Privacy policy

Creator data we process

We read public OnlyFans profile pages and store only fields the creator has already published there:

• Username, display name and profile biography.
• Subscription price and whether the account is free.
• Public post, like and fan counters.
• Self-stated location, as written in the profile.
• A downscaled copy of the public profile picture, stored on our own server after passing an automated safe-for-work filter.

We do not read, store or link to anything behind an OnlyFans paywall. We do not follow links from a profile to other platforms, do not match accounts across sites, and make no attempt to connect a working name to a legal identity. Every category label describing a person — ethnicity, body type, age bracket, gender identity, pregnancy — is applied only when the creator states it themselves in their own profile text. Nothing is inferred from a photograph.

Legal basis for processing creator data

For creators in the UK, EU or EEA we rely on legitimate interests under Article 6(1)(f) GDPR: operating a searchable index of information the creator has deliberately made public in order to be found. We have weighed that against creators' interests and concluded the balance holds only with the safeguards above plus unconditional, fast erasure — which is why the removal form requires no explanation and closes within 48 hours.

Where a creator has asked us to list them, or is one of our own or a partner's models, the basis is consent, and it can be withdrawn the same way.

We do not seek to process special-category data under Article 9. Where a self-written profile happens to reveal something in that class, we process it only as part of the creator's own public self-description, and erasure on request is the remedy.

Your rights as a creator

If GDPR or UK GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive a copy in a portable form. California residents have comparable rights under the CCPA/CPRA, including the right to know and to delete; we do not sell personal information and do not share it for cross-context behavioural advertising.

To use any of these, write to legal@onlylookup.net from an address we can reply to, or submit the removal form for erasure. We answer access, correction and portability requests within 30 days, and erasure within 48 hours. There is no charge and no account required. We will ask you to confirm control of the listed profile only where a request would otherwise expose one creator's data to someone else — erasure is never gated this way.

If you are unhappy with how we handled a request you may complain to your national data protection authority. That right exists regardless of what we say here.

What we keep after erasure

Erasure deletes the profile, its data and the stored image copy. Two things survive deliberately:

• The username, on a permanent blocklist, so the importer cannot re-add the profile on a later crawl.
• The removal request record — username, requester email, reason, timestamps — as the audit trail proving the block was actioned.

Tell us in the request and we will clear the email from that record once the block is in place. We cannot drop the username itself without breaking the block that makes erasure stick.

Visitor data we process

We record page impressions and outbound clicks to the creator's own page so we can tell which listings are useful. Each event stores the placement, the destination, the category and a SHA-256 hash of your IP address. The hash is used to deduplicate repeat events within five minutes; we do not store raw IP addresses in the events table and cannot reverse the hash back to an address. No cookie is set for this.

Standard web-server logs, which do contain IP addresses, are retained short-term for security and reliability.

If Google Analytics 4 is enabled on the site, it sets its own cookies and receives the same impression and click events. Where GA4 runs, Google is an independent controller for that data and its processing is covered by the Google Privacy Policy. You can opt out with Google's browser add-on or any tracker blocker; the site works normally without it. We set no advertising cookies and run no third-party ad network.

Where data is stored

The application and database run on a DigitalOcean server in New York, United States. Encrypted database backups are stored in Cloudflare R2 in Western Europe and are deleted automatically after 14 days. DNS and the email addresses on this site are handled by Cloudflare. For transfers of UK/EU personal data to the United States we rely on the standard contractual clauses in our providers' data processing terms.

Our processors are DigitalOcean (hosting), Cloudflare (DNS, email routing, backup storage), Google (analytics, where enabled) and Anthropic (the model that classifies public profile text into categories). We do not sell personal data to anyone, and we do not share it with advertisers.

Retention

Creator profile data is kept while the profile is listed. Event records are kept in aggregate for ranking and reporting. Removal request records and blocklist entries are kept indefinitely, for the reasons given above. Backups roll off after 14 days, so a deleted profile is gone from backups within that window.

Children

OnlyLookup lists only existing OnlyFans profiles, and OnlyFans verifies that its creators are adults before an account can exist. The site is not directed at anyone under 18 and we do not knowingly process data about minors. Tell us at legal@onlylookup.net if you believe we have, and we will remove it immediately rather than within 48 hours.

Changes

We will update the date at the top of this page when this policy changes. Material changes to how creator data is processed will be summarised here rather than quietly edited in.