Privacy Policy

• The controller: N.JULIEN, in Sion (VS), who operates IntimX under the name Artenic. For your data: privacy@intimx.ch (Art. 2 and 24).
• If you browse the site: no account, no measurement cookie, no tracker. The server log keeps of your IP address only its network, its last digits erased, for 30 days at most; from it the site derives, in memory, your country and keyed fingerprints to count visits, which we treat as personal data (Art. 4, 5 and 13).
• If you publish a profile: your account, your profile page and your photos, your identity file, kept apart and encrypted, and the team’s decisions; this data touches on your intimate life (Art. 9 and 10).
• What is public: the profile page you publish; never your identity or your hidden countries (Art. 9).
• To whom it is disclosed: to the public for the profile page, to Infomaniak, which hosts the site, to the authorities on written order, and to the other recipients Art. 15 states; never sold or rented.
• Where: the site and its backups are in Switzerland; an e‑mail goes to the provider of your mailbox, wherever it is, and WhatsApp or Telegram, if you choose them, are outside Switzerland (Art. 16).
• How long: each period, data item by data item, backups included (Art. 17).
• Your rights: access, copy, rectification, erasure, export, objection, at privacy@intimx.ch; an answer within 30 days (Art. 20 and 21).

This policy describes which personal data IntimX processes, for what purposes, on what bases, how long it keeps it, to whom it discloses it, and what your rights are, when you use the site intimx.ch.

It applies to any person who browses the site (visitors), who publishes a profile on it, solo or duo (providers), who asks to be contacted from the “Are you a provider?” page, or who subscribes to the magazine newsletter, and to the people in the trade whose contact details we keep for recruitment (Art. 8). The terms defined in the Terms of Use (Terms) apply by reference.

IntimX is a service for Switzerland: each profile presents services offered in Switzerland, from a Swiss locality, and IntimX addresses no advertising to a public outside Switzerland.

The controller (Art. 5 let. j FADP) is:

N.JULIEN Sion (VS), Switzerland Trade name: Artenic

Data protection contact: privacy@intimx.ch. The full postal address is provided without delay upon any written request to legal@intimx.ch.

The Publisher has not appointed a data protection advisor (Art. 10 FADP): this appointment is not mandatory. For any question about your data, write directly to privacy@intimx.ch.

We process your data for the following purposes, each on the basis indicated (Art. 31 FADP):

• Providing the service described by the Terms: creating and managing a provider’s account, publishing their profile page, linking two accounts into a duo profile when both members want it, showing their means of contact to the visitor who asks for them, showing them the audience of their profile page, keeping count of the people they invite through their link and the ambassador programme (Terms, Art. 9 bis), sending them the e‑mails related to their account and handing over their data to them. Basis: the contract (the Terms).
• Verifying the age and identity of each provider before any publication — and, for a provider whose identity document is that of a state outside the European Union and EFTA, their foreign national permit and its validity, until its end date — and, before a duo profile goes online, that its two members are two people. Basis: the contract, which makes it a condition of publication, and our overriding interest in never publishing a minor or a person registered by a third party (in particular Art. 182, 195 and 196 SCC), nor a person whom foreign nationals law does not authorise to work in Switzerland (Art. 11 and 116 FNIA).
• Protecting the site and people: blocking sign-in after failures, limiting per connection the registrations, the refused sign-ins, the password links, the requests for a new confirmation link, the contact requests, the newsletter requests, the callback requests, the reports and the duo codes typed; handling reports and moderating, which includes spotting the profile pages without a locality, those whose services do not correspond to the category, and the photos or means of contact that a profile page shares with another account; keeping the logs and the backups. Basis: our overriding interest.
• Counting the audience of each profile page, and hiding a profile page in the countries its provider chooses, on the basis of the visitor’s IP address (Art. 4 and 5). Basis: our overriding interest, and the provider’s interest in their discretion.
• Measuring the audience of the whole site, in totals, and the openings of referral links, per day and per channel (Art. 5). Basis: our overriding interest.
• Sending registered providers three reminders related to their account (Art. 11). Basis: our overriding interest; you can object to them at any time.
• Sending the magazine newsletter, and answering the people who ask to be contacted. Basis: your consent, which you can withdraw at any time, without effect on what was done before.
• Proving your acceptance of the Terms, and that you declared you had read this policy, with their versions. Basis: our overriding interest.
• Keeping for an authority, for a limited time, the data of an account in the cases of Art. 18. Basis: our overriding interest; handing it over on the written order of an authority (Art. 263 and 265 CrimPC): a legal obligation.
• Notifying the Federal Data Protection and Information Commissioner (FDPIC) of a data security breach, when the law requires it (Art. 24 FADP): a legal obligation.

A provider’s data touches on their intimate sphere, which the law classes among sensitive data (Art. 5 let. c FADP): we disclose it to a third party only in the cases Art. 15 states.

You browse the site without an account: we ask you for neither a name nor an e‑mail address. There is no visitor account, no review and no favourite.

The age gate: on your first visit, the site asks you to confirm that you are of age; your answer is kept in your browser by a cookie (Art. 12).

Your IP address: as for any site, your browser sends it to our server with each page. The site never records it whole: the web server log keeps only its network, its last digits erased, for 30 days at most (Art. 13). From it the site derives, in memory, your country and, depending on the use, a fingerprint computed with a secret key of the server (HMAC-SHA-256). Without this key, nobody can recover an IP address from a fingerprint. With it, one could, by trying every possible address: the key stays on our server, its backup copy is kept apart, never with the database backups, and we treat these fingerprints as personal data, erased after the periods of Art. 17.

