Privacy Policy
Last updated: September 2026 · Policy version 2026-09
Short version: NAC runs on our own server. We don't sell your data, we don't run ads, and we don't use analytics or tracking tools.
But we are not able to say "nothing ever leaves our server", and we would rather tell you exactly what does. Taking payments, sending email and delivering push notifications all involve outside companies, and playing an embedded video or searching for a GIF contacts that provider directly from your device. Section 5 lists every one of them, and section 6 explains the ones you can control.
1. Who We Are
Naked as Created (NAC) is a private, faith-based online community accessible at nac.social. The platform is self-hosted and operated by the community founder. This policy describes what information we collect, how we use it, who else can end up seeing it, and how we protect it.
2. Information We Collect
When you register
- Username and display name
- Email address (used for account recovery and notifications)
- Password (stored as a cryptographic hash — we cannot see your password)
When you use the platform
- Messages you send in channels or direct messages
- Files, images, and other media you upload
- Your profile picture and any other profile information you choose to add
- Server membership and role assignments
- Timestamps of your activity (message times, login events)
- Session records for the devices you are signed in on, so you can sign them out
Notifications
If you turn on push notifications, we store the notification token your device or browser gives us. That token is what lets a notification reach your specific device, and it is passed to the notification service your device uses — see section 5.
Sponsorship and payments
If you sponsor NAC or send a one-time gift, we keep a billing record: the plan you chose, its status, the invoices raised against it, and an identifier that links it to the payment processor. We never see or store your card number. Card details are entered with our payment processor and never reach NAC's server.
Agreeing to our policies
When you accept this policy, our Terms of Service and our Community Guidelines, we record which version you accepted and when. We also record your confirmation that you are old enough to use NAC — the minimum age is 18, as stated in the Terms of Service.
Every published version of these documents is frozen and fingerprinted, so a record of your agreement points at the exact wording you actually saw rather than at whatever the page happens to say later. Those archived versions stay available at privacy.nac.social/policy/.
Technical information
Our web server keeps ordinary access logs, which include IP addresses, so that we can operate the service and investigate abuse. Voice and video calls need your device's network address in order to connect at all.
Voice calls
Voice and video calls are processed through a self-hosted LiveKit server. Call audio and video are transmitted peer-to-peer or through our own media relay — they are not recorded or stored unless we explicitly notify you otherwise.
3. How We Use Your Information
- To operate and deliver the community platform
- To authenticate your account and keep it secure
- To allow other members to see your profile, messages, and content
- To send you administrative notifications (e.g., welcome messages, policy updates)
- To manage sponsorships, invoices and the perks attached to them
- To enforce our Community Guidelines and Terms of Service
We do not use your data for advertising, profiling, or sale to third parties.
4. Who Can See Your Data Inside NAC
Messages and content posted in community channels are visible to all members with access to those channels. Direct messages are visible only to the participants.
Community administrators and moderators may access message history and account information as needed to enforce community rules or respond to safety concerns.
Administrators also necessarily have access to the server itself, which means that in principle they can reach anything stored on it. We mention this because "direct messages are private" is true between members, and we do not want it read as a claim that they are technically invisible to the operator.
5. Who We Share Data With
NAC does not use advertising networks, analytics tools, or social logins. We do not sell your data and we do not share it to help anyone build a profile of you.
We do rely on a small number of outside companies to make specific features work. Each one receives only what that feature needs. This is the complete list:
| Who | What they receive | Why |
|---|---|---|
| Our payment processor (Stripe) | Your payment details, which you enter with them directly, and the subscription record tied to your sponsorship | To take sponsorship payments. NAC never receives your card number. |
| Our email provider (Stackmail) | Your email address and the contents of any email we send you | Every email NAC sends — verification, password resets, notifications — is delivered through them. |
| Google (Firebase Cloud Messaging) | Your device notification token and the contents of the notification | To deliver push notifications to Android devices. |
| Your browser's push service (Google, Mozilla or Microsoft, depending on your browser) | Your browser's push endpoint and the contents of the notification | To deliver web push notifications. |
| Media providers — YouTube, Spotify, Twitch, SoundCloud, Bandcamp, Streamable and Lightspeed | Your IP address, browser details, which item you are viewing, when, and any cookies you already have with them | Only when an embedded player from that provider loads. See section 6. |
| GIF providers (Giphy, Tenor) | Your IP address, browser details and what you type into the GIF search box | Only when you open the GIF picker. See section 6. |
| Our hosting provider (Contabo, United States) | They operate the physical server, so all stored data physically resides on their hardware | To host the service. |
| Our DNS provider (Cloudflare) | Only the fact that someone looked up a NAC address. Your traffic does not pass through them. | To publish where nac.social lives on the internet. |
We may also disclose information where we are legally required to, or where it is necessary to protect someone's safety.
