Information
Last updated: 10 November 2026 · This English translation is provided for convenience; the French version prevails.
Discretion lies at the heart of this relationship. In accordance with Articles 12 to 14 of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Act No. 78‑17 of 6 January 1978 on information technology, data files and civil liberties, this page tells you what information is processed, why, for how long, and how to exercise your rights.
Sasha Smash, publisher of the website, who may be contacted at . No data protection officer has been designated, as such designation is not mandatory under Article 37 of the GDPR.
This website has no forms, accounts, members’ area, audience‑measurement tools or advertising, and places no cookies.
Only your confirmation that you are of age is stored in your browser’s local storage (key “majeur”), so that you are not asked for it again on each visit. It stays on your device, is never transmitted and does not allow you to be identified. This storage is strictly necessary to provide the access you request; it is therefore not subject to your consent, pursuant to Article 82 of the Act of 6 January 1978 and the guidelines of the CNIL (the French data protection authority) of 17 September 2020 (Deliberation No. 2020‑091). It remains until you erase it by deleting the site’s data in your browser settings.
The website is served by its hosting provider, OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which acts on the publisher’s behalf as a processor (Article 28 of the GDPR). Its servers, located in the European Union, record technical logs (IP address, date and time, page requested, browser) necessary for the security and proper functioning of the service; this processing is based on the legitimate interest in having a secure and available website (Article 6(1)(f)). These logs are kept in accordance with the hosting provider’s policy, and the publisher does not use them.
Contact takes place in writing only, by text message (SMS), WhatsApp or email. The following are then processed: your phone number or email address, your messages and their date, and any information you choose to share, in particular your first name, age, city and a photograph of your face.
This information is used for four purposes only.
Replying to your messages. Lawful basis: your consent (Article 6(1)(a)), expressed by your initiative in making contact and confirmed during the first exchange.
Arranging a possible meeting (date, place, terms). Lawful basis: your consent (Article 6(1)(a)).
Verifying that you are of age, on the basis of the age you state and, where applicable, the consistency of the photograph exchanged. Lawful basis: the publisher’s legitimate interest in never engaging with a minor (Article 6(1)(f)). No copy of an identity document is requested or kept.
Ensuring the safety of the persons concerned, by making sure that the other party is who they claim to be, and keeping a record of any serious incident. Lawful basis: the publisher’s legitimate interest in ensuring her safety (Article 6(1)(f)) and, in the event of an incident, the establishment, exercise or defence of her legal claims.
The photograph is not processed by any facial recognition system or by any technical means of automated identification: it is only viewed.
Given the nature of the relationship, your exchanges may reveal information relating to the most intimate aspects of your private life. As a precaution, all such exchanges are therefore treated as falling within the special categories of personal data within the meaning of Article 9 of the GDPR. They are processed only with your explicit consent (Article 9(2)(a)), which is requested during the first exchange, together with a link to this page. If you do not give it, no further action can be taken and your messages are deleted.
You may withdraw your consent at any time, as easily as you gave it, for instance by writing “delete”; your data is then erased, except for what must be retained following a serious incident (see below). Withdrawal does not affect the lawfulness of processing carried out beforehand (Article 7(3)).
Share only what is useful for arranging a meeting. None of this information is mandatory; without it, it may simply be impossible to follow up on your request. No automated decision‑making or profiling takes place (Article 22).
Messages, phone number or email address, first name, age and city: deleted no later than six months after our last exchange, or as soon as you ask.
Photograph of your face: deleted as soon as the verification has been made, and no later than thirty days after receipt.
Serious incident (threat, violence, attempted fraud): only the strictly necessary elements are retained, for the duration of the proceedings or of their transmission to the competent authorities, and until the time limits for legal remedies have expired (Articles 9(2)(f) and 17(3)(e) of the GDPR).
These periods concern the data retained by the publisher. Messaging services keep their own copies in accordance with their own rules; it is up to you to delete the conversation on your side.
Your information is not sold, rented, transferred or shared, and is accessible only to the publisher. It is disclosed to an authority only where required by law or in the event of a serious incident.
It passes through the services you choose to write with, which act as controllers of their own processing: your telephone operator for text messages; WhatsApp Ireland Limited, a Meta group company, for WhatsApp; and, for emails, your own email service as well as the publisher’s email provider, OVH SAS (2 rue Kellermann, 59100 Roubaix, France), whose servers are located in the European Union and which acts on her behalf as a processor.
The website itself is hosted by OVH SAS, a processor.
The publisher herself transfers no data outside the European Union. Some providers may, however, process data in the United States: WhatsApp LLC and Meta Platforms, Inc. These companies are certified under the EU‑U.S. Data Privacy Framework, recognised as ensuring an adequate level of protection by European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (Article 45 of the GDPR). The list of certified companies is published at dataprivacyframework.gov.
If you send a gift through PayPal or the Amazon gift list, or follow the publisher on MYM, these platforms may share certain information with her (name or pseudonym, email address, amount, message accompanying the gift). This information is used solely to thank you and to comply with accounting and tax obligations; it is retained for the corresponding statutory period (Article 6(1)(c) and (f)).
What you do on those sites (MYM, PayPal, Amazon, WhatsApp) is governed by their own privacy policies.
The publisher implements measures appropriate to the risk (Article 32 of the GDPR): a passcode‑protected device, WhatsApp conversations end‑to‑end encrypted by default, access restricted to the publisher, and regular deletion of exchanges and photographs. As no system is infallible, absolute security cannot be guaranteed: text messages and emails are not end‑to‑end encrypted. In the event of a personal data breach likely to result in a high risk to you, you will be informed under the conditions laid down in Article 34 of the GDPR.
This website and any exchanges arising from it are strictly reserved for adults. No data concerning a minor is knowingly processed: if it emerges that the other party is a minor, the exchange is ended immediately and their data is deleted without delay.
You have the right of access, the right to rectification, the right to erasure and the right to restriction of processing (Articles 15 to 18 of the GDPR), the right to data portability in respect of the data you have provided (Article 20), the right to object to processing based on legitimate interests (Article 21) and the right to withdraw your consent at any time (Article 7(3)). You may also give instructions concerning the retention, erasure and disclosure of your data after your death (Article 85 of the Act of 6 January 1978).
To exercise these rights, write to , or from the number or account used for our exchanges. You will receive a reply within one month of receipt of your request; this period may be extended by two further months, taking into account the complexity or number of requests, in which case you will be informed within the first month (Article 12(3) of the GDPR). Where there is reasonable doubt as to your identity, additional information, limited to what is strictly necessary, may be requested (Article 12(6)); no identity document will be required where the request is made from the number or account used for our exchanges.
If, after contacting the publisher, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés, the French data protection authority (Article 77 of the GDPR): CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, or online at cnil.fr/fr/plaintes.
This page may be updated, in particular if the services used or the regulations change. The date of the last update appears at the top of the page; in the event of a substantial change affecting ongoing exchanges, you will be informed directly.