Your country: a provider can hide their profile page from visitors in certain countries. To respect this choice, the server deduces the country of your connection from your IP address, using a table of countries (DB-IP Lite) kept on our server. This calculation is done in memory, for the duration of the page request: neither the address nor the country is recorded with your visit; the country enters only a daily total of the site statistics (Art. 5). A profile page hidden in your country answers you like a page that cannot be found. A VPN changes the deduced country.

The contact of a profile page: the number or the Telegram name it gives is shown only after you have asked for it, and this request is counted for the profile page (Art. 5). A single connection can request only 20 contacts per hour and 60 per day: beyond that, the button asks you to wait. To enforce this limit, like the other caps, the server keeps a keyed fingerprint of the connection, erased after 2 days (Art. 17), which does not say for which profile pages you requested the contact; it applies even if your browser sends the Global Privacy Control signal: it is a protection, not a statistic. The WhatsApp and Telegram buttons open these services with this number or name and a message already written, without telling them which page you come from; what you do there is governed by their own terms (Art. 16). A call takes place outside the site.

Sharing a profile page with its button is counted for the profile page, nothing more. The preview of a shared link shows IntimX’s image, never a person’s photo.

Apart from the web server log, the site keeps nothing that links your visits from one day to the next or from one profile page to another.

Profile page statistics. For each profile page, the site counts, per day (Zurich calendar): the visits, the contact requests (number, WhatsApp, Telegram), the openings of WhatsApp and Telegram, and the shares. For a visit, it also notes where it comes from, from a closed list (search engine, other site, direct link, home page, the site’s search, other profile page, magazine, other page of the site, or a list of the site by service, category and place), and in which language the site was being read; never the address of the page of origin or the words searched for.

A connection counts only once per day, per profile page and per measure. For this, the server computes a fingerprint of the connection with a secret key specific to the day, to the profile page and to the measure; an IPv6 address counts for its network (/64). This fingerprint changes every day, cannot be linked to another profile page or to another day, and is erased at the end of its day. It is not computed if your browser sends the Global Privacy Control signal: what you do on the profile page is then not counted. Only the daily totals remain, for 90 days.

Not counted: the provider themselves when their session is open — on a duo profile, both its members — the robots the site recognises, and the pages the browser loads in advance. Several people behind a single connection count as one. The figures are therefore estimates.

The provider sees only these totals, never who visited their profile page. They are erased with the profile page on the final closure of their account, and appear in the export of their data (Art. 21). Those of a duo profile are counted under the duo: both its members read them, they are erased with it (Art. 17) and appear in each member’s export (Art. 21).

Site statistics. The site counts its own page views, without a measurement cookie, without a script and without a third-party service. Each page of the site opened by a person (neither a robot the site recognises, nor a page the browser loads in advance) adds one to the day’s totals, each separately: by type of page, by language, by origin (search engine, other site, direct link, or a page of the site), by country (deduced from the IP address, in memory; only the total per country is kept) and by type of device (phone, tablet or computer, deduced from the browser’s name, which is not kept). The pages of the provider area are not counted. The site also counts how many times the age gate is shown and confirmed. The opening of a referral link, from outside the site, is counted per day and per channel (WhatsApp, Telegram, share, copy, or a link without a channel), without the code or anything that designates a person. A click on the “Publish your profile” card of a list is counted in the same way, per day, without the list’s place or category.

To count the day’s visitors, each once, the server computes a fingerprint of the connection with a secret key, the same for all the pages of a day; an IPv6 address counts for its network (/64). It changes every day, is used for no other measure, and is erased after 2 days. It is not computed if your browser sends the Global Privacy Control signal: your pages are then counted without it. With this fingerprint, the site also notes, once per visitor and per day, the name of the site they arrive from, without the address of its page; without a fingerprint, it does not note it. The name of a site from which fewer than five visitors came during the day is never shown, and it is erased once the day is over.

Each total is read on its own, without cross-referencing. Only these totals and the names of the sites of origin of at least five visitors per day remain, for 25 months, on our server. No data is transmitted to a third party.

Any person can report a profile page from its page, without an account: they choose a reason from a closed list (fake profile or stolen photos, minor, prohibited contact details or content, illegal activity, other) and can add details, 1000 characters at most. A report made by a signed-in provider is received like a visitor’s: it never names its author.

A single connection can report a profile page only once a day; after this first report, it can still make two more the same day for a minor or an illegal activity, or with words that suggest a minor or trafficking. To keep this count, the server keeps a keyed fingerprint of the connection, specific to the day and to the profile page, erased after 30 days.

A report for a minor or an illegal activity, or whose words suggest a minor or trafficking (a word filter spots them), is announced to the team at once, by an alert that contains neither a name nor a text. The filter decides nothing: a member of the team examines each report.

The details of a report are read only by the team, on the file of the reported profile page; they appear in no alert and no summary. The site never shows a report to the reported person nor, for a duo profile, to its members; an access request is examined under Art. 26 FADP, and never gives what would make it possible to recognise its author. The details are kept as long as the reported account exists, and erased 30 days after its closure — those concerning a duo profile, 30 days after the end of the duo; the report itself (its reason, its date, the kind of words the filter spotted in it and the action taken by the team) is kept for 10 years after the closure of the reported account, or after the end of the duo profile it concerns, then erased or anonymised, unless proceedings are pending.

If you subscribe to the magazine newsletter, we keep your e‑mail address, the language chosen and the dates of your request, of your confirmation and, where applicable, of your unsubscription; as proof of your subscription, a keyed fingerprint of the IP address of your request and of that of your confirmation, never the IP address in clear. Nothing is sent to you before you have clicked the link in the confirmation e‑mail; afterwards, one e‑mail when we announce a new article in your language, and nothing else. Each mailing contains a link to unsubscribe in one click.

