Privacy · Reviewed August 27, 2026
What Heatfeed stores and why.
This disclosure describes the behavior implemented in the current Heatfeed prototype. It avoids promises about retention or deletion workflows that the product does not yet provide.
Public catalog and device storage
The public catalog does not require an account. After an adult confirms the age gate, Heatfeed stores that confirmation in the browser’s local storage under a Heatfeed-specific key so the same device can remember it. Search, theme, and sort selections stay in the active page state. Audio previews use the browser’s Speech Synthesis interface and the voices available on the visitor’s device.
Creator vault
The creator vault stores drafts in the browser’s local storage. Before storage, the browser derives an encryption key from the creator’s passphrase and encrypts the vault with AES-GCM; the derived key remains in the active browser session and is not saved by Heatfeed. Losing the passphrase can make a local vault unrecoverable.
Accounts, sessions, and stories
When someone registers for the account-backed writing prototype, Heatfeed stores the chosen handle, a salted password hash, and created story data in a Neon-hosted PostgreSQL database. Production sessions use a signed cookie configured as HttpOnly, Secure, and SameSite=Lax, with a current maximum lifetime of 30 days. Heatfeed does not store the account password in readable form.
Source metadata imports
A creator can request metadata for a secure Literotica URL only after confirming that the creator wrote the work or has permission to use it. Heatfeed sends the submitted URL to Firecrawl to retrieve limited metadata and a summary, not to republish the source story. The import endpoint also uses the request address temporarily for an in-memory rate limit of 6 attempts per 15 minutes.
Providers and tracking
Vercel hosts the web application, Neon provides the account and story database, and Firecrawl processes the optional source-metadata request. Their infrastructure may process network and operational data needed to deliver those services. The current public page contains no known analytics, advertising, session-replay, or social tracking scripts.
Requests and unresolved product work
Heatfeed does not yet provide a verified private inbox or an automated account-deletion workflow. Owner action required: publish a monitored privacy contact, define retention periods, and implement authenticated access, correction, export, and deletion flows before the prototype is promoted for general use.