Your privacy.
Your choices.

This notice describes the current invitation-only Cumby test. Last updated 19 October 2026.

What the test stores

We store your email address, password hash, display name, date of birth, profile details, photos, likes, blocks, messages and reports. Date of birth is used to calculate age and check your declaration that you are an adult. Your full date of birth and email are not shown on member profiles. Administrators can view account email addresses and calculated ages to manage the test.

Information about your interests

Participation in a men’s dating community and any preferences you choose to share may reveal sexual orientation or other sensitive personal information. Account creation asks for your explicit consent to process this information for your profile and community interactions. You can leave optional fields blank, hide your profile, remove photos, or withdraw consent by deleting your account.

Who can see what

Signed-in members with confirmed emails can see active, visible profiles and approved photos. People in a blocked relationship cannot view each other’s profiles, photos or conversations through the application. Administrators review uploaded photos and reports, and can suspend members. Administrators and the hosting operator may technically access stored data; messages are not end-to-end encrypted. Do not treat this test as a confidential vault.

Hosting and email

The application and database are hosted with the JustHostMe hosting account selected by the project owner. Account confirmation and password reset emails use the hosting provider’s email service. Hosting infrastructure may retain security and access logs under its own settings. The application hashes IP-based rate-limit keys and automatically clears expired rate-limit records over time.

Membership allowances and optional visitors

Existing accounts start on Free. We store which different profiles you open each day to enforce the plan’s daily allowance and avoid counting repeat visits twice. Allowances reset at midnight in the timezone shown in your account. Daily view records older than seven days are cleared during normal site use. Your view history is included in your account export.

Visitor sharing is recommended on, with an explicit first-use confirmation before it activates. Existing OFF choices are preserved. You can keep sharing off and still use the community. Only when both members confirm sharing can a visit appear. Free shows the latest 1 distinct visitor and Premium 50 within 30 days; administrators can configure these allowances. Turning sharing off removes shared records involving you. Blocks, hidden profiles and deletion restrict access.

Private profile access audit

Separately from shared visitors and daily quotas, we record signed-in access to other accounts: numeric viewer and target IDs, UTC timestamp, profile or full-photo request, whether access succeeded or was refused, and whether the viewer was an administrator. Repeated requests are separate events. Thumbnails and self-views are excluded. These application records do not store IP addresses, device information, email or name snapshots. Logging starts with this release; it cannot reconstruct earlier visits.

Sharing OFF does not disable this private safety record. Administrators can search it for harassment investigations and review a necessary, proportionate disclosure request. Police requests do not automatically release data: the operator must review the request, applicable legal basis and any special-category condition. Admin reads and scoped exports are logged, exports require a purpose, and export digests and event integrity checks help identify changes; these are not certified forensic records.

The current access-audit retention is 90 days, configurable by administrators between 7 and 365. Expired records are excluded immediately and deleted in batches during normal use and admin review. Numeric audit IDs remain for this period after account deletion. Hosting backups follow the operator’s separate schedule. Before public launch the operator must document Article 6 and Article 9 grounds, necessity, retention, disclosure procedures and the required risk assessment. This notice alone does not establish a lawful basis.

Opening a conversation marks its messages as read. Senders with access to read receipts can see that status. Saved searches, conversation pins, complimentary plan access and upgrade interest are stored against your account. When enabled, one-off Premium purchases use bank transfer with manual administrator approval. We store payment references, amounts, issued instructions and decision history. Financial records remain for six years after the later of payment, refund or access expiry, with the user link removed on account deletion. Private administrator notes are not included in the self-service export; contact support for access requests. No card details are collected and there is no automatic renewal. See the purchase terms for cancellation and refunds.

Interest categories and location

You can optionally select interest categories and enter your country, region and town. These appear on your profile and can be used in discovery filters. Previous free-text interests remain available. The site does not request GPS coordinates or send your location to a geocoding provider.

Winks and optional profile preferences

You can optionally display your position and Dom/vers/sub dynamic on your profile. These preferences may reveal sensitive personal information; leave either blank or remove it in the editor at any time. They are included in your account export. Profile preview shows your saved profile and approved public photos without publishing hidden profiles or counting a visit.

Winks are a separate, visible expression of interest alongside Likes. Receiving Winks starts enabled; switch it off in Account to stop new Winks, on any tier. You may still send Winks to members who receive them. We retain the latest Wink per pair, its time and read status for up to 90 days; expired Winks are excluded immediately and removed in batches during normal use. A member may send one Wink to the same recipient per 24 hours, up to 50 per UTC day. Daily anti-spam counters are kept for up to seven days and cleared in batches. Blocking hides Winks in both directions. Deleting an account removes its Winks and counters. Members who enabled device notifications may receive a generic activity alert. Winks never automatically create a Like, a match or a private album grant.

Private albums and photo messages

Private albums are shared only with named members for 1, 7 or 30 days, until revoked sooner. You can also share an individual approved photo from your own private album in a conversation. A photo message stores a reference and recipient permission, not a second copy of the image; it does not grant access to other album photos or to the album itself. New photo uploads belong in Albums and must be approved before they can be shared. Existing standalone photo-message attachments remain available under their previous access rules.

