Leaving an OnlyFans agency: what trans creators should secure first

Leaving an OnlyFans agency safely comes down to order. Read the contract, record evidence while access still works, then take back the email, two-factor settings, each platform and its payouts. Give notice last.

For trans creators, the exit has extra items. The agency may hold a legal name that is a former name. It may also hold chat scripts in the creator's voice and notices filed in that name. This guide is written by Beloura, a management agency built for trans creators. It explains the process in general; it is not legal advice.

How to leave an OnlyFans agency without losing access: the order

1. Read the written agreement before anything changes.
2. Record the chats, scripts, analytics and leak links the agency holds.
3. Secure the email account, because password resets go there.
4. Move two-factor authentication (2FA, a second login check such as a code from an app) to a phone the creator holds.
5. Take back each platform, and end sessions the creator does not recognise.
6. Remove agency-written text still on the accounts.
7. Check payouts and keep the earnings records.
8. Give notice in writing, with the requests listed below.

The agency problems this guide plans for

Any creator can be let down by an agency. Some failures land differently on trans creators, and they change what needs securing on the way out.

• Neglect. An agency that loses interest may stop checking in and stop answering, while it still holds the passwords. That case has its own section below.
• Misgendering or a former name in chats. Chatters write as the creator. A former name is what many trans people call a deadname. A chatter who uses it, or the wrong pronouns, says so in the creator's voice.
• Fetishising scripts. Some chat scripts and captions sell the creator's identity or body as a category. Fans read them as the creator's own words.
• Outing. An agency may hold the legal name from ID checks, payout forms and contracts. If it differs from the name the creator uses, careless handling can out them to fans, family or an employer.
• Notices filed in the wrong name. Takedown notices filed with a legal name can put that name into a public record.

Step 1: read the contract before anything changes

Some contracts limit changes before notice, or give the agency rights over accounts it set up. Read the agreement first.

The standard terms are the notice period, commission after the exit date, content ownership, and who owns accounts the agency created. On content, US copyright belongs first to the author, which may be whoever filmed or photographed the work. A transfer of ownership must be in writing and signed, but usage rights can exist without one. Any content clause needs legal advice.

Then check the terms that matter more for trans creators.

• Confidentiality. Whether the agency must keep the legal name, ID and personal details private after the exit. Check the clause covers the creator's details, not only the agency's.
• Marketing use. Whether the agency may name or show the creator on its website, roster, social posts or pitch material after the exit. Also whether it describes creators by category.
• Records in a former name. Whether the contract, invoices or tax forms the agency keeps use a former name. Also who inside the agency can see them.

If there is no written agreement, ask the agency to confirm its terms in writing before giving notice. Where a clause stops the creator changing logins, get legal advice before Step 3.

Step 2: record what the agency holds while access works

Once an agency knows a creator is leaving, it can remove access to scripts, saved replies and analytics. These records can support a written complaint, a dispute over commission or ownership, or a platform report.

1. Screenshot the chat scripts, saved replies and mass messages the agency wrote.
2. Screenshot any chat where a chatter used the wrong pronouns, a former name or a category label.
3. Export or screenshot the analytics and payout history for the last few months.
4. Write down every place the legal name sits: ID checks, payout accounts, tax forms, the contract, and any shared drive holding ID scans.
5. Ask the agency, in writing, for every leak link it reported and its status: live, removed, delisted or non-complying.
6. In the same message, ask which name each notice was filed under.

Store these records privately. If they are ever shared, crop out fan usernames first.

Then fill in one row per account. Anything the creator does not hold today goes to the top of the list.

Accounts verified with whose ID

The "verified with whose ID" column matters most. An account the agency verified with someone else's ID, or registered under a former name, may be hard to reclaim later. Ask the agency in writing which ID and which name each account was set up with. The guide on legal names and ID checks covers where the legal name appears on each platform.

Step 3: take back email, 2FA and each platform

Password resets go to the email account, so whoever controls the email controls everything else. Secure it first.

The email account

For Gmail, using Google's own help pages linked under Sources:

1. Change the password.
2. Under Security and sign-in, check 2-Step Verification. Remove any phone, authenticator app, security key or passkey the creator does not hold.
3. Create a new set of backup codes. Google says the old set then stops working.
4. Replace any recovery phone or recovery email that belongs to the agency.
5. Remove delegates (Settings, Accounts and Import), turn off forwarding, and delete filters that forward mail elsewhere.
6. Remove third-party apps the creator does not recognise, and sign out of unknown devices under "Manage all devices".

