Data Privacy Policy

Last updated 2026

The Glow Room (“we,” “us,” the “data controller”) takes your privacy seriously — discretion is the whole point of how we work. This policy explains, in plain terms, exactly what personal data we collect when you visit, apply, or create an account, why we collect it, who it is shared with, how long we keep it, how it is protected, and the rights you have over it — including the right to have it deleted at any time.

Sensitive data, handled with care. Some of what you may choose to give us — a government ID, your address, and any intimate photos or video — is legally “sensitive” or “special-category” personal data. We only collect it with your explicit consent, use it only for the narrow purposes below, and you can withdraw that consent and have it erased whenever you want.

1. Who is responsible

The data controller for the information described here is The Glow Room. Questions or requests go to the records custodian:

Custodian: [Records custodian - designate before launch]

Address: [Custodian mailing address - designate before launch]

Email: [contact email - set me]

Text: 801-664-3370

2. What we collect

Application details you give us: the name you go by, your age, a way to reach you, and your answers about preferences, boundaries, and availability.
Age & identity data (sensitive): if you fast-track, a photo of your government ID, your full legal name, date of birth, and residential address — required by law to confirm you are 18+ and to complete the paperwork.
Consent & agreement records: the consent record generated when you confirm, and the NDA / Co-Performer Release you e-sign, together with the timestamp and IP address recorded at signing for legal validity.
Optional media (sensitive): any photos or short video you choose to upload, and your profile answers.
Account data: a username and a password stored only as a salted cryptographic hash — we never see or store your password in readable form.
Payment routing: the app and handle you give us so we can pay you (e.g. a Venmo/CashApp handle). We do not collect or store bank or card numbers.
Technical data: a login session cookie, a browser flag remembering you confirmed you are 18+, your IP address at the moments the law requires us to log it (application and signing), and standard web-server access logs. We run no advertising, analytics, or cross-site tracking.

3. Why we use it & our legal basis

To verify you are 18 or older — a legal obligation (18 U.S.C. §2257).
To review your application and coordinate if it’s a fit — on the basis of your request and consent.
To prepare and send the legal agreements and to pay you — to take steps you asked for.
To keep the records the law requires — a legal obligation.

For sensitive data (ID, address, intimate media) our basis is your explicit consent, which you can withdraw at any time.

4. Who it is shared with

We do not sell your personal data, ever, and we do not share it for anyone else’s marketing. To run the service we use a small number of service providers (“processors”), who only handle what they need to and are bound to protect it:

Cloud hosting — a US-based cloud infrastructure provider stores the application data on an access-restricted private server.
New-application alerts — when you apply, a notification containing the basic details you entered (such as the name and contact you gave) is sent to us through a push-notification relay and, where enabled, an email delivery provider, so we see your application promptly.
E-signatures — the NDA and Co-Performer Release are sent for signing through an e-signature provider (DocuSign).

Web fonts are served from our own server — no page on this site makes requests to third-party font or analytics hosts.

We will also disclose data if required by law — for example, a valid subpoena or court order — but only to the extent required.

5. Where your data lives

Your data is stored and processed in the United States. If you access the site from outside the US, you understand your data is transferred to and handled there.

6. How it is protected

Application records and uploads are stored on an access-restricted server with tightened file permissions; passwords are salted and hashed; login sessions use signed, HTTP-only cookies. Your government ID is used only for the legal age-verification file — it is never posted, never shared publicly, and never used for anything else. No system is perfectly secure, but we limit who and what can reach your data to the minimum needed to run the service.

7. How long we keep it & deletion

Age-verification and signed-agreement records are retained for as long as the law requires us to keep them. Everything else — your application, uploaded media, profile, availability, and account — is kept only while it is useful for the purpose you gave it, and you can have it deleted at any time on request. If you change your mind after applying, that is completely fine: ask us and we will delete your application and anything you sent with it.

8. Cookies & similar technology

We use only what the site needs to function: a login session cookie (so the portal remembers you) and a local browser flag that records you confirmed you are 18+ so the age notice does not reappear. No advertising or third-party tracking cookies are set by us.

9. Your rights

Wherever you live, you can ask us to:

Access the personal data we hold about you;
Correct anything inaccurate;
Delete your data and withdraw your consent;
Receive a copy of what you gave us, or ask us to restrict or stop certain processing.

If you are a California resident, you have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of any “sale” or “sharing” (we do neither), and not to be discriminated against for exercising them. If you are in the EU/UK, you have the corresponding rights under the GDPR, including to lodge a complaint with your data-protection authority. To exercise any of these, just contact the custodian above — there is no charge, and no email account is required to reach us.

10. Data breach

If a breach ever affected your personal data in a way that posed a risk to you, we would notify the affected people and any authorities as required by applicable law, without undue delay.

11. Minors

This service is strictly for adults 18 and older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it immediately. See our 18 U.S.C. §2257 statement.

12. Changes to this policy

We may update this policy; the current version is always posted here with its date. Material changes will be reflected on this page.

Terms Privacy 18 U.S.C. §2257 DMCA Home