Stop sharing a photo with a person from the message or its album; this revokes that person’s message grants for that photo. Full-album grants remain separate: a person with whole-album access may still see the photo through that grant. Likewise, revoking a whole-album grant does not remove permissions for photos separately shared in messages. Blocking revokes message-photo grants and album access in both directions; unblocking does not restore these new grants. Removing the original photo or album makes referenced photo messages unavailable for everyone. Rejecting a previously approved photo also hides it from recipients.

Recipients must have an available, unblocked account. Administrators can review photos and investigate photo reports. These photos are not end-to-end encrypted. Recipients may save or screenshot an image; revoking access or deleting the original cannot recall copies. Photos remain non-explicit during the beta. Public and private album photos share your plan’s photo allowance and are stored once regardless of how often you share them. A separate daily photo-share limit protects against spam.

Deleting an account removes its conversations and photo-share records. Shared album originals remain with their owner when a recipient deletes their account, so other authorised recipients retain access. Deleting the owner’s account removes those originals. Account exports include metadata for photo shares you sent.

Optional device notifications

Notifications are off until you request and grant browser permission. We store a device subscription endpoint, encryption keys, registration times and an account/session reference. Browser push delivery uses your device provider (such as Apple, Google or Mozilla), which receives delivery metadata. Notification content is encrypted in transit to that service and contains only a generic Cumby activity alert, without names, message bodies or photos. The app name can still appear on your lock screen. Delivery is best effort and may be throttled or suppressed by the device.

Manage registered devices or disable all notifications in Account. Signing out removes subscriptions registered in that session; password changes invalidate older registrations. Account deletion removes subscriptions. Stale subscriptions can remain until you remove them or the provider rejects them. Use device settings to revoke browser permission. The installable web app’s service worker does not cache private pages, messages or photos and does not provide offline access to member information.

Keyword search allowances

Limited plans store a keyed fingerprint of each distinct keyword search and its allowance day, rather than the search text, to enforce daily limits. These records are deleted with your account and cleared after seven days through routine cleanup. Unlimited searches are not recorded in this allowance table. Account exports include daily usage counts. Saved searches separately retain the filters you choose to save.

Private bookmarks and browsing preferences

Private bookmarks are available on every plan. We store the bookmarked account ID and time against your account. Other members are not notified and cannot see your list. Hidden, blocked, suspended or deleted profiles are not shown in it. Bookmarks do not create Likes, Winks or shared profile visits; opening a saved profile follows the normal profile-view allowance and visitor/audit rules. Account exports include your bookmarks. Deleting either account removes its related bookmarks.

Your compact or comfortable grid choice is saved against your account. The signed-in browser tab remembers browsing filters and scroll position for up to two hours to help you return to results. This can include keyword text. Tab records are cleared on signed-out pages or account changes; closing the tab ends its normal storage lifetime. A server session also holds a fallback return-to-results address. Clearing browser storage removes tab history without deleting saved searches or bookmarks.

Invitation requests and support

If you request an invitation, we store your email address, request time, decision and explicit consent version. This can reveal interest in a gay fetish community. You must confirm that you are 18 or over and explicitly consent before submitting. Requests are reviewed by administrators and do not create an account or subscribe you to marketing. We do not send an automatic acknowledgement email. On approval, an administrator may create a member invitation and choose to email it to the requested address.

Pending requests expire after 30 days; approved and declined requests expire seven days after review. Expired requests are excluded from the review queue and deleted in batches when requests are submitted or reviewed. Contact support to withdraw a request earlier. Invitations themselves expire after seven days, under their separate account-creation rules. Administration records retain request IDs rather than copies of request email addresses; protected backups follow the separate schedule below. If you email support directly, the email content is held in the support mailbox to respond to your enquiry. Please do not include intimate photos, passwords or unnecessary sensitive information.

Cookies and tracking

The application uses a Secure, HttpOnly session cookie to keep you signed in and protect forms. The server-side login session expires after two hours of inactivity. There are no advertising cookies, analytics scripts, external fonts or third-party embedded media in this version.

Your controls

Use Account to download your account details and activity as JSON, change your password, manage blocks, or delete your account. Photos can be downloaded individually from your profile or removed in the editor. Data export includes messages you sent, not private account information about other members. For additional access or correction requests, contact the administrator who invited you.

Deletion and retention

Deleting your account removes the active profile, photos, likes, blocks, verification/reset tokens and all stored conversations involving the account. Reports can remain with user references removed for safety review; information in report text may still identify someone. The private access audit retains numeric account IDs until its configured expiry. Administration records and hosting backups/logs may also persist until reviewed or expired by the operator. Local backups are retained for 30 days, with the latest good snapshot preserved until replaced. Do not use real sensitive information for testing until you are comfortable with these limits.

Keeping information safe

The website uses HTTPS, password hashing, protected sessions, request checks and access-controlled photo delivery. Uploaded images are resized and re-encoded to remove their original metadata. No system can guarantee absolute security. Report a suspected issue privately to the administrator who invited you.