Cookie Policy

1. What we use, and what we do not

SEPX runs no analytics, no advertising and no cross-site tracking. There is no analytics tag, no advertising pixel, no data-broker script and no profiling of you for marketing on this site.

What we do set is what the service needs to work: keeping you signed in, completing a sign-in with an external provider, remembering preferences you chose, and — through our payment and anti-bot providers — stopping fraud and abuse.

2. Cookies we set

All three are strictly necessary: without them you cannot sign in, and the sign-in cannot be protected from being hijacked. They carry no advertising identifier.

• “token” — your signed-in session. Set when you log in or register. HTTP-only, so scripts on the page cannot read it; SameSite=Lax; Secure in production; expires after 30 days or when you log out.
• “oauth_state_…” — a short-lived value set while you sign in with an external provider, so the provider’s response can be matched to the request you started. Cleared as soon as sign-in finishes.
• “oauth_dob_…” — a short-lived value holding the date of birth you entered during an external sign-in, so the age check survives the round trip to the provider. Cleared as soon as sign-in finishes.

3. What we store in your browser

These live in your browser’s local storage rather than in a cookie, and none of them is sent to us as a tracking identifier. Some hold a choice you made; the rest hold a copy of what you are already looking at, so the app opens without waiting for the network.

• “secretchat-theme” — appearance: light or dark, accent colour, compact mode and any custom themes you built.
• “secretchat-locale” — interface language.
• “secretchat-notifications” — notification sound settings: whether sound is on, which sound, and its volume.
• “secretchat-auth” — a copy of your own profile from your last signed-in session, so the app can render before it has heard back from the server. It is not the session itself: the session lives in the “token” cookie, and clearing this does not sign you out.
• “secretchat-cache” — a copy of your servers, channels, members and unread counts, kept so the app opens instantly. It is only ever written on your device.

4. Third-party scripts

Only functional third-party scripts run on SEPX. Each sets its own cookies under its own policy, and none of them loads until you reach the page that needs it.

Card payments are taken on the processor’s own pages. Nothing of theirs runs in your browser here and they set no cookies on this site; their own privacy and cookie policies apply once you are on their pages.

• Cloudflare Turnstile — bot protection, loaded only on the pages that submit a form to us without a session: login, registration, password reset, the content removal form and the support form for people without an account. It checks that a real browser is submitting the form.
• PrivateAV (verify.privateav.com) or iDenfy (ui.idenfy.com / ivs.idenfy.com) — the age and identity check, loaded only when you start that check: before you can use the platform at all, before opening adult content, before completing a purchase, or before publishing. The check runs in the active provider’s frame where it supports embedding, or in a popup where it does not (PrivateAV and iDenfy Age Estimation), and any cookie set for it is the provider’s own, set on the provider’s domain rather than on sepx.cc. What is submitted goes to the active provider and is not stored on our systems; sections 7 and 9 set out who can see it and for how long.

5. Consent, and how to withdraw it

We do not show a cookie banner because we do not set any cookie that requires consent: everything in section 2 is strictly necessary for a service you asked for, and nothing in section 3 profiles you or leaves your device — it is your own settings and a local copy of your own data.

You can still clear or block all of it. Every browser lets you delete cookies and site data for a site and block them in future — look for “Cookies and site data” in your browser’s privacy settings. Clearing site data for SEPX signs you out, resets your theme and language, and brings the adult-content notice back.

Blocking cookies from Cloudflare, PrivateAV or iDenfy will stop you signing in, verifying your age or paying: those checks cannot run without them.

If we ever add a cookie that is not strictly necessary, we will ask for your consent before setting it and record that consent. Questions: Data Protection Contact, support@sepx.cc.

6. Changes and contact

We update this policy whenever the scripts the site loads change. Controller: SEPX LIMITED, 20 Wenlock Road, London N1 7GU, United Kingdom. ICO registration ZC212736; the certificate is on the ICO's public register at https://ico.org.uk/ESDWebPages/RegistrationCertificate/ZC212736 (PDF). If you are unhappy with how we handle your personal data you can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.