What Ferality stores about listeners

Version 1 · 14 October 2026 · for listeners and visitors

A short, honest inventory of what is kept about you if you listen on Ferality, with or without an account, why it’s there, and how to get rid of it. If you create work here, the creator notice covers that too.

Who is responsible for your data: Michelle Lubbe, who runs Ferality. Contact: [email protected].

---

Why this matters more than usual

Ferality is an adult platform. What you listen to, like or follow here can say something about your sexual preferences, which data-protection law treats as the most sensitive kind of personal data there is. So it is kept to a minimum, never sold, never used for advertising, and never shown to creators except as totals.

If you just visit

• An age acknowledgment: when you confirm you’re 18 or over, a small cookie (frl_age18) remembers it on your device for 180 days. It is a click-through, not verification, and nothing is sent anywhere.
• Listens: when you’ve played 30% of a work, a listen is recorded: which work, when, and a one-way hash of a random ID kept in a cookie (frl_aid, one year). That builds each work’s listen count and what’s trending. The random ID isn’t connected to who you are, even when you’re signed in, and repeat plays within 12 hours count once.
• Reports: if you report something, the report is stored with its reason. You are stored only as a one-way hash, so even the operator cannot see who filed it.

If you have an account

Everything above, plus:

• Your account: your handle, a bcrypt hash of your password (never the password itself), when you signed up and when you were last seen. An email field exists and is optional.
• Your 18+ confirmation: that you confirmed it at sign-up, when, and a one-way hash of the IP address it came from. The IP itself is not stored. It records that you said so; it is not proof of age, and the site doesn’t treat it as proof.
• No listening history. Listens are counted exactly as above, by the random browser ID and never by your account. There is no record anywhere of what your account has played.
• Follows and likes: who you follow and what you’ve liked. Creators see how many followers and likes they have, not who. Nobody else can see who you follow.
• Comments: what you wrote, where and when. Your handle, and your avatar if you add one, appear next to them. Before a comment appears, it is checked by an automatic word filter and an automated screen; if either flags it, or the screen is unavailable, the comment waits for a person to look at it. A removed comment is hidden rather than erased, so the record of what was taken down survives.
• Blocks: who you’ve blocked.
• Notifications: things like replies, so the bell can show them.

On your device only

Your volume, where you stopped in each track and your play queue are kept in your browser so they’re there next time. They are never sent to Ferality.

If you pair a toy

• Bluetooth, straight from your browser: the haptics are worked out on your device and sent straight to your toy. Nothing about it leaves your device.
• Through the Lovense app: the commands travel through Lovense’s servers, using the creator’s Lovense developer account. The pairing code doesn’t identify you, and the pairing lasts only while you’re on that page. Your Lovense account and app are covered by Lovense’s own privacy policy.

Who else sees it

The database and the application run in the EU. OpenRouter processes comment text in the US, briefly. Nothing is sold, and there are no advertisers, data brokers, analytics or tracking pixels.

Why we’re allowed to

• Your account, follows, likes, comments and blocks: to provide the service you signed up for.
• Listen counts, comment screening and reports: to run a safe platform and show what people are listening to, which is a legitimate interest. Listens are never tied to your account, so they don’t build a record of your tastes.

How long

Your account, follows, likes and blocks: until you close your account. Comments: until you remove them or close your account. Listen records: kept as totals for counts and trending. Your 18+ confirmation: kept with your account.

A written retention schedule with actual numbers on it is an open task. When it exists it will be linked here.

What you can ask for

Write to the contact above and you’ll get:

• A copy of everything stored about you.
• Corrections to anything wrong.
• Deletion: your account closed, and your follows, likes, blocks and the text of your comments deleted.
• An objection to any use you don’t agree with.

You can also complain to the Data Protection Commission at dataprotection.ie.

The honest caveat

This describes what the software actually does today, checked against the code. It has not been through a formal GDPR review yet. If something here worries you, say so.