Tool Tutorial PSA and Guide to protect yourself as a Developer

[iopq]

As a creator, it is your due diligence to protect yourself from bad actors and other pitfalls.

Identity:
Anonymity is your friend. Never do anything to jeopardize revealing personal information. This includes things like taking private commissions or donations to something like a personal Paypal -- even if it is from a long-time 'supporter' and seemingly 'safe'. I've now witnessed multiple occurrences of someone getting dox'd under the guise that a 'supporter' wanted to help them out by circumventing a monetization platform's cut. Do NOT fall for this or anything similar. I'd strongly advise even keeping things like your country and location unknown. The only people that should have any information at all on you are the billing agencies and platforms that require it so that you can be paid.


Content:
Just because your content and art satisfies the guideline(s) of this website and others like it, you might find yourself violating several other ToS. These can result in the termination of your account(s) across services, not to mention potential legal headaches.

Contrary to popular belief, your text and dialogue in your game is more important than its art and images.
For example, even if the art in game clearly only depicts elderly women, even making something like an obvious 'joke' that one is below the age of an adult will result in your game getting nuked without questions if someone decides to report it.
Keep explicit ages in dialogue out of your game entirely. If you want to include anything involving ages in your game set their default to at least 18+ and never mention or imply that this is not the case.

Any "Disclaimers" at the start or even throughout of your work are NOT sufficient in order to protect you, and will not circumvent this. However, it is highly recommended (and required in some cases) to include one anyway. It does not matter the content being portrayed, the insistence that the work is 'fiction', or anything of the like. The only thing that matters in this regard is the explicit text in your game. Assume that text can be put in a vacuum and viewed without context or knowledge. Tread especially lightly with anything that is or could be considered taboo. Being brazen against this line of thinking will only result in you getting burned. This juice isn't worth the squeeze.. not even worth looking at.
The amount of creators that find this out the hard way grows constantly. It is actually exceptionally rare that art alone will get you in trouble. Regardless, make sure you're following the guidelines of this website.


Community:
Apps such as discord are a powerful tool to foster communication and feedback. Again, protect your identity and don't let emotion cloud your judgement. Be weary and conscious of not only links and files, but invites to other servers. If you've seen the disgusting lengths that some of these misguided white knight e-soldiers have gone to target creators that I have you'd be shocked. I would strongly recommend having a 2nd or 3rd discord account if you value these services as your primary method of your communication. It's very easy to access multiple accounts through something as easy as another browser window. Treat your primary accounts to these services in a protective manner. I would honestly do any type of exploring or extra communication/networking through an alternate account. Do not become overly reliant as your account may be suspended or banned through no fault of your own.


I will add more to this in the future, but given the current climate a thread like this is long overdue. It's been painful watching friends and people I have worked with fall victim to these avoidable mistakes. Do not think that because your content is 'vanilla' that you are safe from some attention starved individual randomly deciding to ruin your day.
In the meantime feel free to point and discuss anything you feel is vital in regards to the topic.

 

[sortakinda]

Also keep in mind just because it's legal now does not mean it's still legal tomorrow and that you won't get prosecuted retroactively.

Yes it's ridiculous that you need to have similar OPSEC to a drug dealer when you're essentially making visual novels, but that's the moronic dystopian shitshow we're living in now.

 

[CometaInteractive]

Disclaimers are completely tenuous from a legal perspective, if you break the law, you break the law. It's that simple.

Having a strong disclaimer for your adult game is important in the situation that someone would make a libelous claim against you or the game. The disclaimer should outline clear age guidelines for players and characters and clarify that all content is consensual in nature. Here's my current disclaimer:

Adult Content Warning

This game contains explicit sexual material inteded for adults only (18+).

By continuing, you confirm you are of legal age to view such content in your country/jurisdiction and consent to viewing adult content.

I am 18 or older - Continue

I am under 18 - Exit

Disclaimer: All characters, events, and locations in this game are fictional. Any resemblacne to real persons, living or dead, is purely coincidental. All Sexual acts depicted are consensual and all characters are 18 or older. This games contains explicit adult content intended for adults only. Viewer discretion is advised. The creators do not endorse or condone any illegal activities or abuse in real life.

If anyone has any advice or strengthening it further, would be good to hear. Really great idea for a thread and something to be taken seriously. People shouldn't get in trouble or be socially punished for creative pursuits that are not or do not intend harm.

 

[iopq]

Disclaimers are completely tenuous from a legal perspective, if you break the law, you break the law. It's that simple.

Having a strong disclaimer for your adult game is important in the situation that someone would make a libelous claim against you or the game. The disclaimer should outline clear age guidelines for players and characters and clarify that all content is consensual in nature. Here's my current disclaimer:



If anyone has any advice or strengthening it further, would be good to hear. Really great idea for a thread and something to be taken seriously. People shouldn't get in trouble or be socially punished for creative pursuits that are not or do not intend harm.

