Furry Fun Box

Privacy Notice

Last updated 8 November 2026.

This notice describes what Furry Fun Box actually does with information. The service is offered by the operator of furryfunbox.com. It should be read with the Terms of Use.

No accounts

There are no visitor accounts, profiles, passwords, or mailing-list signups on this site. You do not register. There is no mailing list to join or leave. The operator of furryfunbox.com may sign in to a private usage page. That sign-in is not a visitor account, and the lounge does not ask you for it.

What your browser stores

The site uses sessionStorage in your browser, which lasts for that tab session and is not an account:

• Age-gate acknowledgement. When you tap I am 18 or older, the browser stores a flag that you passed the gate. That tap is also your agreement to the Terms of Use and this notice. The flag is how the same tab skips the gate until the session ends.
• Display name. If you enter a display name, the browser stores it so the same tab can fill it in again. A display name is not an identity check. It can be anything you type, up to 24 characters.

The lounge pages do not set an account cookie or an advertising cookie. The age-gate flag is sessionStorage, not a login. After the operator signs in to the usage page, the browser stores an httpOnly session cookie for that sign-in. The lounge does not ask for it, and it is not an advertising cookie.

Camera and microphone

The age gate does not ask for your camera or microphone. The browser asks for them only if you choose Camera and then enter a box. Chat only does not ask. If you refuse a camera prompt, you can still stay, watch, and use chat. Other people in the box can see and hear whatever you share, and they can see that a chat-only person is present.

Video and audio

Video and audio travel directly between the browsers of the people in a box. They are not sent to this site to be recorded or stored. The operator does not keep a copy of the picture or sound.

To help browsers find a direct path, the site uses public STUN servers at stun.l.google.com (port 19302) and stun.cloudflare.com (port 3478). Connection setup may involve Google and Cloudflare, under their own practices. There is no TURN server, so this site does not relay the media through a relay provider. If a direct connection cannot be made, the call can fail.

Other people in the box receive the media. They are not the operator. A private box name does not stop someone who knows or guesses it from joining, and it does not stop another participant from recording you. Do not assume the conversation is private from the other people in it.

Signalling

The site does keep a short-lived signalling record so people in the same box can find each other. That record can include a random peer id created in your browser, your display name, whether you joined with a camera or chat only, the box name, the time you were last seen, chat text, and the technical messages browsers exchange to set up a connection.

Those records are kept outside the public website files. They are not a user database. A person drops out of a box about 25 seconds after they stop being seen. Chat text lapses after about 60 seconds. When nobody is left in a box, the file for that box is deleted.

Public rooms — The Lounge, The Velvet Room, and After Dark — are listed by name. While the landing page is open, the browser asks about every 4 seconds for a rough headcount of those three rooms only. The answer is a count and a cap of 20. It is not a list of names, and it does not include private boxes. Private boxes are unlisted and cap at 6.

Usage records

The operator of furryfunbox.com keeps a private usage log to see whether the lounge is being used. A record is written when someone takes a seat and when that seat ends. It includes the time, the room name, whether the seat was camera or chat only, how many seats were filled in that room afterwards, and, when the seat ends, how long it lasted. It can also include a daily marker that is a hash of the network address and the date, made with a salt that stays on the server. The raw address is not written in that log.

That log does not include chat messages, video, audio, or display names. It is not a visitor account. It is kept outside the public website files, with the other private signalling data.

IP addresses and hosting

The operator does not claim that the site “collects no data” or “never sees an IP address”. Ordinary web hosting can process your IP address in server logs for security and operation of the site.

The signalling endpoint also uses the IP address for rate limiting. It hashes the address into a short-lived counter of about 300 requests, and that counter resets about once a minute. The raw address is not written into that counter. The counter exists to slow abuse. It is not a profile of you.

What this notice does not offer

There is no account to inspect, export, or delete. Signalling data is meant to disappear on its own, on the timings above. SessionStorage stays in your browser until you close the session or clear site data.

This site does not publish a contact address. There is no separate request desk. That is a limit of the service, not a promise that no technical data exists.