest in a safe service.)
• To prevent fraud and abuse: spotting stolen cards, chargeback abuse, linked accounts that get around blocks, spam and scraping. (Legitimate interests, and legal obligations from card networks.)
• To talk to you: emails about your account, purchases, security and changes to our terms, and notifications you choose. (Contract; you can turn most notifications off.)
• To improve spicy.fm: counts and statistics about how the site is used, without third-party analytics. (Legitimate interests.)

Who we share it with

• Creators you interact with see your display name, handle and what you send them, and creators see who subscribes, buys and tips. They don't see your email address or card details.
• Service providers who work for us under contract and only on our instructions: hosting and storage (DigitalOcean, Cloudflare), email delivery (SendGrid), payment processing (CCBill, Segpay), identity checks (Veriff) and age checks. Each gets only what it needs.
• Agencies a creator works with, and the creator's team members, see what the creator lets them see. Every action they take is recorded.
• Authorities: NCMEC for suspected child sexual abuse material, and law enforcement or courts when the law requires it or when someone is in danger.
• A buyer of spicy.fm, if the business is sold, under this policy.

Where your information goes

We are based in the United States and our providers store data in the United States and other countries. When we move personal information out of the UK, the EU or another region with transfer rules, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Your account: until you delete it. A deleted account is closed at once and erased after 30 days.
• Content: until you or we delete it, except copies others have bought, which stay available to them, and content we must keep as evidence.
• Payment records: as long as tax and accounting laws require, usually 7 years.
• Identity checks and consent records for creators and co-performers: as long as 18 U.S.C. 2257 and other laws require, which can be 7 years or more after the content was made.
• Security and fraud records: up to 3 years, longer if needed for a legal claim.
• Content removed because it broke the law: held for a limited time as evidence, then deleted for good.

Your choices and rights

You can see and change most of your information in your account settings, download a copy of your data from your account, and delete your account.

Depending on where you live (for example in the UK, the EU, or US states such as California), you may also have the right to: know what we hold about you, get a copy, correct it, delete it, limit or object to how we use it, take it elsewhere, and withdraw consent. We don't sell or share personal information for cross-context behavioral advertising. To use these rights, write to privacy@spicy.fm or use the Contact page. We'll answer within the time the law sets, and we won't treat you differently for asking. You can also complain to your local data protection authority.

Security

We protect your information with encryption in transit, hashed passwords, two-factor authentication and passkeys, strict access controls for staff (who must use two-factor authentication), signed links for private media, and logs of who looks at sensitive information. No system is perfect, so please use a strong, unique password and turn on two-factor authentication.

Children

spicy.fm is only for adults. We don't knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we close it.

Changes

When we change this policy in a way that matters, we post the new version here ahead of time and tell you. Earlier versions stay readable on this page.

Contact

Privacy questions and requests: privacy@spicy.fm, or the Contact page.