Pretty standard, but Fwiw I always put and advocate to include that it is designed for entertainment purposes only, and also explicitly state that it contains sensitive topics and subject matter(even if it's vanilla as hell), and usually hide the "continue" option in the agreement to that.
ie) If you have read and understood this then click "here" (or somewhere specific on the screen) to continue.



But yeah pretty meaningless at the end of the day, the thing that matters most is the text in your game.

 

[CometaInteractive]

Yeah I was just thinking it's probably best to split up the age gate and the disclaimer into two screens. Expand the text on each a bit so it's more comprehensive.

But yeah pretty meaningless at the end of the day, the thing that matters most is the text in your game.

Definitely this. TOS for Patreon forbids a bunch of stuff beyond obvious age related content. Always read the fine print is important here i guess.

 

[eevkyi]

Anonymity is your friend. Never do anything to jeopardize revealing personal information. This includes things like taking private commissions or donations to something like a personal Paypal -- even if it is from a long-time 'supporter' and seemingly 'safe'. I've now witnessed multiple occurrences of someone getting dox'd under the guise that a 'supporter' wanted to help them out by circumventing a monetization platform's cut. Do NOT fall for this or anything similar. I'd strongly advise even keeping things like your country and location unknown. The only people that should have any information at all on you are the billing agencies and platforms that require it so that you can be paid.

While I agree that deliberately exposing personal data is not a good idea, it's naive to think that it's possible to remain anonymous while having an online presence or receiving payments through any means. The simple act of accessing the internet already puts privacy at risk to some extent, no matter how much you try to protect yourself.

Like any platform/website, monetization or crowdfunding services, and even payment processors, can suffer data breaches due to security vulnerabilities or even a disgruntled former employee. It's difficult to remain anonymous even using cryptocurrencies, since a large part of blockchains are public and at some point you will end up wanting to convert the money to fiat directly or indirectly.

Regarding the use of personal payment accounts, in many countries opening a company is not only very expensive, but also exposes your personal data even more due to certain mandatory public records. Unfortunately, taking some risk is inevitable, especially if you need to offer services to third parties to pay your bills.

 

[iopq]

While I agree that deliberately exposing personal data is not a good idea, it's naive to think that it's possible to remain anonymous while having an online presence or receiving payments through any means. The simple act of accessing the internet already puts privacy at risk to some extent, no matter how much you try to protect yourself.

Outside of a data breach, this is just false.
Even a site as terrible as Patreon (especially post breach), gets a commendation in regards to creator privacy.

If you take the necessary precautions you will be fine, and there are so many added layers you can pile on it becomes even more unfeasible unless you make a severe mistake. Usually in the form of falling for social engineering or a honeypot.

It is worth noting that this is easier said that done. Most people fail before they even start simply by reusing a username or password with prior connections. For observation and anonymity purposes there is no reason not to clone a username that already exists somewhere. Unless you're undisciplined or care about meaningless online ego you're pretty much completely safe.

If someone did have the genuine skill required to unveil someone the reality is their market is going to be much higher than an adult game/VN creator, and I'd be willing to bet money it's more for the 'lulz' than any malicious intent.

 

[eevkyi]

Outside of a data breach, this is just false.
Even a site as terrible as Patreon (especially post breach), gets a commendation in regards to creator privacy.

If you take the necessary precautions you will be fine, and there are so many added layers you can pile on it becomes even more unfeasible unless you make a severe mistake. Usually in the form of falling for social engineering or a honeypot.

It is worth noting that this is easier said that done. Most people fail before they even start simply by reusing a username or password with prior connections. For observation and anonymity purposes there is no reason not to clone a username that already exists somewhere. Unless you're undisciplined or care about meaningless online ego you're pretty much completely safe.

If someone did have the genuine skill required to unveil someone the reality is their market is going to be much higher than an adult game/VN creator, and I'd be willing to be money it's more for the 'lulz' than any malicious intent.

Using only browser fingerprinting and certain data cross-referencing, it's perfectly possible to identify someone. Your internet/vpn/proxy provider and their employees can easily know your online habits. Even using tor/i2p/etc it's impossible to remain 100% anonymous, and it doesn't take a serious mistake for your privacy to be compromised.

A developer or freelancer will inevitably have interconnected online footprints, resulting in a vast amount of seemingly harmless information that will ultimately lead to other data, often with little or no effort. Adopting an overly paranoid stance on privacy is not only useless but can also generate distrust among potential supporters and consumers.

 

[CometaInteractive]

In terms of protecting our privacy in our normal day-to-day activities, iopq is completely correct. Outside of a data breach, companies like Patreon for example have a legal responsibility to keep your data private. Any damage in this regard will cost them a fortune so this is something they take seriously.

