Privacy notice

Who is responsible and how to contact us

The data controller for Nocturnal Pass is Davide Florio, operating under the name 1Prestige1, at 38A Werter Road, London SW15 2LJ, United Kingdom. For privacy questions or requests, email info.nocturnalpass@gmail.com. This link opens a draft in your email app: you must press Send to submit it. Please do not include sensitive information in the first email unless necessary; we may need to verify your identity before acting on a request.

Information we use

When you register on this site, we store your email address, password hash, account backup hash and account records. Backup codes are optional and can be created from account settings after confirming your password; they are not shown during registration. Registration requires an adult declaration; community profiles store that declaration and discovery profiles store your stated age. Gender is selected later during community profile setup. This site handles registration and sessions through its own account system. Community features can store the profile details, approximate area, interests, messages, connections, posts, photos and videos you provide. Registration does not require a photo, but access to some community features requires a profile photo and a private challenge selfie for review. We store the submitted media and consent records for that review. Nocturnal Pass prohibits under-18s from registering or using its community. The entry gate and registration use your own 18+ declaration. The challenge selfie is reviewed for a visual match with the profile photo; it does not establish legal age. AgeVerif is connected to the member access flow through a server-side OAuth2 check. The ordinary community accepts a server-validated AgeVerif result with an age threshold of at least 18 and a recognised STANDARD, ENHANCED or STRICT assurance label. Restricted creator, model, game and gallery areas retain the higher ENHANCED or STRICT requirement. Neither access rule is a certification of legal compliance or of highly effective age assurance. These provider labels do not establish legal compliance or independently prove the effectiveness of the selected method. Nocturnal checks the provider response on the server and stores its verification reference, verification time and expiry, plus a hash identifying the signed-in session and the provider assurance label. The verified result and assurance label are saved to your account and reused across sign-ins until the provider expiry. Nocturnal does not receive facial images through this integration. AgeVerif’s biometric policy dated 16 June 2026 says facial processing occurs locally and a 0.1% anonymised sample of facial landmarks may be retained for one year. This is a provider statement, not an independent audit. The configured selfie method is unavailable in Italy. Inaccessible, unsuccessful or insufficient results do not grant member access. Exact processing locations, contractual roles, applicable UK transfer safeguards and independent performance evidence for the selected method remain unverified. Account management, support and cancellation remain accessible without this check. Event booking and membership can involve transaction and booking details; the site's configured checkout can send a member's email to Square to prefill a membership checkout. We also record referral and site usage information described below.

Information about sex life or sexual orientation may be especially sensitive. You decide what to add to your profile; avoid posting anything you do not want shared with its selected audience.

Why we use it

Account details support registration, authentication and access to requested features. Profile and community data support discovery, groups, messaging and content sharing. The For you feed uses interests you explicitly saved in your profile, upload categories, tags and recency to reorder content you are already allowed to see. It does not use browsing history or infer additional interests. Choose Latest for chronological order or edit your profile interests to change these suggestions. Safety records support reports, moderation and fraud prevention. If you report a private message, the site records its text, sender and time in a private support ticket for owner review; a profile report records the member account and your reason. The reported member is not given the report through this flow. Booking and payment details support requested purchases and legal accounting duties. Optional marketing must have a separate choice; creating an account is not consent to promotional emails.

The usual UK GDPR basis for core account and requested community functions is performance of a contract; safety measures may rely on legitimate interests; accounting may be required by law. Processing of special category information needs a separate Article 9 condition, such as valid explicit consent where appropriate. The profile editor asks separately for explicit consent to process optional sensitive profile details for discovery. It records the wording version and time; withdrawal hides the profile and clears its introduction, interests and preferences from active profile records. Existing profiles without this recorded choice are excluded from discovery until their owners save the profile with the separate choice. Content already shared in messages or posts needs a separate deletion request or account closure.

Contact Us and AI assistance

Contact Us offers an AI assistant and a separate team contact form. The assistant sends your question and the recent conversation to OpenAI’s Chat Completions API to generate a reply. It receives no account, purchase or private-message records from Nocturnal. Conversation history is held in the open page and is not automatically attached to a team request or stored in our support inbox. Please avoid passwords, card details and sensitive personal information. OpenAI states that API content is not used for training by default; its standard abuse-monitoring retention can be up to 30 days, with exceptions described in its API data controls. We request no stored application output. This uses the global API endpoint and is not a UK-only service. The AI may make mistakes and cannot change your account or decide a complaint or refund.

The team contact form saves your name, reply email, chosen topic and message in a private support inbox so we can respond to your request. Form messages are not sent to the AI. We use contact information to provide the assistance you request and manage complaints and safety reports; creating a request does not subscribe you to marketing. Only authorised staff can access the inbox. Request deletion or ask a privacy question at info.nocturnalpass@gmail.com. You can also contact that email directly instead of using AI.

