Privacy Policy

1. Who is responsible

OnlyValue AI operates this service and acts as the data controller: we decide what is collected, why, and on what legal basis. For any question about how your data is handled, or to exercise the rights listed in section 11, write to [email protected]. We respond within 30 days.

2. What we collect from you directly

• Account: email address, display name (optional), interface language, plan, and the date your paid period ends.
• OnlyFans access credentials, if you connect an account. Encrypted with AES-256-GCM before they reach the database, under a key held only in server configuration. No endpoint returns them — not to you, not to support.
• Proxy settings, if you configure one. The full URL, including any username and password, is encrypted the same way. The interface only ever shows a masked form such as socks5://a••••e:••••@1.2.3.4:1080.
• Payment records: an order id we generate, the plan, the USD amount, the crypto asset, the status, and the on-chain transaction hash once the payment settles. We never see or hold a card number, a wallet private key, or a bank detail.
• Your acceptance of the Terms: the version accepted, a server timestamp, a salted hash of your IP address, and your browser user-agent string. The IP itself is not stored.

3. What we collect from your connected account

Once you connect an OnlyFans account we read, on a read-only basis: daily earnings totals, subscriber counts, new and lapsed subscriber counts, and message statistics (counts and timings, not content). We derive LTV, retention, churn, traffic attribution, cohort figures and forecasts from those numbers. We do not read the content of your messages, and we do not access your media.

4. What we deliberately do not collect

• No third-party analytics, no advertising pixels, no tracking scripts. There is no Google Analytics, no Meta pixel, no session recorder.
• Fonts are self-hosted at build time, so loading a page does not send your IP address to Google.
• Your raw IP address is never written to the database. Where we need it for abuse prevention or an acceptance record, we store an HMAC-SHA256 hash instead.
• AI chat messages are not stored. Your question and the reply exist for the duration of the request; only a per-day message counter is kept, to enforce the plan quota.
• We do not build a profile of you across other websites, and we do not sell or rent any data to anyone.

5. Cookies and local storage

Four things, and only one of them is a choice. Supabase sets httpOnly session cookies so you stay signed in. A cookie named ov.locale remembers your interface language and contains only "ru" or "en". A cookie named ov.consent records the answer you gave to the cookie notice. Those three are strictly necessary and are not asked about, because the site cannot work without them or would have nowhere to put your answer. The optional one is ov.ref: if you arrive through a referral link it stores that referral code for 30 days, so whoever sent you is credited when you sign up. It is set only if you allow it, and you can change your mind from "Cookie choice" in the footer. Local storage holds the same language preference and an unsent chat draft. There are no advertising or analytics cookies of any kind.

6. Why we are allowed to process this

Account data, connected-account analytics and payment records are processed to perform the contract you enter into when you sign up. Abuse prevention, rate limiting and the audit log rest on our legitimate interest in keeping the service running and secure. Where consent is the basis — for example if you enable analysis of message topics — you can withdraw it at any time by turning that feature off, without affecting anything done before.

7. Who else sees your data

• Supabase — database, authentication and hosting of your account data and analytics. Data is held in the region selected for the project.
• The hosting provider running this application (for example Vercel), which processes requests and server logs.
• NOWPayments — payment processing. They receive the order id, the amount and the chosen asset. They do not receive your analytics.
• The AI provider configured for chat: xAI (Grok) or Anthropic (Claude). They receive aggregated figures — totals, percentages, daily revenue numbers — and your question. They do not receive your email, your credentials, or the content of your OnlyFans messages.
• Telegram, only if the operator has enabled payment notifications. It receives the plan and amount of a completed payment, not your identity.

8. International transfers

The providers above operate globally, so your data may be processed outside your country. Where the law requires a transfer mechanism, we rely on the standard contractual clauses those providers publish. If you need the specific region a deployment uses, ask and we will tell you.

9. How long we keep things

• Account and profile: until you delete the account.
• Connected-account credentials and proxy settings: deleted immediately when you disconnect the account. There is no soft delete and no backup copy kept separately from the database backups.
• Analytics: until you delete the account, so historic comparisons keep working.
• Payment records: retained after account deletion where accounting or tax law requires it, reduced to the order id, amount, date and status.
• Audit log and terms acceptance: two years, as evidence of who changed what and what was agreed.
• AI usage counters: rolling, per day.

10. How your data is protected

Every table has PostgreSQL row-level security enabled and forced, with policies keyed to your user id, so one account cannot read another. Credential columns are additionally excluded from the grants the browser role has, which means they are unreachable even if a policy is misconfigured. Traffic is served over HTTPS with HSTS, a content security policy, and API responses marked no-store. Payment callbacks are verified with HMAC-SHA512 and deduplicated so a replayed callback cannot be honoured. The full technical description is on the Security page.

11. Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. The dashboard already covers most of this: CSV export gives you your analytics, disconnecting an account erases the stored credential, and Account -> Delete account removes the rest. That deletion is immediate and cannot be undone; it keeps only the payment records accounting law requires, with no reference to you. For anything else write to [email protected] and we will respond within 30 days. If you are in the UK or EU and are unhappy with the response, you may complain to your national data protection authority.

12. Age

This service is for adults only. You must be at least 18 to use it, and any account you connect must belong to an adult. We do not knowingly process the data of anyone under 18; if we learn that we have, we delete it.

13. Breach notification

If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it and tell you directly without undue delay, describing what happened, what data was involved and what you should do.

14. Changes

If we change this policy in a way that materially affects you, we will tell you before the change takes effect. The date at the top always reflects the current version.