An address never confirmed is erased 7 days after the last request, with the fingerprints of that request. When you unsubscribe, your address and the fingerprints of your subscription are erased: we keep only a fingerprint of your e‑mail address, computed with a secret key, with the language and the dates, for 24 months, so as not to write to you again. Entered again, an unsubscribed address receives no more than one confirmation e‑mail per week, and nothing else without a click.

A single connection can request the newsletter only five times a day; the trace of these requests (a keyed fingerprint of the connection) is erased after 2 days.

Basis: your consent, which you withdraw by unsubscribing.

On the “Are you a provider?” page, the form “A question? We’ll answer” lets you ask IntimX to contact you. You give a means (e‑mail, WhatsApp, Telegram or phone), your address, your number or your Telegram name, and, if you wish, your canton; we also keep the language in which you were reading the site, and the date of your agreement, given by ticking the form’s box.

By e‑mail, the request is confirmed by a click: we send you a confirmation e‑mail at once, and nothing else before you have clicked its link, valid for 24 hours. A request can name only one address, and an address receives no more than one confirmation e‑mail per day, whoever enters it. Without a click, the request is erased after 7 days. As proof of your request and of its confirmation, we keep, as long as the request exists, their dates, your e‑mail address, and a keyed fingerprint of the IP address of each of the two actions; never the IP address in clear.

Once your request is confirmed, a member of the team answers you by e‑mail. We write to you at most three times about it, at least three days apart. Each message contains a link to receive nothing more, which at once erases your request, and any other request or any other contact we keep under the same address. A program may propose these messages to the team, without reading your contact details; a member of the team approves each one (Art. 14).

By WhatsApp, Telegram or phone, a member of the team contacts you by that means; no click is asked of you, and nothing of your IP address is kept beyond 24 hours. WhatsApp and Telegram then receive your number or your username, and our messages, outside Switzerland (Art. 15 and 16).

A single connection makes only one request per day; the trace that makes this possible (a keyed fingerprint of the connection) is erased 24 hours after the request.

For recruitment, we also keep the contact details of people in the trade whom we have come to know otherwise — through a recommendation, an establishment or a partner — and who have asked us to contact them, themselves or through the person who recommends them to us: the means of contact, the language, where applicable the canton, a name, a town and notes from the team, as well as the follow-up of the exchanges. A member of the team may contact them, one at a time, never by Telegram; the site sends them no e‑mail. We tell them so at our first contact, at the latest one month after recording their contact details, together with the source of those details; without this contact, they are erased.

Each request or contact receives an invitation code; if you register with this code, your request is attached to your account. A request or a contact is erased 90 days after the last exchange, the registration or the refusal, or, without any exchange, 90 days after the request; and at the latest with the address of the account it led to, 30 days after the closure of that account.

Basis: your consent, which you withdraw through the link in each message or by writing to privacy@intimx.ch; for the people known otherwise, our overriding interest in recruiting, one person at a time, and their request to be contacted.

Registration: your e‑mail address, your password (hashed with Argon2id, never kept in clear), the display name you choose and your language. If you register through a referral link or code, IntimX keeps which link your registration comes from, when it counted and, if the team takes back the invitation, when and why (fraud or a minor). The person this link comes from sees only how many invited people have published their profile and count for that person, never your name. To whoever opens that person’s link, IntimX shows their display name and their title only if they have chosen to show them, never their stars. The team’s administrator sees who invited whom; the administrator looks at a person’s referrals in two cases: more than 4 invited people who have published within 30 days, or the taking back of an invitation for a minor.

Proof of your acceptance: the version of the Terms you accepted and that of this policy you declared you had read, their date, and a SHA-256 fingerprint of your IP address, computed with a secret key of the server. This fingerprint is lasting: the same address always gives the same fingerprint, which makes it possible to check the proof against a given address; it does not make it possible to recover the address without the key (Art. 4).

Profile, public once published: your display name, the headline, the introduction, the category (girls, men or trans), the service (escort, massage or BDSM), the locality, chosen from the official list of Swiss localities, and its canton, the languages you speak, and, if you state them, your practical info: rates per duration or “on request”, hours, dated absences, whether you receive clients or travel, services chosen from a closed list, means of payment accepted. Your phone number, with its WhatsApp mention, and your Telegram username are shown only to the visitor who asks for them. The address of your page is taken from your display name; you can change it as long as your profile page has never been published, then it no longer changes, and it remains reserved after the closure of your account (Art. 17).

Duo profile: a profile that two provider accounts hold together, their two identities verified. Its name, its texts, its practical info, its means of contact, its photos (with the name of whoever added them) and its statistics are common to both members; an added photo is public only once accepted by the other member. Each member sees, of the other member, their display name, their agreement to the duo as it is written and, in one word, whether everything is ready on their side, never what is missing; never their identity, their e‑mail address, their hidden countries or their measures, and the duo does not lead to their own profile. The person who types an invitation code reads the duo as it would be published and the display name of whoever invites them, then accepts or refuses it; the person who gave the code then sees the display name of whoever typed it, and learns in one word whether the invitation was refused, has expired or is no longer valid, never why.

An invitation code is shown only once, to the person who draws it, and is kept neither in the database nor in a log: only its fingerprint, computed with a secret key of the server. It is valid for 7 days only, and is erased when the code is used, when a new code replaces it, when the invitation is withdrawn or when the duo ends. Your hidden countries and your search engine option are copied onto your row of the duo, which the other member does not read: the duo is hidden in every country where a member hides their own profile, and withdrawn from search engines as soon as a member withdraws theirs; the other member may notice it by looking for it from those countries or in a search engine. Before it goes online, and again when one of the two identity files is decided anew, the team looks at the two files side by side and says whether they are two people (Art. 10). The team’s measures and actions on the duo, and their reason, can be read in the area of both its members; a suspension or a removal of the duo remains linked to both its members as long as it holds, even after the end of the duo (Art. 17).

