Policy
Privacy policy.
Last updated May 12, 2026.
Summary
Nyhilism is an adult ad marketplace. To do that job, we collect three kinds of data: account information (so we know who’s signing in), traffic events (so we can serve ads, bill correctly, and audit fraud), and content uploads (creatives advertisers submit for review). We don’t sell any of it, and the only third parties we share it with are payment processors, infrastructure providers we host on, and law enforcement when properly compelled.
The rest of this page is the long version.
Data we collect
Account data
When you sign up, we collect: name (first + last), email, organization name, country, date of birth, password (stored hashed with Argon2id), and your role (publisher or advertiser). Date of birth is used to verify you’re 18+ and is otherwise not shared with any counterparty on the network.
Traffic events
When a Nyhilism tag serves an ad on a publisher’s page, we log: the zone ID, the creative ID, the impression timestamp, whether the impression passed viewability and tab-focus checks, the truncated IP address of the visitor, the user-agent string, and a hash of the IP for repeat-visit detection. Click events log the same plus a redirect token.
Creatives
Advertisers upload banner images for review. We store the image bytes, file metadata (dimensions, type, size), the upload timestamp, and any moderation notes. Images go through a human moderation queue before serving; PhotoDNA hash scanning is planned before GA.
Site metadata
Publishers register sites by domain. SiteScan periodically loads the homepage in an automated browser, captures a screenshot, and records detected ad networks, compliance signals (DMCA page, 18+ gate), and performance metrics. The screenshot is stored; page bodies are not.
How we use it
- Serve the right ad in the right zone (auction + booking).
- Bill advertisers and credit publishers for valid traffic.
- Flag invalid traffic (datacenter ASNs, refresh abuse, no viewability) and discount the impression on both sides of the ledger.
- Detect repeat-visitors for impression-cap enforcement.
- Produce the public traffic-quality and SiteScan scores.
- Respond to support, abuse, and DMCA inquiries.
- Comply with subpoenas, warrants, and court orders.
What we don't do
- We don’t sell any data we collect to anyone, ever. That includes ad-tech data brokers, third-party DMPs, and so-called “intent” aggregators.
- We don’t share which sites a viewer visited across publishers. The hash we use for repeat detection is scoped per campaign and not exported.
- We don’t store full IP addresses for longer than the traffic-integrity window requires.
- We don’t use any data collected here to train advertising models for other platforms.
- We don’t load Google Analytics, Facebook Pixel, or any other third-party ad-network tracker. Product analytics (PostHog) only runs when you opt in via the cookie banner.
Retention
| Category | Window |
|---|---|
| Account data | Until account deletion + 90 days |
| Traffic events (raw) | 13 months |
| Hourly rollups | 5 years |
| Creatives (active) | Until removed by advertiser |
| Creatives (deleted) | 30-day soft-delete then permanent |
| SiteScan screenshots | Most recent + last 12 scans |
Your rights
If you’re in the EU/UK (GDPR) or California (CCPA), you have specific rights over the data we hold about you:
- Access. Get a copy of the data we hold linked to your account.
- Correction.Fix any of it that’s wrong.
- Deletion. Have it removed (subject to legal retention requirements).
- Portability. Export it in a structured format.
- Object / restrict. Limit how we process it.
- Lodge a complaint. With your local data protection authority (EU) or the California Privacy Protection Agency.
Email [email protected] from the address attached to your account. We respond within 30 days.
Security
Account passwords are hashed with Argon2id. Session tokens are stored as SHA-256 hashes server-side — a database leak alone can’t replay sessions. Database backups are encrypted at rest. TLS 1.3 in transit. All workers and the ad-server run on hardware we own; no third-party cloud holds the database.
If we discover a breach affecting your data, we notify the relevant supervisory authority within 72 hours and impacted users without undue delay.
Minors
Nyhilism is an adult network. You must be 18 or older to register for an account. We collect date of birth at signup and decline registration for anyone under 18. We do not knowingly process data about minors; if you believe we have, email [email protected] and we’ll delete it.
International transfers
Our infrastructure is hosted in the European Union. If you’re accessing the service from the United States or elsewhere, the data you submit is transferred to and processed in the EU. We rely on Standard Contractual Clauses where appropriate.
Changes
We update this policy when our practices change. Material changes get a notice on the dashboard before they take effect, and the Last updated date at the top of this page rolls forward.
Contact
Privacy questions: [email protected].
Copyright complaints: see DMCA.