Legal
Cookie Policy
Contents
1. Who we are and what this policy covers
This Cookie Policy is issued by PEACHCREAM S.R.L., a Romanian limited liability company with its registered office at Șoseaua Iancului nr. 53, bl. 102B, sc. C, et. 7, ap. 111, Sector 2, Bucharest, Romania, registered with the Bucharest Trade Register under no. J2026041854006, sole registration code (CUI) 55048995 (CreamyPeach, we, us), which operates creamypeach.com and its related applications and services (the Platform).
It explains every cookie and every similar technology we place on your device when you use the Platform: what it is, who sets it, why, how long it lasts, and how you control it. It forms part of our Privacy Policy, which explains how we process personal data, and of our Terms of Service.
We apply Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, which implements Directive 2002/58/EC (the ePrivacy Directive) in Romania; Regulation (EU) 2016/679 (GDPR); the UK Privacy and Electronic Communications Regulations 2003 and UK GDPR for users in the United Kingdom; and, for users in the United States, the state privacy laws that apply to online tracking, including the duty to honour the Global Privacy Control signal.
What a cookie is. A cookie is a small text file that a website stores in your browser. Similar technologies are other ways of storing information on your device: local storage and session storage (key-value stores in the browser), IndexedDB (a browser database), cache storage (files saved so pages load faster and work offline) and device identifiers. The same rules apply to all of them, so this policy lists them all.
What we do not do. We use no third-party advertising cookies, no social-media cookies, no cross-site tracking and no fingerprinting. We do not sell or share information collected through cookies for advertising. Your interest in adult content is never used to build an advertising profile.
2. Your choices
Strictly necessary items need no consent. The law allows us to store items that are needed to deliver a service you have asked for or to transmit a communication: keeping you signed in, protecting the Platform against bots and fraud, remembering your cookie choice and the result of your age check, and routing your payment. These cannot be switched off in our settings because the Platform does not work without them. You can still block them in your browser, but then you cannot sign in.
Everything else runs only with your consent. On your first visit we show a banner with three choices of equal prominence — Accept all, Reject all, and Choose — before any non-essential item is stored. We do not use pre-ticked boxes, cookie walls or "continue browsing means consent". If you make no choice, only strictly necessary items are used. Your choice is recorded in the cp_consent cookie with the date and the version of this policy you saw, so that we can prove it, and we ask again after 180 days or when we add a new category.
Change or withdraw at any time. Open "Cookie settings" in the footer of every page. Withdrawing consent is as easy as giving it and takes effect immediately for the future; items already stored under a category you switch off are deleted at your next page load.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of every non-essential category, without a banner, in every country.
Browser controls. You can also delete or block cookies and site data through your browser settings (usually under Privacy or Site data). Instructions for the main browsers are published by their makers. Blocking strictly necessary items prevents sign-in, age verification and payment.
No penalty for refusing. Refusing non-essential items never limits your access to content you have paid for or to any feature of the Platform.
3. The cookies we use
The tables below list every cookie set when you use the Platform. "First party" means set by creamypeach.com; "third party" means set by another company on its own domain while you use a feature it provides. "Session" means deleted when you close your browser.
Category A — Strictly necessary (no consent required)
- Cookie
- access_token
- Set by
- CreamyPeach (first party)
- Purpose
- Proves that you are signed in on each request
- Lifetime
- Session, or up to 30 days if you tick "Keep me signed in"
- Cookie
- refresh_token
- Set by
- CreamyPeach (first party)
- Purpose
- Renews your sign-in without asking for your password again
- Lifetime
- Session, or up to 30 days if you tick "Keep me signed in"
- Cookie
- cp_session
- Set by
- CreamyPeach (first party)
- Purpose
- Tells each page whether you are signed in and whether age verification has been completed
- Lifetime
- Session
- Cookie
- cp_consent
- Set by
- CreamyPeach (first party)
- Purpose
- Records your cookie choices, the date and the policy version you saw
- Lifetime
- 180 days
- Cookie
- cp_zone
- Set by
- CreamyPeach (first party)
- Purpose
- Stores your time zone so that times are shown correctly
- Lifetime
- 12 months
- Cookie
- __cf_bm
- Set by
- Our security and content-delivery provider (third party, named in our processor list)
- Purpose
- Distinguishes people from automated traffic and protects against bots and denial-of-service attacks
- Lifetime
- 30 minutes
- Cookie
- cf_clearance
- Set by
- Our security and content-delivery provider (third party, named in our processor list)
- Purpose
- Remembers that you passed a security challenge so you are not asked again
- Lifetime
- Up to 12 months
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| access_token | CreamyPeach (first party) | Proves that you are signed in on each request | Session, or up to 30 days if you tick "Keep me signed in" |
| refresh_token | CreamyPeach (first party) | Renews your sign-in without asking for your password again | Session, or up to 30 days if you tick "Keep me signed in" |
| cp_session | CreamyPeach (first party) | Tells each page whether you are signed in and whether age verification has been completed | Session |
| cp_consent | CreamyPeach (first party) | Records your cookie choices, the date and the policy version you saw | 180 days |
| cp_zone | CreamyPeach (first party) | Stores your time zone so that times are shown correctly | 12 months |
| __cf_bm | Our security and content-delivery provider (third party, named in our processor list) | Distinguishes people from automated traffic and protects against bots and denial-of-service attacks | 30 minutes |
| cf_clearance | Our security and content-delivery provider (third party, named in our processor list) | Remembers that you passed a security challenge so you are not asked again | Up to 12 months |
Category B — Referral attribution (consent required)
- Cookie
- attribution
- Set by
- CreamyPeach (first party)
- Purpose
- Remembers which Creator's link brought you to the Platform so that a sign-up or subscription within 30 days is credited to that Creator. It contains a Creator reference, not your identity, and is never shared with advertisers.