Learn basic OPSEC and how to manage your accounts, don't take payment directly, don't leak info yourself. This is entry-level opsec that anyone working in a business that handles sensitive data needs to be aware of. A lot of security breaches at companies are caused by social engineering, not because the IT infrastructure doesn't work.

 

[eevkyi]

In terms of protecting our privacy in our normal day-to-day activities, iopq is completely correct. Outside of a data breach, companies like Patreon for example have a legal responsibility to keep your data private. Any damage in this regard will cost them a fortune so this is something they take seriously.

Obviously, nobody should take unnecessary risks like sharing their address or revealing their daily whereabouts to strangers online, but from the moment you need to hand over your personal/financial data to certain services and companies, your privacy is permanently at risk. Even though numerous laws supposedly protect you, you have no control over how those companies and their employees will handle your data. And, being a small developer/independent professional who counts every penny, you'll hardly be able to seek redress through the judicial system, especially if you're in a different jurisdiction.

In such a scenario, any excessive concern with privacy won't offer any real protection, because you've already had to outsource the main responsibility for this issue in order to carry out your activities, to receive payments, etc.

Learn basic OPSEC and how to manage your accounts, don't take payment directly, don't leak info yourself. This is entry-level opsec that anyone working in a business that handles sensitive data needs to be aware of. A lot of security breaches at companies are caused by social engineering, not because the IT infrastructure doesn't work.

Some people simply have no other viable option besides receiving money directly. Some people may also prefer to pay directly to have legal proof that they paid that specific person and minimize the risk of falling victim to a scam.

No matter how paranoid you get about opsec, you will always be at the mercy of the services you need to use/provide your data to, and they won't always take good care of it, or tomorrow a new vulnerability may emerge that puts everything at risk.

 

[iopq]

Obviously, nobody should take unnecessary risks like sharing their address or revealing their daily whereabouts to strangers online, but from the moment you need to hand over your personal/financial data to certain services and companies, your privacy is permanently at risk. Even though numerous laws supposedly protect you, you have no control over how those companies and their employees will handle your data. And, being a small developer/independent professional who counts every penny, you'll hardly be able to seek redress through the judicial system, especially if you're in a different jurisdiction.

In such a scenario, any excessive concern with privacy won't offer any real protection, because you've already had to outsource the main responsibility for this issue in order to carry out your activities, to receive payments, etc.

Not sure what to tell you. Maybe you're just young or inexperienced. Aside from that you're directly contradicting your own "points" making them moot. The equivalent of what you're saying is to stay indoors so you don't get struck by lightning.

As already mentioned the companies handling your data already have a vested interest to protect it, as they will be the ones taking the brunt of the blow if anything is to happen. Even in a fairy tale scenario where this is not true, you can still take precautionary measures.

Not directed at you but just to be clear nobody here is condoning or supporting any illegal activity, this thread is merely to point out considerations that might be overlooked that can lead to severe consequences.

Some people simply have no other viable option besides receiving money directly. Some people may also prefer to pay directly to have legal proof that they paid that specific person and minimize the risk of falling victim to a scam.

Absolutely false, and the latter is actually how you get scammed or compromised in the first place.
The rest is usually chalked up to personal greed, dire situations, or flat out ignorance.

 

[eevkyi]

Not sure what to tell you. Maybe you're just young or inexperienced. Aside from that you're directly contradicting your own "points" making them moot. The equivalent of what you're saying is to stay indoors so you don't get struck by lightning.

As already mentioned the companies handling your data already have a vested interest to protect it, as they will be the ones taking the brunt of the blow if anything is to happen. Even in a fairy tale scenario where this is not true, you can still take precautionary measures.

Not directed at you but just to be clear nobody here is condoning or supporting any illegal activity, this thread is merely to point out considerations that might be overlooked that can lead to severe consequences.

There's no contradiction in the obvious: Developing any kind of creative work/activity online and offering ways to receive some kind of payment will always involve privacy risks, even more so when you inevitably need to entrust the security of your data to third-party services. Taking certain basic precautions is important, but don't delude yourself into thinking you're safe and anonymous just by following an opsec guide in a scenario that involves dealing with financial transactions and a persistent online presence.

Absolutely false, and the latter is actually how you get scammed or compromised in the first place.
The rest is usually chalked up to personal greed, dire situations, or flat out ignorance.

I strongly recommend that you research the costs of opening and maintaining a company in certain places with little or no government incentives for entrepreneurship. I also recommend that you research in more depth the different laws around the world that require the personal information of business owners to be publicly available (often including address and phone number) and how much this results in attempted scams against these people.

Regarding additional risks, it's much easier for an anonymous user to use third-party data within a payment intermediary to commit scams than for a real person with an easily verifiable reputation to do the same.

 

[TDoddery]

If anyone has any advice or strengthening it further, would be good to hear. Really great idea for a thread and something to be taken seriously. People shouldn't get in trouble or be socially punished for creative pursuits that are not or do not intend harm.

You could spell "intended" properly