Google says that after recovery details or other sign-in factors change, it may send codes to the previous details for 7 days. A recovery phone change can also take up to 7 days. During that window, the agency's phone or inbox may still receive codes, so watch for sign-in alerts.

Instagram

1. Change the password, then turn on two-factor authentication in Accounts Center, under Password and security.
2. Check recent login activity for devices the creator does not recognise.
3. Change the email and phone to the creator's own. When the email changes, Instagram sends a link to reverse it to the original address. If that address belongs to the agency, the agency gets the link. Do steps 1 and 2 first, and expect a possible reversal.

OnlyFans and Fansly

Work through each account's own settings in the same order as the email. Change the login email, then the password. Turn on two-factor authentication where the platform offers it, and end any sessions the creator does not recognise where the platform lists them. Check the payout details last. Each platform's own help centre shows where these settings sit.

Details that can lead back to a legal name

Trans creators can be outed by account details nobody looks at. On each account, check:

• the name on the profile and the contact details on each account, in case they hold a former name;
• which phone number and email the agency put on file, in case they lead back to the legal identity;
• which inbox gets sign-in alerts and reset emails, since these can show the account holder's name.

Agency-written words still on the account

Text the agency wrote stays live after it leaves. Fans keep reading it as the creator's own voice.

1. Cancel any posts or messages the agency set to go out later.
2. Rewrite any automatic messages and saved replies the agency wrote.
3. Review the bio, pinned posts and captions for the wrong pronouns, a former name or category labels.

Content and fans after leaving

Fans subscribe to the account, not to the agency. Whoever controls the account after the exit keeps the relationship and the message history.

• Content copies. Download the creator's own copies of the vault and of content the agency holds on shared drives before access changes.
• Fan messages. Keep the message history on the account. The chatters' notes about fans may sit in agency tools the creator cannot reach.
• Accounts the agency created. Reddit, X or link-in-bio pages set up by the agency should hand over with their email and 2FA. If the agency refuses, the contract terms from Step 1 decide what happens next.

Switching OnlyFans agencies works the same way. Take back every login before the new agency is given access, and give the new agency its own access where the platform allows it.

If the agency has gone quiet

An agency that has gone quiet adds its own problem: it may still hold the passwords.

1. Send a dated written request for the logins, the leak link list and the analytics, with a date for a reply.
2. Keep a copy of the message and any reply.
3. If no reply comes, use each platform's own account-recovery route through the email the creator controls.
4. If the email itself is held by the agency, use the email provider's recovery route first.

Payouts and records for the exit month

Check that the payout account, and the name on it, belong to the creator. Keep the payout statements and earnings history for the exit month and the months before it. They help with any dispute over commission, and with planning when income is uneven.

Giving notice

Give notice in the form the agreement requires, and keep a copy. In the same message, ask the agency in writing to:

• delete every copy of the creator's ID documents;
• stop using the legal name;
• remove any listing of the creator from its website, roster, social posts or pitch material, and stop describing the creator by category.

Keep the reply.

Names on takedown notices the agency filed

Where the legal name is a former name, a public notice can link that name to the creator's handles. Google shares parts of each copyright removal request with Lumen, a public research database. The shared fields include the requester's name and the rights holder's name. Google says it never shares the contact fields, such as the email address.

1. Ask the agency which name it put in the requester and rights-holder fields.
2. Keep that answer with the link list from Step 2.
3. Know the limit of agent filing. US law allows a notice signed by someone authorised to act for the owner. That changes the requester name, but Google still shares the rights holder's name.

Google's route for removing personal information from search covers contact details and ID images, not a name on its own in its listed types. A former name in a Lumen record is therefore likely to stay. The guide on leaked content covers the takedown mechanics in full.

If a name or personal details get out after the exit

Google has free routes for doxxing, and for search results showing a home address, phone number, email or ID images. StopNCII makes a hash (a digital fingerprint) of an intimate image on the creator's own device, and the image never leaves it. Participating platforms check matching uploads against their rules and act on them. If the agency keeps running an account with the creator's photos, Instagram's impersonation form takes reports from the person impersonated. The guide on leaked content covers each route, and the guide on name-mismatch appeals covers ID that does not match the account name.

Red flags to carry into any agency arrangement

These questions are worth asking any agency, including one already in place.

• Who writes the chats, and how are chatters told the creator's name and pronouns?
• Whose name goes on takedown notices?
• At exit, does every account hand over with its email and 2FA?

The guide on questions to ask an agency has the full list, and all guides are in one place.

What changed

• 3 October 2026: first published.