The services published touch on your intimate life: you choose and publish them yourself, you can withdraw them at any time, and they are erased on the final closure of your account.

Profile, never public: the countries where you hide your profile page (ten at most, never Switzerland) and the option that withdraws it from search engines. This setting can say where you come from: it is entered neither in the audit log nor in the event log, and it is erased on the final closure of your account.

Photos: JPEG, PNG, WebP or HEIC, 12 MB at most each, 20 at most per profile. As soon as they are uploaded, their hidden data (location, device, date) is removed, original included; a HEIC photo is kept as a JPEG. The original, without metadata, is kept to remake the two WebP versions the site serves.

Sign-in: you enter your area only once your address is confirmed by the link in the e‑mail; before that, sign-in responds to you as it would to a wrong password, without counting your correct password among the failures that block your account. For each session, a random token, kept in the form of a SHA-256 hash, its dates of creation, of last activity and of expiry, and a lasting fingerprint of your IP address computed with the server’s secret key. After 10 failures in a row, sign-in to your account is blocked for 15 minutes: the trace of this block is erased as soon as you sign in or choose a new password, and at the latest 30 days after the closure of your account (Art. 17). On the page that sends a new confirmation link, the address you type is used for sending the link and is not kept; the page gives the same answer for any address.

Team decisions: the measures taken on your profile (warning, suspension, removal, lifting), their reason, taken from a closed list, and the note the team may have added to it for you; the dates on which the team, after reviewing a measure, decided to maintain it; the photos the team removed, and their reason; the removal of your profile from the lists until it is corrected, and its reason; the corrections of service, category or locality made by the team, which an e‑mail announces to you and which your profile shows. You read them in your area, except a decision to maintain: nothing announces it to you, and the export of your data gives it (Art. 21). The e‑mails that announce the others to you do not state the reason.

E‑mails: the list of the e‑mails we have sent you (their type and their dates), never their text.

Before any publication, a member of the team verifies your identity. You submit: your first name, last name and date of birth; the front of an identity document (passport, identity card, foreign national permit B, C, L or G, or foreign identity document) and, if you wish, its back; a selfie in which you hold the document next to your face, with the four-digit code the page gives you, written by hand. Each document weighs 8 MB at most. The site refuses outright a date of birth showing an age under 18.

If your identity document is that of a state outside the European Union and EFTA, the team asks you instead for your foreign national permit (B, C, L or G), checks its type and its validity before approving, and records its end date: to work in this trade in Switzerland, foreign nationals law requires an authorisation. An e‑mail warns you 30 days, then 7 days before, without stating the date: submit your new permit as soon as you have it, and your profile stays online while the team looks at it; without a new permit on the expiry date, the team asks you for it through a new verification (below; Art. 11; Terms, Art. 12). Nothing else is asked: this permit is kept like any document, and its end date with your file, in the vault. A new permit submitted before the date is kept in the same way beside your file: approved, it replaces the old one, which is destroyed, and its end date replaces that of the old one; refused, it is destroyed, and the old one remains valid until its end date.

This data is kept in a separate vault: your first name, last name and date of birth, and the code, are encrypted there (AES-256-GCM), and the documents are encrypted on disk, with a key kept outside the database. Only a member of the team in charge of verification opens them; each submission, each opening and each decision is entered in a custody log that the team can neither modify nor erase. Your selfie is never published, never compared with the photos of your profile, and never shown to an artificial intelligence program.

The decision is announced to you by e‑mail; its reason, taken from a closed list, and any note from the team are shown on the “Identity” page of your area. A new submission replaces the previous one, documents included, and erases the note of the previous decision. The team may ask you for a new verification, even after an approval: your profile page and your duo profiles then leave the site and return to draft; once the new file is approved, you put your profile page back online, and a member of a duo profile puts the duo back online after a new look by the team.

For a duo profile, once both identities are approved and before it goes online, then again when one of the two files is decided anew, a member of the team opens the two files side by side and says whether they are two people; each opening is entered in the custody log. This look — its conclusion, the two decisions it covers, who made it and when — is kept with the duo (Art. 17). A duo for which the team cannot establish that it brings together two people is suspended for fraud, and both its members are informed (Art. 11).

The documents and the selfie are kept as long as your account exists: the team may need them for a new verification, to look at the two files of a duo profile, or for an authority (Art. 18).

Your file is destroyed 30 days after the closure of your account, unless it is preserved for an authority (Art. 18). The custody log remains for 10 years after the closure, then it is erased or anonymised, unless proceedings are pending: it states when the file was submitted, opened and decided, by which member of the team and for what reason, without your name or your documents.

Apart from its team, the site writes only to the people who have or have had an account, who have subscribed to the magazine newsletter, or who have asked to be contacted. Its e‑mails leave from the address noreply@intimx.ch, through Infomaniak’s sending service (Art. 15); nobody reads this mailbox: a reply to one of these e‑mails reaches support@intimx.ch. An e‑mail never states the reason for a decision: it is shown in your area, except for a closure by the team.

