Everything here stays in our own system
We don't use any third-party email or SMS/OTP service to run your account. No outside company ever receives your email, phone number, or password to send you anything — account creation, login, and password recovery all happen entirely inside Boo's own systems, backed by our own database. The practical effect: nothing about your account ever passes through a mail provider, a texting API, or any other outside service as part of normal account use.
What we collect, and why
- Email & phone number — to identify your account and, for phone, so a creator or admin can reach you about a booking. Both are checked for duplicates at signup so you can't end up with two accounts by accident.
- Password — stored only as a bcrypt hash. This is a one-way transformation; even we can't reverse it back to your actual password.
- Recovery code — generated once at signup for self-service password recovery. Also stored only as a hash, and shown to you in plain text exactly once, at the moment it's created. If you lose it, we can't retrieve it — that's by design, the same reason your password can't be retrieved.
- Date of birth — self-attested at age verification, to confirm you meet the 18+ requirement.
- For creators: an identity-check selfie — used only to confirm your face matches your profile photo before your profile goes live.
- Payment records — for crypto payments, the wallet address you paid from and the transaction hash you submit. We never collect card numbers, bank details, or crypto wallet private keys/seed phrases — we only ever ask for a public transaction reference.
- Activity relevant to your account — bookings, messages, support conversations, and account changes, so support and moderation can actually function.
If you lose access to your account
The recovery code above handles this automatically and instantly — no human, no waiting. If you've lost that too, you can file a request describing your situation; an admin reviews it and, once satisfied it's really you, issues a one-time temporary password that they relay to you directly (by whatever contact method you used to reach them). That temporary password is generated fresh, shown to the admin exactly once, and never stored anywhere in plain text either.
Who sees what
- Platform admins can see your account details, booking history, and messages when needed for support or moderation — every one of those actions is itself logged.
- A creator you book with sees what's necessary to fulfill that booking (e.g. your phone number, once you book) — not your full account.
- We do not sell your data to anyone, and we don't share it with advertisers.
Cookies
We use one functional session cookie to keep you logged in, and a small cookie to remember you've passed the 18+ age gate. No third-party tracking or advertising cookies.
Deletion
Closing a creator profile deactivates the account and permanently removes uploaded photos/content; financial history (bookings, payments, payouts) is retained as required for accounting and legal record-keeping even after an account is deactivated.