Account and access protection
The domain uses HTTPS. ChatGPT handles sign-in; Love Out Loud does not store your ChatGPT password. The server checks signed-in identity for profile publishing, uploads, and deletions, verifies ownership of those records, and restricts company and safety-request information to the configured site owner. Private API responses are marked not to be cached. Sign-in identifies an account and is not independent age, background, relationship, or identity verification.
Application protections
Write requests are checked for same-origin use; forms have server-side validation and bounded input sizes. Database queries use bound parameters. Uploads are limited by format, file signature, size, and profile quota; executable web content such as SVG and HTML is not an accepted upload format. File hashes help identify and block byte-identical restricted media. Security response headers reduce MIME confusion, unnecessary referrer information, and access to unneeded browser features. These measures reduce risk; they are not a complete malware scan, a penetration-test certification, or a guarantee that every harmful submission will be detected.
Public sharing and personal safety
Published profiles and files are intentionally public. HTTPS protects transport but does not make a published photo private. Others may take screenshots or save copies. Avoid private addresses, personal documents, exact whereabouts, intimate content, minors, and sensitive filenames. Embedded metadata is not automatically removed in every format. Check shared material before publication and remove it if circumstances change. Keep your sign-in account secure and sign out on shared devices.
Content and vulnerability reports
Use Help & Requests for threats, impersonation, privacy issues, nonconsensual media, or a suspected security vulnerability. No sign-in is required. Provide a location and concise description; do not upload intimate content, credentials, or exploit another person’s account to demonstrate a problem. You receive a private reference and status key. Do not share that key. Test only accounts and material you own or have explicit permission to test; this policy does not authorize unauthorized access or promise immunity or a bounty.
Incident response
For a suspected incident, the operator reviews the report, restricts affected content or access where necessary, preserves appropriate evidence, investigates with relevant providers, and takes corrective steps. If a legally reportable personal-data breach is confirmed, affected people and regulators must be notified as required by the applicable law and its deadlines. We do not promise absolute security or continuous monitoring. Contact emergency services for immediate danger.
Questions about this policy or a concern about your information?
Help & requests