To providers, the e‑mails related to your account:

• “Welcome to IntimX”, at registration, with the link to confirm your address, valid for 24 hours;
• “Confirm your e‑mail address”, with a new link, valid for 24 hours: when you sign in with the right password before confirming it, or when you request it on the page given in our confirmation e‑mails (at most one per hour and three per 24 hours), when the team sends it to you again, or when it changes your address at your request — it then goes to the new address;
• “The e‑mail address of your IntimX account has been changed”, to the address you are leaving, once only, when the team changes, at your request, an address you had confirmed; it states neither the new address nor any name;
• “Your e‑mail address was entered on IntimX”, if someone enters your account’s address to create another one; at most once per 24 hours;
• “Choose a new password”, when you have requested it; the link is valid for 60 minutes;
• “Your IntimX password has been changed”;
• “Sign-in attempts on your IntimX account”, when sign-in is blocked after failures; once per block, and at most once per 24 hours;
• the decisions on your identity: “Your identity is verified”, “Your identity file was not accepted”, “We need your identity documents again”;
• “Your foreign national permit is about to expire”, 30 days before the end date of your permit, if the team recorded it at your verification (Art. 10), then “Reminder: your foreign national permit is about to expire”, 7 days before; neither of them states the date, and they are no longer sent once your new permit has been submitted; without a new permit on the expiry date, the team asks you for it through a new verification (“We need your identity documents again”);
• the team’s measures: “A warning about your profile”, “Your profile is suspended”, “Your profile has been removed from IntimX”, “The measure taken on your profile has been lifted”;
• the team’s actions on your content: “A photo has been removed from your gallery”, “Your profile is off the lists until it is corrected”, “Our team has corrected your profile”, when a correction by the team changed something;
• for a duo profile, each member receives their own e‑mail of each measure and each action of the team on the duo, which names “your duo profile”: “A warning about your duo profile”, “Your duo profile is suspended”, “Your duo profile has been removed from IntimX”, “The measure taken on your duo profile has been lifted”, “A photo has been removed from your duo profile”, “Your duo profile is off the lists until it is corrected”, “Our team has corrected your duo profile”; no e‑mail announces a measure or an action on a duo that has ended;
• when a duo ends, the member who remains receives “Your duo profile is no longer online”, or “Your duo profile has ended” if the duo was never online; never the member who leaves, nor when a preservation keeps the other member;
• closure: “Your IntimX account is closed”, when you close it, with the link to reactivate it for 14 days; “Your IntimX account has been reactivated”; “Your IntimX account has been closed”, when the team closes it, except for a person who might be a minor or at the request of the authorities, in which cases no e‑mail is sent;
• “An invited person has published their profile”, when a person you invited publishes their profile and highlight days are due to you: it tells you until when to activate them, without naming that person;
• “Our terms change on …”, at least 30 days before a new version of the Terms and of this policy comes into force.

To providers, three reminders related to your account, each sent once at most, and only after the agreement of a member of the team, to whom a program proposes them (Art. 14):

• “Your e‑mail address has not been confirmed yet”, one day after registration, if the address is not yet confirmed and is still the one given at registration;
• “Your profile is not online yet”, two days after registration, if the profile is not published and your identity not approved;
• “Your profile can be published”, two days after the approval of your identity, if the profile is not published.

At most one message of this kind reaches you per period of 7 days. You can object to them by writing to privacy@intimx.ch; the team then refuses any reminder that is proposed to it for you.

To the readers of the magazine newsletter: “Confirm your subscription to the IntimX magazine”, then “New article: …” when we announce an article in your language (Art. 7).

To the people who ask to be contacted by e‑mail: “Confirm your contact request”, then, once the request is confirmed, at most three messages: “Your contact request on IntimX” and its follow-ups, “IntimX: your registration is still open” (Art. 8).

IntimX sets three cookies, all necessary for the site to work. As Art. 45c let. b TCA requires, we tell you here each one, its purpose, and how to refuse it:

• intimx_session: the token of your provider session. Duration: 30 days. HttpOnly, Secure, SameSite=Lax.
• intimx_age: your answer to the age gate. Duration: 365 days.
• intimx_locale: the language chosen, set only when the language being read differs from your browser’s, or when it already exists. Deleted when the browser is closed.

No audience measurement or advertising cookie, no tracker, nothing else kept in your browser. The statistics (Art. 5) are computed on our server, without placing anything on your device.

You can configure your browser to refuse cookies. Without the first two, signing in and confirming that you are of age do not work.

The web server log keeps, for each page requested, the IP address reduced to its network — the last of the four numbers of an IPv4 address erased, and everything that follows the first two groups of an IPv6 address — the browser and the other headers your browser sends with the page, except its cookies and the headers that ordinarily transmit an IP address, the address of the page without its parameters (including the address of a profile page, which contains the display name of its provider, or the name of a duo profile), the date and the server’s response; never the whole IP address, nor the port of the connection, nor the parameters of an address (a search, a confirmation link, a duo code), nor the page you come from. The web server’s error log keeps no IP address. It is used for security and diagnosis, never for statistics. No line stays in it for more than 30 days.

The system log and the logs of the site’s programs keep neither an IP address, nor a name, nor an e‑mail address, nor a text written by a person; no line stays in them for more than 30 days.

The audit log records the actions that change something on the site — a registration, a publication, a team decision, a scheduled erasure — but not a mere counted visit; the event log records what follows from them. They name each account, and each duo profile, by a technical identifier, never by its name or its address, and keep the type of the action, its date, its outcome and, for some, a key taken from a closed list (a reason, a language); never a free text, nor the invitation code of a registration. They are kept as proof of what was done: up to 10 years after the closure of the account or the end of the duo profile they name — a line that names neither, 10 years after it was written — then erased or anonymised, unless proceedings are pending.

The alerts and the daily summary the team receives contain only numbers and dates, never a name, an address or a text.

A program helps the team: it spots what is waiting — a reminder due, an e‑mail that has not left — and proposes an action, which a member of the team approves or refuses. It never decides on an identity verification, a measure, a closure or a legal text; it never reaches the vault; of a duo profile, it reads nothing — neither the profile page, nor the photos, nor the statistics, nor who is a member of it, nor the messages that speak of it — and writes nothing about it; it never writes freely to a person: a message can come only from a closed, translated and verified catalogue. Its proposals name the account concerned by its technical identifier; this mention is erased 90 days after the proposal, once it has been decided. It does not know who invited whom.

No artificial intelligence model receives your data.

