Privacy Policy

Last updated: July 7, 2026

Important: This policy reflects our real data practices and the requirements of Canada's PIPEDA and Alberta's PIPA, but it has not been reviewed by a privacy lawyer. Given that we handle sensitive information (age/identity verification, adult-content activity) and transfer data across borders, professional review is strongly recommended before relying on this as final.

1. Who we are

Crimson After Hours (the "Site") is operated by FumikoEcho Network, a sole proprietorship in Alberta, Canada ("we," "us," "our"). We are the organization accountable for the personal information handled through the Site. This policy explains what we collect, why, how we use and protect it, and your rights, in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

2. Our privacy principles

We handle personal information according to the ten fair-information principles that underpin Canadian privacy law: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and the ability to challenge our compliance. The sections below put those principles into practice.

3. What we collect

• Account information — username, email address, hashed password, role, account status, and any profile details you add (display name, bio, avatar).
• Age / identity verification — to access adult content you complete a check through our verification provider, Persona. Depending on the method, Persona processes a government-ID image and/or a biometric selfie. We receive the result (verified / not verified) and a reference to the verification; the underlying ID images and biometric data are processed and stored by Persona under Persona's own retention policy (currently up to three years), not held by us.
• Content and metadata — videos, audio, images you upload; titles, descriptions, tags; and technical metadata generated during processing (resolution, duration, file hashes).
• Activity data — comments, reactions, follows, playlists, watch/view records, and notifications.
• Usage and device data — IP address, browser/device information, timestamps, and pages viewed, some retained in hashed or truncated form for anti-abuse purposes (e.g. preventing view-count manipulation).
• Cookies and local storage — a session cookie (required for login), a CSRF-protection cookie, and a local-storage entry for your chosen theme. We do not use third-party advertising or cross-site tracking cookies.
• Moderation and safety records — reports, sanctions, appeals, and content-scan results.

4. Why we use it (purposes)

• To create and secure your account and authenticate you;
• To verify age eligibility for adult content and comply with age-verification obligations;
• To host, process, and deliver content (transcoding, thumbnails, previews);
• To operate moderation, trust & safety, and legal compliance — including detecting and reporting suspected child sexual abuse material;
• To send transactional email (verification, security, account and content notices);
• To maintain security and integrity, and detect abuse and fraud;
• To comply with legal obligations and respond to lawful requests.

We do not sell personal information and we do not use it for third-party advertising.

5. Consent

We rely on your consent (given expressly through account creation, age verification, and content upload, or impliedly where reasonable and appropriate) and, where applicable, other lawful bases. You may withdraw consent for non-essential processing at any time by contacting us, subject to legal or contractual limits — for example, we must retain certain moderation and law-enforcement-reporting records regardless.

6. Who we share it with

We share personal information only as needed to run the Site:

• Hosting — InterServer Inc. (New Jersey, USA). Your account data and uploaded content are stored on servers physically located in the United States. This means your information is transferred to, stored, and processed in the U.S., where it may be accessible to U.S. authorities under U.S. law (including legal processes that differ from Canada's). By using the Site you acknowledge this cross-border transfer. We remain accountable under Canadian law for information transferred to our service providers.
• Age/identity verification — Persona (withpersona.com). Processes ID and biometric data to verify your age. See Persona's privacy policy for its handling and retention.
• Transactional email — Brevo (Sendinblue SAS). Delivers verification and security emails.
• DNS / network — Cloudflare.
• Community integration — Discord. If we post new-content announcements to a Discord channel, only already-public information (title, thumbnail, link) is sent.
• Law enforcement / regulators — where required by law, including mandatory reporting of suspected child sexual abuse material to the Canadian Centre for Child Protection and/or the U.S. NCMEC.

We do not otherwise sell, rent, or trade your personal information.

7. Retention

We keep account and content data while your account is active and for a reasonable period afterward to meet legal obligations, resolve disputes, and enforce our agreements. Moderation, sanction, and safety records — and anything related to suspected child sexual abuse material — may be retained longer as required for legal and safety purposes. Copyright-notice records are retained as required under the Copyright Act (see the Copyright Policy).

8. Your rights

Under PIPEDA and Alberta PIPA you may:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your account and associated personal information, subject to the retention requirements above;
• Withdraw consent for non-essential uses;
• Ask questions or complain about our practices.

Contact us (Section 12) to exercise any of these. If you are not satisfied with our response, you may complain to the Office of the Information and Privacy Commissioner of Alberta or the federal Office of the Privacy Commissioner of Canada.

9. Security

We use reasonable technical and organizational safeguards: password hashing, HTTPS in transit, signed access tokens for private media links, and role-based access controls that limit staff visibility of sensitive data (such as verification results and safety records) to specific trust & safety roles. No system is perfectly secure and we cannot guarantee absolute security.

10. Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate regulator(s) as required by PIPEDA and Alberta PIPA, and keep records of breaches as required.

11. Children's privacy

The Site is restricted to adults 18+. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it and take appropriate action on the account.

12. Contact

Privacy questions, requests, or complaints: contact@fumikoecho.ca (attn: Privacy). We may update this policy; material changes will be reflected in the "Last updated" date above.