Privacy Policy

This Privacy Policy explains what Feral Mode LLC ("Feral Mode") collects when you use Feral Mode Live (the "Service"), what it does with it, who else sees it, how long it's kept, and what you can do about it. Feral Mode is the business responsible for your data (the "controller"). The Terms use the same words.

The short version

Your exact location is thrown away the moment it arrives. The Service keeps only the blurred area your pin sits in, and only for a day after your app last reported it. The one exception is a place you choose to send someone in a message.
Your data isn't sold. Feral Mode doesn't sell or rent personal data, doesn't share it for targeted advertising, and has no advertising or analytics trackers in the app.
Your sexual-health answers are optional, encrypted, hidden unless you choose to show them, and never used for ads or analytics.
Messages are not end-to-end encrypted. They are encrypted in transit and stored on Feral Mode's servers, so ~~photos and videos can be scanned for child sexual abuse material and~~ reported messages can be reviewed. That's a deliberate trade-off, explained below.
Some records outlast your account. Who vouched for and vetted whom, and records of rule-breaking, are kept to keep the network safe.
You can download your data or delete your account at any time from Account › Your data.

1. What Feral Mode collects

Things you give it

Account: your handle, the email you confirm, and passkeys you save (the Service stores the passkey's public key, never your fingerprint, face or PIN). Anonymous accounts can skip the email.
Age check: the date of birth you enter is compared with today's date and then thrown away; only the time you passed is kept. Your device's time zone is checked at the same moment, because sign-up is open in the US and Canada only, and isn't kept either. Where an age-verification provider is used, Feral Mode receives only a pass or fail and a reference number, never your ID or selfie.
Profile: photos, headline, about text, age (optional), and any stats you add, such as height, weight, body type, position, tags, what you're into, what you're looking for and whether you can host.
Identity and health (optional, sensitive): gender identity, orientation and expression; and HIV status, PrEP, when you were last tested, and safer-sex practices. See section 4.
Photos and video: profile and album photos and anything you send in chat. Photos are resized and their hidden metadata (including any GPS location) is stripped on your device before upload.
Gesture clips you record to be vetted. See section 5.
What you post and send: messages, taps, knocks, Wall posts, statuses, check-ins, spots and spot details you add, tips and safety flags, reports and appeals, and bug reports.
Notes on people (Plus): the private notes, names, ratings, warnings and contact details you save about others. Only you can read them.
Settings: visibility, notification and email preferences, quick replies, tile size and similar choices.

Things collected as you use the Service

Location, only while the app is open and only if you allow it. See section 3.
Device: a random ID the app creates, and a short description of your device (platform, screen size, time zone and language). The Service stores only scrambled (salted and hashed) versions of the ID and the description, plus the platform, your time zone, whether the app is installed, your push subscription and when the device was last seen. These let you see and sign out your devices and stop removed people from coming back.
Activity on the Service: when you're online, who you tapped, favorited or blocked, whose profile you opened (people can see who looked at them, unless you have Plus and look incognito), invites, vouches and vets, and your notifications.
How you found the Service, if you arrived by a tagged link (for example a code from a flyer).
Internet address (IP). The Service uses it briefly to limit abuse when you're not signed in, and its hosting provider records it in standard server logs.

Things others provide about you

Members who report you, block you, vouch for you, vet you, message you, or write notes about you (notes are private to their writer; you can't see them and neither can Feral Mode's moderators).

Feral Mode doesn't buy data about you and doesn't collect your contacts, your real name, a phone number, or payment card details.

2. How it's used, and the legal basis

To run the Service: your account, map, profile, chat, the Wall, spots, notifications, Plus and support. Basis: the contract with you (the Terms).
To keep people safe and the network real: age checks, ~~scanning uploads,~~ vetting, reports and moderation, the chain and cascade, blocking ban evasion, rate limits, and investigating abuse. Basis: legitimate interests (keeping members safe, especially from abuse of minors and non-consensual content) and legal obligations.
To use sensitive data you choose to give (identity and health): only to show it where you say, and to filter the map for Plus members who search by identity. Basis: your explicit consent, which you can withdraw by deleting the answers.
To send account emails and push notifications you've allowed. Basis: the contract, and your consent for push.
To send news and promotions about Feral Mode Live, if they're on in Settings › Notifications. In the US they start on until you turn them off; anywhere else, Canada included, they stay off until you turn them on. Every one has a one-click unsubscribe. Basis: your consent, or in the US, legitimate interests until you opt out.
To understand and improve the Service, using counts that don't name anyone (for example how many people were active in a city). Location in these counts is never finer than a city. Basis: legitimate interests.
To comply with the law and to establish or defend legal claims. Basis: legal obligation and legitimate interests.