We neither sell nor rent your data. It is disclosed only to the following recipients:

• The public: the profile page you publish, as Art. 9 describes it.
• The other member of a duo profile, the person to whom you give a duo code and the person whose code you type: what Art. 9 states.
• The person whose referral link invited you: a number, never your name; and anyone who opens your own link: your display name and your title, if you have chosen to show them, never your stars (Art. 9).
• Infomaniak Network SA (Geneva, Switzerland), which hosts our server (database and files) and transmits our e‑mails, as processor.
• WhatsApp or Telegram, if you ask to be contacted through one of them: your number or your username, and our messages (Art. 8 and 16).
• The authorities: the profile page as published, on the written request of an identified Swiss authority — never a duo profile, which carries the words and photos of another person and is handed over only on written order (Art. 18); any other data (identity, selfie, e‑mail address, sign-in traces, details of reports), only on written order (seizure or duty to hand over items or assets, Art. 263 and 265 CrimPC). A foreign authority is referred to the channel of mutual legal assistance (Federal Office of Justice, fedpol). On the same day, we tell the authority in writing what we keep and until when.

The site uses no other provider: no map service, no audience measurement, no advertising, no notification. The table of countries (DB-IP Lite) and the official list of Swiss localities (swisstopo) are files kept on our server: their publishers receive nothing.

The WhatsApp and Telegram buttons of a profile page transmit nothing to these services from our server: your browser opens the service with the number or the name the profile page gives and a message already written; what you do there is governed by their own terms (Art. 16).

The site and its data are hosted in Switzerland, at Infomaniak Network SA; the backup copies are kept on that server and on a server of the Publisher, in Switzerland. We entrust your data to no provider outside Switzerland. Some data does, however, leave Switzerland:

• an e‑mail we send you is delivered to the provider of your mailbox, in the country where it is located; this delivery directly serves the service you requested (Art. 17 para. 1 let. b FADP);
• if you ask to be contacted by WhatsApp or Telegram, our messages pass through these services: WhatsApp processes them in particular in the United States, at certified companies whose protection Switzerland recognises (Annex 1 of the Data Protection Ordinance); Telegram, in the Netherlands for an account opened from the European Economic Area or the United Kingdom, and, for an account opened elsewhere, in countries it does not name; you chose this means after reading, under this choice, that these services process your messages outside Switzerland, where data protection is not always that of Switzerland (Art. 17 para. 1 let. a FADP);
• a WhatsApp or Telegram button of a profile page opens these services from your browser; their servers are outside Switzerland, and what you do there is governed by their terms.

A published profile page can be read from any country, and search engines may copy it: the law does not regard this publication as a disclosure abroad (Art. 18 FADP).

Open account: your data is kept as long as your account exists, subject to the periods below. An account whose e‑mail address has never been confirmed is closed and erased 30 days after registration: what closure by the team erases at once and what is destroyed 30 days after a closure (see below) are erased and destroyed in one go, and what remains of it is what remains of a closed account. No e‑mail announces it, and the same address can be used for a new registration. An account whose address has been confirmed once is never erased in this way, even if the team later changes it at your request.

Closure by yourself: your profile page and your duo profiles leave the site at once, and your sessions are closed; nothing is erased for 14 days, and you can come back through the link in the e‑mail “Your IntimX account is closed”, or by signing in, sign-in offering it to you. After 14 days, the content of your profile page (everything you wrote and chose in it, your hidden countries), your photos and your statistics are erased; your duo profiles end and are erased at once, with what the other member wrote and added to them.

Closure by the team: the content of the profile page, the photos and the statistics are erased at once, without a grace period; the account’s duo profiles end and are erased in the same way.

30 days after closure: your e‑mail address, your password, your identity file (fields, documents, selfie, code and, where applicable, the end date of your foreign national permit), the notes written for you by the team, the list of the e‑mails we have sent you, the details of the reports concerning your profile page, the trace of the quality checks the team made on your profile page and that of a sign-in block are destroyed; your display name becomes “Account closed”.

What remains afterwards, without your e‑mail address, is kept for 10 years after closure — the general limitation period — then erased or anonymised, unless proceedings are pending: the technical identifier of the account, its dates and, where applicable, its referral code, never given to another person; the address of your page, taken from your display name or chosen before its first publication (Art. 9), reserved during that time so that no other profile takes it; the date of first publication; the reports received, without their details, and the measures taken, with the dates on which they were maintained; the trace of a quality check that also concerned the profile page of another account, when it is filed under that account; the custody log of the identity verification; the proof of your acceptance, with its IP address fingerprint; the lines of the audit and event logs.

During a preservation for an authority, the site erases as usual what it was showing; only what the preservation keeps and the identity file in the vault await its end (Art. 18).

Particular periods:

• Sessions: a session expires after 30 days; its trace (dates and fingerprint of the IP address) is erased 30 days after its expiry or its closure.
• Address your account leaves when the team changes it at your request: erased as soon as the e‑mail informing it of the change has left, and at the latest 7 days after the change; it is used only for that e‑mail.
• Profile page statistics: the day’s fingerprints (visits, contact requests, openings, shares), until the end of their day; the daily totals, 90 days.
• Site statistics: the day’s fingerprint, 2 days; the name of a site of origin from which fewer than five visitors came during the day, until the end of that day; the totals and the other names, 25 months.
• Reports: the fingerprint of the connection, 30 days; the details, as long as the reported account exists, then 30 days after its closure — for a duo profile, 30 days after its end; the report itself, 10 years after the closure of the reported account or the end of the duo profile, then erased or anonymised.
• Caps per connection (registrations, refused sign-ins, password links, requests for a new confirmation link, contact requests, newsletter requests, duo codes typed, these also counted per account, invitation codes that lead to nobody): 2 days. Callback request: 24 hours.
• Magazine newsletter: an address never confirmed, 7 days; the fingerprints of the request and of the confirmation, with the address; after an unsubscription, a keyed fingerprint of the e‑mail address, 24 months.
• Callback requests by e‑mail never confirmed: 7 days. Recruitment requests and contacts: 90 days after the last exchange, the registration or the refusal (Art. 8).
• Proposals of the program that assists the team: the account’s identifier, 90 days after the proposal is decided.
• Referrals: an invitation that never counted, 12 months after registration; the link between two accounts, with the account of the person who refers, or with that of the invited person, who then remains only a number for the other if they had counted; the days and the highlights, with the account; the openings of links, 25 months, like the site statistics.
• Duo profile: it ends when a member leaves it, or when the account of a member is closed for good. It is erased 14 days after its end — its texts, its photos and their files, its statistics, the reasons for the photos the team removed from it — at once if it was never linked or on the final closure of a member’s account. 30 days after its end, its name, the details of its reports, the notes the team wrote with its measures and the “Looked at” marks filed under it go; and so do who was a member of it and the team’s look at the two files (its conclusion, the two decisions looked at, who and when), except as long as a suspension or a removal weighs on the duo, a report for a minor concerns it or a report on it remains open, never beyond the purge of both accounts; the e‑mails that spoke of it to its members then forget the duo. A request to join a duo that did not succeed goes 30 days after its end. The audit keeps each member’s actions, as for any account; the duo’s row — its address, its state, its dates — its reports and the team’s measures remain on file, as for a profile whose account is closed.
• Web server log and system log: 30 days at most.
• Acceptance log, custody log of the identity verification, audit log and event log: as proof, up to 10 years after the closure of the account or the end of the duo profile they name — a line that names neither, 10 years after it was written — then erased or anonymised, unless proceedings are pending.

Backups: every night, the database and the files (photos and encrypted documents) are backed up. A data item erased from the site remains in the backups for up to 14 days for the database, and up to 21 days for the photos and the documents; the copy kept off the server, encrypted in full, follows the same periods. The documents and the identity fields remain encrypted there.

In three cases, a copy of what an account contains is set aside before any erasure: when the team closes an account because the person might be a minor; when it closes it at the request of the authorities; and when a Swiss criminal authority, whose request has been verified, asks for the data of an account to be kept, the account then remaining open.

This copy contains: the profile page as it was, with its dates and the address of its page; the originals of the photos, removed from the gallery; the e‑mail address and the dates of the account; the identity file — its documents and the selfie are copied into the preservation, and its fields and its code remain in the vault without being destroyed; the dates and the IP address fingerprints of the account’s sessions; the reports concerning the profile page (their reason, their details, their date and the action taken, never who made them); who invited the person to IntimX, and whom they invited there, with the dates of these invitations. Nothing else that concerns another person, apart from these invitations and what the following paragraph keeps.

A preservation concerning an account also keeps each duo profile of which this account is or was a member — its content, its reports and a copy of its photos, those the other member added included, and, of a duo already erased, what the database still holds of it, its row and its reports — without the other member knowing; a duo is never handed over with the profile as published, only on written order.

It is encrypted under a key of its own. Only an administrator of the team can open it, and each opening is entered in advance in a custody log. No automated program and no artificial intelligence model accesses it.

It is kept for 90 days. At the written request of the authority, it can be extended once by 90 days; beyond that, only during a seizure or a duty to hand over items or assets ordered in writing. It is destroyed automatically when it expires, or earlier if the authority confirms in writing that it no longer needs it; the ordinary erasures then resume. Its handover follows Art. 15.

An image that might fall under Art. 197 SCC is neither opened nor handed over by our tools: it is removed from the site, reported to the police, and destroyed 30 days after this report, with its copies.

During a preservation, the site erases as usual what it was showing; only the copy and the identity file kept in the vault await its end. When the team closes an account because the person might be a minor or at the request of the authorities, no e‑mail is sent to the person, nor to the other member of one of their duo profiles, and the reason for the closure is written only in the preservation, and is destroyed with it.

IntimX implements, in particular, the following measures:

• Separation: a PostgreSQL database in four schemas (application, vault, system, team) and five roles with distinct passwords — one per program (the site, the sending of e‑mails and the scheduled tasks, the program that assists the team), one for the team’s console, one for structural changes. Each role refuses another’s password.
• Vault: your e‑mail address, your hashed password and your identity file are in a separate schema; the address your account has just left waits there until the e‑mail that informs it of the change has left (Art. 17). The program that assists the team has no access to it. The e‑mail sending program reads there, through narrow doors, only the address of an account at the moment of sending, or that former address, which it forgets as soon as the e‑mail has left, and which accounts are awaiting the reminder of the end date of their foreign national permit, without that date; it erases the other data there only when it expires, without ever holding the encryption key.
• Encryption at rest: your first name, last name and date of birth, the selfie’s code and the identity documents are encrypted (AES-256-GCM), with a key kept outside the database and outside the backups.
• Passwords hashed with Argon2id; session tokens kept in the form of a SHA-256 hash; fingerprints of IP addresses and of a duo’s invitation codes computed with a secret key (HMAC-SHA-256), which only the site holds, also kept outside the database backups.
• Transport: HTTPS mandatory, in TLS 1.3 only; Secure cookies.
• Requests: the origin of any request that modifies something is checked; SameSite cookies.
• Row access: each table of personal data, in the application and vault schemas, enforces PostgreSQL’s row-level security, including on the owner role. The site writes to the audit log, the event log and the sending queue only through narrow doors, and reads nothing there.
• Lockout: after 10 failed sign-ins, 15 minutes of blocking; beyond 30 refused attempts in one hour from a single connection, that connection is slowed down; a single connection can request only 20 contacts per hour and 60 per day (Art. 4).
• Logs: the audit log, the acceptance log and the custody log can only be added to. Apart from the web server log (Art. 13), no log and no alert contains a name, an e‑mail address or a text written by a person.
• Team console: never accessible from the Internet, only through an encrypted tunnel; it is entered with a passkey or a printed recovery code, never with a password; an identity document or a preservation opens there only after a new confirmation made with a computer’s passkey or a security key.
• Backups: every night, encrypted then copied off the server, onto a server of the Publisher in Switzerland where our server can add a copy but never erase one; the key that decrypts them is kept offline, neither on our server nor on the Publisher’s, and neither the vault’s encryption key nor the fingerprint key is among them.
• Breaches: we keep a register of data security breaches, and we notify them to the FDPIC, and to the persons concerned, when the law requires it (Art. 24 FADP).