Automated moderation

New JPEG, PNG and WebP photo uploads up to 5 MB, and their captions where provided, are sent to OpenAI’s Moderation API to assist our safety review. Account emails, passwords, private messages, verification challenge selfies and consent documents are not included in these screening requests. Videos and unsupported files require human review. Screening does not establish age, identity, consent or legality and never grants automatic publication; uploaded media remains pending human approval even when no category is flagged or the screening service is unavailable.

OpenAI processes these requests as our service provider. Its published API data controls state that Moderation API data is not used for model training and has no routine abuse-monitoring or application-state retention, subject to exceptions for image safety review and legal obligations. Requests use the global API endpoint; we do not promise UK-only processing. OpenAI’s Data Processing Addendum describes its processing terms and international transfer safeguards, including the UK Addendum. See OpenAI API data controls and Data Processing Addendum. We use this screening for community safety and enforcing our media rules; contact info.nocturnalpass@gmail.com to ask about the screening or challenge a moderation decision. Never submit known or suspected child sexual abuse material.

Who sees it

Your saved profile is shown to community members once you have an approved photo and have recorded the separate sensitive-profile consent. There is no profile-hiding switch. Removing your profile photo or withdrawing this consent removes your profile from discovery; you can also close your account. Previously hidden profiles with current consent, a matching approved profile photo and active member verification are made visible to community members. Suspended, banned, flagged and moderation-hidden profiles remain excluded. Other content is visible according to the audience and privacy controls you choose. Private messages are intended for their participants, subject to safety and legal access. The site owner can review reports and submitted verification evidence; approved challenge selfies are deleted from active media storage after review. The live application uses a Cloudflare D1 database for account and community records and an R2 bucket for uploaded media, as confirmed by its deployed source bindings. Square handles checkout when its payment flow is used; external ticket links can take you to a separate ticket provider. The contracting entities, actual storage and backup regions, other recipients and contractual roles still need confirmation. Never upload images of another identifiable person without their permission.

Sessions and site measurement

Signing in sets a secure, HTTP-only session cookie. A standard session expires after 24 hours; choosing “Remember me” allows a session for up to 30 days. Signing out invalidates that session. When email recovery is enabled, reset links are single-use, expire after 15 minutes and are sent through Resend. Resetting a password invalidates active sessions and the previous backup code. Expired reset records are removed during recovery requests and routine maintenance. A recent provider-confirmed subscription may retain access for up to six hours during a provider outage, never beyond its paid expiry; this does not grant a ticket discount. This site currently measures page views, event views and selected link clicks. It saves a visit identifier and attribution in browser local storage and sends the page path, event type, source, referral domain and campaign source where available to its own event endpoint. Account and other private paths are excluded from page-view reporting. Registration also records a conversion event with supplied attribution. Measurement records older than 90 days are removed during successful cleanup runs, including when a new event is recorded. We found an AdSense account identifier in page metadata, but did not verify that an advertising script is active or that any third-party advertising cookie is set. The owner also has a manual cleanup control for measurement records older than 90 days, expired sessions and queued storage deletions; automatic cleanup is attempted during site activity, normally once every 24 hours, with failed runs retried after 15 minutes and queued file deletions after an hour. The owner can inspect the last automatic result. This is not a clock-based schedule and does not run while the site has no traffic. Optional analytics is off until you accept it in the cookie banner. You can change or withdraw that choice using Cookie settings; rejecting it removes the device visit identifier and attribution. Previously collected events are removed after 90 days by the next successful cleanup; removal on the exact expiry date is not guaranteed. The active advertising scripts, if any, and their cookies still require a separate inspection beyond the AdSense metadata.

Retention, transfers and your rights

Account and content records are kept while needed to operate your account. The Close account action attempts to cancel linked Square subscriptions before deleting account and related community records. It records listed media keys in a deletion queue before removing account records, then attempts deletion from active object storage. A failed storage deletion remains queued for retry during later site activity; failed deletions request an hourly retry, without a guaranteed wall-clock deadline; safety, dispute or legal records and backups may persist. Square retains its own payment records under its applicable terms. Square's published UK Data Processing Terms say seller data may be transferred outside the UK and that details of applicable safeguards can be requested from Square. This does not establish the location of this site's transactions. Cloudflare's D1 and R2 documentation describes several possible data locations; the actual configuration of this site's database and bucket has not been verified. Approved verification challenge selfies are removed from active storage after review. There is no verified automated deletion period for inactive accounts or backups. We still need the actual backup schedule and deletion period, the provider entities and configured storage locations for this site, the applicable contractual chain and transfer safeguards, and any other active provider locations. These facts are not yet confirmed. Contact us before sharing especially sensitive information if you need those details. You can ask for access, correction, deletion, restriction, portability or object to relevant processing, and withdraw consent where used. Email the address above; you can also complain to the UK Information Commissioner’s Office at ico.org.uk.