Feral Mode doesn't make decisions about you based solely on automated processing that have legal or similarly significant effects. ~~Automated tools rate photos for nudity and prohibited content.~~ A person makes every decision to restrict or remove an account, except for the automatic, temporary holds described in How reports work~~ and the automatic freeze for suspected child sexual abuse material~~, which a person then reviews.

3. Location

What happens to your position. When the app is open and you've allowed location, your device sends its position. The server immediately converts it into the hexagonal area containing it and discards the exact point; it is never written to a database or log. You choose how big that area is under Settings: Block (about 170 m across, the default), Neighbourhood (about 460 m) or District (about 1.2 km).

What others see. Your pin is shown at a point inside your area that is shifted randomly each day, and distances are shown in rough bands (under 1 km, under 2 km, and so on). The Service is designed so that nobody can pin you down more precisely than your area, however they probe. You can hide your distance, hide your pin, or go ghost under Visibility.

How long it's kept. Your current area is kept in memory for 24 hours after your app last reported it, then deleted. In a city the app is still building up, your pin stays up, marked offline, until you go ghost, turn location off or sign out. No location history is kept. Your account and each device keep only the city-level area (about 20 km) you were last in, for your device list and to know which city's settings apply to you.

Things you choose to share that carry more:

A place you send in a message is the exact point you picked, and it's kept as long as the message (30 days).
Checking in or saying you're on your way to a spot links you to that spot, which is a real, exact place, for as long as the check-in lasts, and the record stays in your history until you delete your account. Who sees you there depends on whether you check in visibly.
A Wall post carries the area you posted from, and lives only while you're on the map.
Travel mode shows you in the city you set.

Signing up anonymously may ask for your location once, to decide which city's rules apply. It is turned into a city-level area and not stored on the server.

4. Sensitive information

Simply being on Feral Mode Live may suggest your sexual orientation or sex life. Feral Mode treats everything on the Service with that in mind, and treats the following as sensitive data:

Gender identity, orientation and expression are optional. They show on your profile if you fill them in, and Plus members can filter by them.
Sexual-health answers (HIV status, PrEP, last test, practices) are optional, have no free-text box, are encrypted with a separate key before they're stored, and each one is hidden until you switch it on under Health. Moderators can't see them. They are never used for advertising, analytics or anything else.
Notes on people are encrypted the same way and only their writer can read them.

You give explicit consent to this use of your sensitive data by choosing to enter it. You can withdraw that consent at any time by clearing the answers; they're deleted from the live system straight away.

Consumer health data. Some US states give extra rights over health-related data, including the right to know who it's shared with and to have it deleted. Feral Mode collects your health answers only to show them on your profile as you choose, shares them with nobody except the service providers that store them, and never sells them. Its consumer health data notice says more, and is linked from the front page.

5. Vetting clips

To become Trusted you record three short clips of yourself doing gestures in the app. They are:

encrypted when stored, with a key only the Service holds;
~~scanned like every upload (section 7);~~
shown only to the one member reviewing them, with that member's handle burned into the picture, and never downloadable;
deleted the moment the reviewer decides, or after 7 days if nobody does.

Afterwards only who reviewed you, when, and the outcome are kept. Feral Mode doesn't create face templates, faceprints or any other biometric identifier from your clips or photos.

6. Who can see your information

Other members see what your profile and settings allow, depending on their tier and yours: Anonymous users see members only as silhouettes; members see Anonymous and Pending profiles; your Wall posts are visible to people near you who could see your pin. Trusted profiles show who vouched for and vetted them. Messages, photos and albums go only to the people you send or unlock them for. Your email is never shown to anyone.

Feral Mode's moderators (currently the owner, and Trusted members the owner appoints, who are bound to confidentiality) can see what they need to handle reports and keep the Service safe:

the content that was reported, and when a conversation is reported, the last 20 messages of that conversation from both sides;
your profile, public photos, account history, standing, chain, devices (platform and city only) and previous handles;
when investigating a report about you or a safety risk, your private-album photos and the photos and videos you have sent in chat.

Moderators can't browse conversations, can't read messages that haven't been reported, and can't see your health answers, your notes on others, or your email. Every moderator action is logged.

7. Encryption and scanning

Every photo, video and clip is checked automatically before anyone else can see it: it's compared against databases of known child sexual abuse material (CSAM) and rated for nudity and prohibited content. A suspected match is blocked, preserved as evidence, and the account is frozen. Feral Mode reports child sexual abuse material it finds or is told about to the National Center for Missing & Exploited Children (NCMEC), as US law requires, and preserves it as evidence. NCMEC may share reports with law enforcement anywhere.