Under the FADP (Art. 25 to 29 and 32), you can:

• request access to your personal data and obtain a copy of it, free of charge;
• have inaccurate data rectified. Your profile is corrected in your area; a duo profile too, by each member, the other member accepting each modification. An e‑mail address mistyped at registration cannot be corrected: the confirmation link went to the address typed, and one enters one’s area only after opening it; you then create a new account with the right address. A confirmed address is changed by the team, at your request, on one of these two proofs: a written request sent from that address to privacy@intimx.ch; or, if you no longer have access to that mailbox, a new identity file, which the team asks you to submit and which it approved less than 30 days earlier (your profile page and your duo profiles leave the site until this approval, then you put them back online; Art. 10). A confirmation link is then sent to the new address, and your open sessions are closed: you sign in again once the new address is confirmed. The address left receives an e‑mail stating the change, without the new address; it is kept only for that e‑mail (Art. 17);
• request the erasure of your data: you close your account yourself from your area (Art. 17); there you can also leave a duo profile, which is then erased at the latest 14 days after its end (Art. 17); for the magazine newsletter or a callback request, the link in each message is enough;
• receive your data in a structured format, or have it transmitted to another controller (Art. 21);
• object to processing based on our overriding interest, including the reminders (Art. 11);
• withdraw your consent at any time, without effect on what was done before.

Certain data is kept despite an erasure request, for the periods of Art. 17: the proofs (your acceptance, custody log, audit and event logs), the backups until they expire, and what a preservation for an authority keeps (Art. 18).

On request, we also tell you when your identity file was submitted, opened and decided, according to the custody log.

We may refuse, restrict or defer an answer in the cases the law provides for (Art. 26 FADP), for example to protect a third party; we then give you the reason.

To exercise your rights, write to privacy@intimx.ch, from your account’s address if you have one. We answer within 30 days; if your request requires more time, we tell you so before the end of this period, with the period expected.

You can report a processing operation to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (edoeb.admin.ch), which may open an investigation (Art. 49 FADP); a dispute is brought before the civil courts (Art. 32 FADP).

From your area, on the “Account” page, you download your data in one file (structured JSON format):

• your account: display name, e‑mail address, language, dates of registration and of confirmation;
• your acceptance of the texts: the versions of the Terms and of this policy, the latter declared read, and their dates;
• your sign-ins: the dates of each session;
• your profile, with your practical info, your hidden countries and the search engine option;
• the list of your photos, and those the team has removed since your last addition, with their reason; your photos themselves are handed over to you on request to privacy@intimx.ch;
• the list of the e‑mails we have sent you (type and dates);
• the daily totals of your profile page’s statistics, over 90 days;
• the moderation decisions concerning you, with their reason, the team’s note and the dates on which the team decided to maintain them;
• referrals: your referral code, the number of invited people who have published their profile and count for you, and your own invitation (its dates and, as long as the account of the person whose link you came through exists, its code; never the name or the account of that person); your highlight days and your highlights;
• your identity file: its status, the decision, its reason and its note, your first name, last name and date of birth, where applicable the end date of your foreign national permit and the status of the new permit you have submitted (under review or refused, with its reason and its note), and the list of the documents submitted. The documents themselves are handed over to you on request to privacy@intimx.ch.
• the duo profiles you are or were part of, until their erasure: what they say and their dates, whether you created them, your settings (your agreement to their going online, your hidden countries, the search engine option, your dates of joining and leaving), the list of the photos you added to them, the photos the team removed from them (their reason and their date, whichever member had added them), the daily totals of their statistics, and their moderation decisions, with their reason, the team’s note and the dates on which they were maintained;
• a duo profile already erased, during the 30 days following its end, and beyond that as long as a suspension or a removal by the team binds you to it: that you were its member (whether you created it, your dates of joining and leaving), its end, its erasure and its moderation decisions.

Never the data of the other member of a duo, nor the union of your hidden countries.

IntimX is reserved for adults (aged 18 or over). An age confirmation is requested on first access, and identity verification refuses anyone under 18. Pornographic photos are prohibited (Terms, Art. 8).

IntimX does not knowingly collect data from minors. If we learn that a minor has opened an account, the team closes it at once: their profile page, their photos and their duo profiles leave the site and are erased from it, a copy is kept for the authorities under Art. 18, and no e‑mail is sent, not even to the other member of one of their duo profiles.

Any report concerning a minor is handled with absolute priority: the team is alerted at once. In an emergency, also write to legal@intimx.ch.

The Publisher may amend this policy. A significant amendment is announced by e‑mail to the holders of an open account, at least 30 days before it comes into force. The date of the version in force is indicated at the top of the document. Previous versions are available on request at support@intimx.ch.

For any question about the protection of your data:

Controller: N.JULIEN Contact: privacy@intimx.ch

For general questions: support@intimx.ch For urgent reports (minor, trafficking) and the authorities: legal@intimx.ch

Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern, Switzerland edoeb.admin.ch