Last updated:
Privacy Policy
This is the privacy policy for Naughty Games (naughty.games and the
game host nut.games), a free, ad-supported site for adult games,
operated by Naughty Games.
Data controller
Naughty Games is the data controller for the information this policy describes.
- Naughty Games
- Email: [email protected]
The short version
- You can browse and play without an account. Visitors are tracked by a random ID in a cookie, not by name.
- If you make an account, publish a game or fill in a form, we store what that needs, and nothing is sold.
- Ads on the site come from third-party ad networks. Their scripts run in your browser and see your IP address, like any website you load.
- Some content is checked or produced by AI services. The sections below say which ones and what they receive.
- We do not sell, rent or trade personal data.
When you visit
We record the following automatically, tied to a random session ID in the
naughty_sid cookie:
- The pages you view, the searches you run, and the clicks, plays, ratings and follows you make.
- The referrer and any UTM campaign tags on the link that brought you here.
- Your country, which Cloudflare works out from your IP address.
- Your user agent (browser, operating system and device type).
Your IP address passes through Cloudflare and our servers with every request, like on any website. For visitors without an account we use it only in memory, for example to rate-limit comments, and we do not store it. We store only the country.
We also use Cloudflare Web Analytics, which counts page loads without cookies.
When you make an account
You can sign in three ways, and we store:
- Username and password: your username and a hash of your password. No email is needed.
- Email link: your email address.
- Telegram: your Telegram ID, the name and the profile photo Telegram shares with us.
For every sign-in session we store your IP address and user agent, so you can be protected against someone else using your account. Recovery codes are stored only as hashes.
With an account we also store what you do with it: your library (recent plays, favorites, ratings, follows), game saves, comments, messages, chats with the site's AI characters, generated avatars, notifications and push subscriptions. Things you did before signing up, like ratings and follows, are moved into the account when you sign up.
When you publish a game
If you use the developer console, we also store:
- Your games, builds, images, listing text and links, and our review notes and results for each of them, including automated checks (see Automated checks and AI).
- If you join the revenue share: your USDC wallet address on Polygon, your earnings and payouts with their transaction hashes, and a log of wallet changes with the IP address and user agent used for each change, to protect your payouts from account takeover.
Blockchain transactions are public by design. Anyone who knows your wallet address can see the payouts we send to it.
We show developers aggregate stats for their games (plays, players, play time, countries, devices, link clicks). We never give developers the personal data of players.
When you fill in a form
Forms (feedback, corrections, game claims, sponsor inquiries, the newsletter and contact) store what you type, your country and your user agent. Email is optional on most of them. We use it only to reply, handle the request or send the newsletter you asked for. Every newsletter email has an unsubscribe link.
Ads and third-party content
The site is free because of ads. These load from third parties directly in your browser, so they receive your IP address and user agent, and may set their own cookies under their own privacy policies:
- ExoClick, TrafficStars and JuicyAds serve display and video ads. We pass them a number for the game page an ad appears on, so revenue can be credited to that game's developer. We do not pass them anything about you.
- CrakRevenue serves the chat widget and the cams on
/live. - Sponsor links go through our own redirect first. We log the click (session ID, country, user agent) and send you on without a referrer.
We do not use advertising pixels of our own, and we do not target ads using special categories of personal data.
Automated checks and AI
- Anthropic (Claude) checks comments, and developer builds, images, listings and links, for content that breaks our rules. It also checks generated avatars, writes descriptions of public game pages, and helps our team analyse and run the site.
- OpenRouter runs the chats with the site's AI characters. It receives the conversation and a short summary of earlier chats. We block hosts that do not allow adult content.
- Runware makes avatar images from the prompt you type or from the tags of games you play.
- Google Web Risk checks links developers add for malware and phishing.
Automated checks on developer content only flag it for review. A check that finds a high risk can pause a preview or a link until a person looks at it, but a person makes every approval and every rejection.
Service providers
| Provider | What it does for us |
|---|---|
| Cloudflare | Network, security, file and game hosting (R2), device tests |
| Railway | Application servers and database |
| Resend | Sends our emails and receives mail sent to @naughty.games |
| Anthropic | Moderation and site analysis (see above) |
| OpenRouter | AI character chat (see above) |
| Runware | Avatar images |
| Link safety checks for developer links | |
| Telegram | Telegram sign-in, only if you use it |
| Your browser's push service | Delivers notifications, only if you turn them on |
Cookies
| Cookie | Lifetime | Purpose |
|---|---|---|
naughty_sid |
1 year | Random session ID for analytics and your anonymous library. |
naughty_age_ok |
1 year | Remembers that you confirmed you are 18+. |
naughty_hide |
1 year | Content types you chose to hide. |
ng_js |
1 year | Notes that JavaScript runs, to tell real clicks from bots. |
naughty_tease |
30 days | Which AI character greeted you before you signed up. |
naughty.session_token |
7 days | Keeps you signed in. |
naughty.session_data |
5 minutes | Short cache of your sign-in session. |
naughty.dont_remember |
Session | Sign-in without "remember me". |
naughty_admin |
7 days | Editor sign-in. Only set for our team. |
The site also keeps settings, your library and game saves in your browser's local storage. Ad networks set their own cookies (see above).
How long we keep data
- Visit events: 31 days in our database. After that, each month is kept as a compressed archive in private storage that only our team can read, and totals (such as daily searches and first visits) are kept.
- Accounts and what they contain: until you delete your account.
- Rejected developer builds: deleted within about an hour of the decision. Builds rejected because of minors or other illegal content are kept for 90 days as evidence for the authorities, then deleted.
- Payout records: kept as financial records for as long as the law requires.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, or to stop a use of it. We answer within one month.
To delete your account, sign in and use Delete account on your account page. It deletes the account and what it contains right away. If you lost your password, sign in with a recovery code first.
For other requests, email [email protected]. We accept email
requests about an account only from the email address on that account.
If you have no account, send us your session ID (the naughty_sid
cookie) and we delete its history.
We may keep what the law requires us to keep, such as payout records and evidence of illegal content. You can also complain to the data protection authority where you live.
Age requirement
Naughty Games is an 18+ site. We use an age gate, but we cannot verify age. By using the site you confirm you are of legal age to view adult content where you live.
Changes to this policy
We may update this policy. The date at the top of the page shows the latest revision.