Because the Service has to ~~be able to scan uploads, and to~~ show moderators reported messages, messages and media are not end-to-end encrypted. They're encrypted in transit (HTTPS) and stored on Feral Mode's servers, where access is limited as section 6 describes.

8. Service providers and other recipients

Feral Mode doesn't sell or rent personal data, and doesn't "share" it for cross-context behavioral advertising as US state laws define those words. It shares personal data only with:

Service providers that process it on Feral Mode's behalf, under contract, only to provide their service:

Google Cloud (USA): hosting, databases, storage and server logs.
Google Workspace (USA): sending email.
GitHub (USA): if you send a bug report, it's filed in Feral Mode's private issue tracker with your handle, account tier, the page you were on, the app version, your browser's user-agent string, your screen size and what you wrote. It never includes your email, your IP or anything else from your account.
[IMAGE-SCANNING PROVIDER] (USA): scanning uploads (section 7).
[AGE-VERIFICATION PROVIDER], where an age check is required: it collects what it needs for the check under its own privacy policy and returns only pass or fail.
[PAYMENT PROCESSOR], if you buy Plus: it handles your payment details under its own privacy policy; Feral Mode receives only your subscription status and a reference.
Your browser's push service (Apple, Google or Mozilla, depending on your device) delivers notifications you've allowed. By default they say only "New activity"; you choose whether they show who and a preview.
Protomaps, on GitHub Pages (USA): the map's typefaces and icons are loaded from it, so it sees your IP address as your browser fetches them. It receives nothing else.

NCMEC, as section 7 describes, and law enforcement when the law requires. Feral Mode gives information to police or government only in response to valid legal process (a subpoena, court order or warrant appropriate to what's asked), reviews every request, pushes back on requests that are too broad, and tells you before handing anything over unless the law forbids it or someone's life or safety is at immediate risk. In an emergency involving a risk of death or serious harm, Feral Mode may share the minimum needed without waiting. Requests go to legal@getferalmode.com.

To protect rights and safety: to enforce the Terms, investigate fraud or abuse, or protect any person from harm.

If the business changes hands: in a merger, acquisition or sale of assets, personal data may transfer to the new owner, who must honor this policy. You'll be told first.

With your direction: for example when you send someone a message, share a profile, or export a note as a phone contact.

Advertising. There are no ads or ad trackers in the Service today. If ads are introduced for accounts without Plus, they will be chosen by city and tier only, never by anything in your profile, your health answers, your location below city level, or your activity, and this policy will be updated first.

9. Cookies and storage on your device

The Service uses only what it needs to work. There are no third-party, advertising or analytics cookies.

fml_s (cookie): keeps you signed in. Lasts 30 days in the installed app, 24 hours in a browser tab.
fml_g (cookie): remembers that you passed the age check while you sign up. Lasts 24 hours.
Local storage: your device ID, display settings (SFW mode, sounds, units, map view and layers), messages waiting to send when you're offline, whether this device has a passkey, and how you found the Service (30 days).
App cache: the installed app keeps its own code and fonts so it opens fast and works offline. It doesn't cache photos or messages.

Because these are strictly necessary, the Service doesn't ask for cookie consent. Clearing your browser's data for the site signs you out and, for an Anonymous account without an email or passkey, loses the account.

10. How long it's kept

Your exact position: not kept at all.
Your current area: 24 hours after your last report (longer only in a growing city, until you go ghost, turn off location or sign out).
Message text: 30 days. Photos and videos in chat: as long as the message, unless the sender chose "gone after they open it" or "gone 24 hours after they open it" (7 days if never opened).
Uploads in your Recents that are only chat media: 90 days after you last used them.
Wall posts: while you're on the map, then deleted within 7 days. Saved copies: 30 days.
Statuses, check-ins and flags: end after a few hours; the records stay in your history until you delete your account.
Vetting clips: until the decision, at most 7 days.
Invite links: expire after 7 days.
Idle Anonymous accounts: deleted after 30 days without a sign-in.
Data exports: 7 days.
Everything else on your account: until you delete your account.
Backups: encrypted, overwritten within [30] days.
Server logs: [LOG RETENTION] days.

When you delete your account, you vanish from the map, the Wall and other people's lists at once, you're signed out everywhere and your sign-in methods are removed. Within 30 days your profile, photos, videos, albums, health answers, messages you sent, notes (yours, and others' about you), favorites, blocks, taps, profile views, statuses, check-ins and devices are deleted. Messages other people sent you stay in their inboxes until they expire.