- Lifetime
- 30 days
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| attribution | CreamyPeach (first party) | Remembers which Creator's link brought you to the Platform so that a sign-up or subscription within 30 days is credited to that Creator. It contains a Creator reference, not your identity, and is never shared with advertisers. | 30 days |
Category C — Preferences and statistics
We currently use no preference cookies and no analytics or statistics cookies. Usage statistics are compiled from our own server logs in pseudonymised form, without any cookie. If we introduce a cookie in either category, we will add it to this table, ask for your consent before it is stored, and bump the version of this policy.
Category D — Advertising and social media
None. We do not use advertising cookies, pixels, social-media plug-ins or any tracker that follows you to other websites.
Cookies on our partners' pages
Two features open pages operated by our partners, which set their own cookies under their own policies while you are on those pages: our payment processor (payment pages, for payment security and fraud prevention) and our verification provider (age and identity verification, to run the check and resist fraud). Their cookies are not controlled by us. Each partner's notice is shown before you start, and their current names are published in our processor list at creamypeach.com/privacy/processors.
4. Browser storage we use
The Platform is a web application. To work quickly, reliably and offline, it stores the following in your browser. All of it is strictly necessary for the features described, is stored only on your device, and is never read by anyone else.
- Storage
- Local storage
- What is stored
- A cached copy of your own profile; the studio and Creator you last selected in the operator panel; emoji-picker data
- Why
- So that pages open instantly without re-downloading your profile and so that your workspace reopens where you left it
- Cleared
- When you sign out, or when you clear site data
- Storage
- Session storage
- What is stored
- Unsent message drafts; details of media you have opened
- Why
- So that a draft survives a page reload and media reopens in the right state
- Cleared
- When you close the tab
- Storage
- IndexedDB
- What is stored
- Your chat messages, stored encrypted; paid media you have unlocked
- Why
- So that conversations and purchased media work in real time and offline, and so that nothing is stored in clear text
- Cleared
- When you sign out, when you delete a conversation, or when you clear site data
- Storage
- Cache storage
- What is stored
- Application files, pages you have visited and public Creator images
- Why
- So that the Platform loads quickly and keeps working on a poor connection
- Cleared
- Automatically after 30 days, and when you clear site data
| Storage | What is stored | Why | Cleared |
|---|---|---|---|
| Local storage | A cached copy of your own profile; the studio and Creator you last selected in the operator panel; emoji-picker data | So that pages open instantly without re-downloading your profile and so that your workspace reopens where you left it | When you sign out, or when you clear site data |
| Session storage | Unsent message drafts; details of media you have opened | So that a draft survives a page reload and media reopens in the right state | When you close the tab |
| IndexedDB | Your chat messages, stored encrypted; paid media you have unlocked | So that conversations and purchased media work in real time and offline, and so that nothing is stored in clear text | When you sign out, when you delete a conversation, or when you clear site data |
| Cache storage | Application files, pages you have visited and public Creator images | So that the Platform loads quickly and keeps working on a poor connection | Automatically after 30 days, and when you clear site data |
Unlocked media stored in IndexedDB remains subject to the Terms of Service: it is for your personal viewing on the Platform, it carries a forensic watermark, and copying or sharing it is a breach.
To remove all of this at once, sign out or use "Clear site data" for creamypeach.com in your browser.
5. Personal data, transfers and retention
Some of the items above contain or can be linked to personal data (for example, your sign-in tokens or the Creator reference in the attribution cookie). We process that data as described in our Privacy Policy. The legal basis is our contract with you for strictly necessary items (Article 6(1)(b) GDPR) and your consent for everything else (Article 6(1) (a) GDPR and Article 4(5) of Law no. 506/2004).
Our security, payment and verification providers may process the data their cookies collect in the United States. Those transfers are covered by the EU-US Data Privacy Framework where the recipient is certified, and otherwise by the European Commission's Standard Contractual Clauses, as explained in clause 17 of the Privacy Policy.
Each item is kept for no longer than the lifetime stated above. Records of your consent choices are kept for 5 years after your last visit so that we can demonstrate compliance, then deleted.
6. Your rights
You have the rights described in clause 26 of the Privacy Policy, including the right to withdraw consent, to access the data we hold and to complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (anspdcp.ro), to the UK Information Commissioner's Office, or to the authority of the country where you live.
7. Changes and contact
We update this policy whenever a cookie or storage item is added, removed or changed. The version and date at the top tell you when. Material changes, such as a new category that needs consent, are announced through the banner before they take effect.
Questions about cookies: [email protected]. Our Data Protection Officer: [email protected]. Post: PEACHCREAM S.R.L., Șoseaua Iancului nr. 53, bl. 102B, sc. C, et. 7, ap. 111, Sector 2, Bucharest, Romania.
Your cookie choices
Change or withdraw your consent at any time. Withdrawing is as easy as giving it.