wubby.love
The humans behind this

Built by a community member,
for the community.

Hey — I’m Luc. I’ve been part of the ABDL and ageplay community for years, mostly as an observer and lurker. I built wubby.love because every platform I tried was either overrun with bots, full of subscription traps, or just… not built with our community in mind.

I’m a software engineer. I started this project because I was frustrated, not because I saw a business opportunity. The one-time fee exists to keep the space real — not to extract money from people.

The r/ABDL community called me out for requiring payment before you could even see the platform. They were right. We changed it the same day. That’s how this is going to work — feedback in, changes out.

Fully open source

You shouldn’t have to trust us blindly — especially on a platform like this. Every line of code is public under the AGPL-3.0 license. Read it, audit it, raise issues.

AGPL means: if you run a fork of this commercially, you have to open source your changes too. The community keeps the benefit.

Security decisions

These aren’t marketing bullet points — they’re decisions you can verify in the code. Links go to the relevant file.

No ID documents stored

Verification returns one boolean — verifiedAt. The document itself never touches our servers. Stripe Identity handles it.

Mandatory content scanning

Every image upload runs through Sightengine before storage. NSFW is blocked from public photos. CSAM detection on every single file.

EXIF/GPS stripped before storage

Every image is re-encoded server-side to remove metadata before it ever hits S3. Your phone's location never lands in our database.

Passwords hashed with bcrypt

Never stored in plaintext. Rate limiting on sign-in per IP and per account to slow brute-force attempts.

Private media behind auth

Private album photos are never served via a guessable URL. Every request is re-checked server-side, then redirected to a 60-second presigned URL.

Parameterized queries throughout

Prisma ORM — no raw SQL string concatenation, no injection surface.

What we don’t do

Get in touch

Found a security issue? Have feedback? Want to help?

Ready to join the community?