What's kept after deletion, and why:

The chain record: an anonymous ID standing in for you, linked to who vouched for and vetted you and whom you vouched for and vetted. No handle, profile or content. Kept so the cascade and ring detection keep working (legitimate interest in the network's safety).
Safety records: reports made by or about you (including any messages captured with them), moderation decisions and appeals, kept for [2] years after the case closes, or longer if needed for a legal claim, an investigation or a legal hold.
The fact that you accepted the Terms, Rules and Privacy Policy, and when: kept as proof of the agreement for [the limitation period].
Spots you added stay on the map for everyone, no longer linked to you.
Bug reports you sent: kept to fix what they describe, but no longer linked to you; they read as from a deleted user. A copy already in the issue tracker keeps the handle you had when you sent it.
Anything NCMEC or law enforcement requires to be preserved, for as long as required.

If your account is removed for breaking the rules, your photos are deleted, and so are your profile and health answers. Feral Mode keeps your email, scrambled device IDs and scrambled versions of your photos (not the photos themselves) for [5] years to stop you coming back, along with the safety records above.

11. Your choices and rights

Everyone, wherever you live, can:

See and download your data from Account › Your data. The download includes your account, profile and health answers, photos, messages you sent, chain, notes, places, activity and reports you made. For anything it doesn't include, ask.
Correct your profile and settings at any time in the app.
Delete your account from the same place, or delete individual photos, posts, notes and answers.
Control who sees you under Visibility, go ghost, hide your distance, and turn notifications and emails on and off.
Withdraw consent for location (in your browser or phone settings), push notifications, or sensitive data (by clearing it).

Depending on where you live, including Colorado, California, Connecticut, Virginia and other US states, and Canada, you may also have the right to know what personal data Feral Mode processes and how; to get a copy in a portable format; to correct or delete it; to restrict or object to processing, including processing based on legitimate interests; to opt out of sale, targeted advertising and significant profiling (Feral Mode does none of these); to limit the use of sensitive data (Feral Mode uses it only to provide what you asked for); and not to be treated differently for using these rights.

To make a request that you can't handle in the app, email privacy@getferalmode.com from the email on your account. For an Anonymous account with no email, write from any address and include your handle; Feral Mode will ask you to confirm the request from inside the app. Feral Mode will confirm it's you before acting, and will answer within 45 days (30 days in Canada), and tell you if it needs longer. An authorized agent can make a request for you with your signed permission. Feral Mode honors Global Privacy Control signals as an opt-out of any sale or sharing, though there is none.

Appeals. If Feral Mode declines your request, you can appeal by replying with "Appeal" within 60 days. Someone who didn't make the first decision will answer within 45 days. If you're still unhappy, you can complain to your state attorney general (in Colorado, coag.gov/file-complaint) or, in Canada, to the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d'accès à l'information). The person responsible for personal information at Feral Mode is its owner, reachable at privacy@getferalmode.com.

12. Security

Connections are encrypted (HTTPS). Health answers, notes and vetting clips are encrypted with keys kept separately from the data. Photos and media are kept in private storage and served only through links that expire within minutes, after checking you're allowed to see them. Device IDs are stored only in scrambled form. Access to systems is limited to the people who run the Service. No system is perfectly secure; if a breach affects your personal data, Feral Mode will tell you and the authorities as the law requires.

Report a security problem to security@getferalmode.com.

13. Where your data is

Feral Mode is based in the United States and the Service is hosted in the United States. Sign-up is open in the US and Canada only; members can use the Service from anywhere once they're in. If you use it from outside the US, including from Canada, your data is transferred to, stored and processed in the US, where privacy laws differ from yours and courts and authorities there may be able to get it under US law. Feral Mode protects it as this policy describes wherever it's processed.

14. People under 18

The Service is only for adults. Feral Mode doesn't knowingly collect data from anyone under 18. If it learns that an account belongs to someone under 18, it removes the account and its content and, where it involves sexual content, reports it to NCMEC as section 7 describes. If you believe a minor is on the Service, report it or email safety@getferalmode.com.

15. Changes

When what this policy says changes, Feral Mode publishes a new version, and the app asks you to read and accept it before you carry on. Small wording fixes may be made without asking. Earlier versions are available on request.

16. Contact

Feral Mode LLC, 1645 Newton St, Denver, CO 80224

Privacy questions and requests: privacy@getferalmode.com
Law enforcement and legal process: legal@getferalmode.com
Safety: safety@getferalmode.com, or the Report button in the app

Version 1, October 26, 2026.