6. Embedded Media, GIFs and Link Previews
Link previews are handled by us
When someone posts a link, our own server fetches the preview image and re-hosts it. That means loading a preview does not tell the linked website anything about you.
Embedded players and GIF search are not
An embedded video or audio player, and the GIF picker, contact that company directly from your device. When that happens, that company can see your IP address, your browser and device details, which content you are loading or searching for, and — if you are signed in to them elsewhere in your browser — which account of theirs you are.
Why we are spelling this out. The sensitive fact here is not usually the video. It is that a company can connect a real, named account of theirs to the fact that you were on NAC. Please read section 7 alongside this.
What we do about it
We are moving these behind your explicit choice: media will not load from an outside provider until you ask it to, you will be told which company is involved before it does, and your answer is remembered separately for each provider so that agreeing to one is not agreeing to all of them. Where a player allows it, we also strip the address of the page you came from and isolate it from that provider's cookies.
What we cannot do: we cannot hide your IP address from a provider whose player you have chosen to load. Playing their media means contacting them, and contacting them reveals your address. The only complete protection is not to load it — which is why the choice exists. If you would rather view something without the association, open it in your own browser instead.
7. Sensitive Information
NAC is a naturist community. In many places, information revealing this kind of membership is treated in law as a special category of personal data deserving extra protection — and regardless of the law, we know that for many of our members it is genuinely sensitive.
We treat the simple fact that you are a member as confidential in its own right. In practice that means:
- We do not publish member lists, and our data request tool never confirms or denies whether any particular email address belongs to a member.
- We do not use analytics or advertising tools, which are the usual way this kind of association leaks.
- We are explicit, in section 6, about the one remaining place where an outside company could make that connection — and we are putting it behind your choice.
8. Data Storage and Security
All data is stored on a privately operated server hosted in the United States. All traffic to the platform is encrypted in transit (HTTPS/TLS).
Files and images you upload are encrypted at rest using AES-256-GCM, so the stored media is not readable from the raw disk without our key.
Administrative access to the server uses key-based authentication only, with passwords disabled, and is not reachable from the public internet.
No system is perfectly secure. We cannot guarantee absolute protection against unauthorized access, and you use the platform at your own risk.
9. Data Retention
Your data is retained for as long as your account is active. If you request account deletion, we remove your account and associated personal information, and uploaded files attached to deleted content are genuinely erased from storage rather than just hidden. Messages you sent may remain in channel history but will be disassociated from your identity where technically feasible.
Backups. We keep encrypted backups so the community can be restored after a failure. A backup taken before you asked for deletion still contains your data until that backup ages out of its retention window. We do not restore backups in order to recover deleted accounts, and each backup is deleted on its normal schedule.
10. Your Rights
You have the right to:
- Request a copy of the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and personal data
To exercise any of these rights, use the data request form. You do not need an account, a login, or to be a current member — it works just as well if you have left or been removed. We confirm the request by emailing the address already on the account, so nobody else can request your data.
You can also contact an administrator directly in the NAC community, or email privacy@nac.social.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The date and version at the top of this page reflect the current release, and every previous version stays published at privacy.nac.social/policy/ so you can see exactly what changed.
When we make a material change, we do not rely on you noticing it. NAC asks you to review and accept the new version the next time you use it — every member, not just new sign-ups — and records which version you accepted. Minor corrections that do not change your rights or how your data is handled may be made without re-prompting, and are still published as a new version here.