Introduction
Welcome to Heatwave ("we," "our," or "us"), operated by Heatwave Social Inc. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Heatwave mobile application (the "App"). We believe in being straightforward about our data practices -- no legalese, no hidden practices. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.
Information We Collect
We collect the following categories of information:
Account Data
When you register, we collect:
Email address
Date of birth (used solely for age verification -- we do not display your age or birthday publicly)
Username (stored alongside a lowercase copy for case-insensitive uniqueness enforcement)
Profile information you choose to provide (display name, bio, profile picture)
Phone number (optional -- if you provide one, we store only an irreversible keyed hash of it, never the raw number; see "Contacts & Friend Discovery" below)
Content Data
When you use Heatwave, we collect:
Posts, photos, and videos you create (including edited and compressed versions, as well as automatically generated thumbnails at 200px and 480px resolutions)
Comments and replies
Flame, unlock, and repost activity
Messages sent through Unlock Chats (ephemeral direct messages)
Shared post messages in your inbox
Hashtags parsed from your captions
Purchase Data
If you buy tokens:
Transaction IDs and purchase receipts from the Apple App Store or Google Play Store
Token balance and transaction ledger (all credits and debits)
We do NOT receive or store your credit card number, billing address, or any payment details -- all payment processing is handled entirely by Apple, Google, and our payment partner RevenueCat
Usage & Device Data
We automatically collect:
Device type, operating system, and app version
IP address (logged for security and abuse prevention)
Usage patterns: screens viewed, features used, session duration
Crash reports and performance diagnostics (via Firebase Crashlytics)
Push notification tokens (via Firebase Cloud Messaging, for delivering notifications you have enabled)
Firebase App Check attestation signals (device integrity verification -- no personal data, just a device legitimacy check)
What We Do NOT Collect
We want to be explicit about the data we do not collect:
Precise GPS location -- we do not access or store your device location
Raw phone numbers -- we never store them; any phone number is converted to an irreversible keyed hash that cannot be reversed to reveal the original number
Biometric data -- we do not use facial recognition or any biometric analysis on user photos or videos
Stored contact details -- we do not retain raw phone numbers from your contacts; they are hashed on our server and discarded after matching
Cross-app tracking data -- we do not track you across other apps or websites
Advertising identifiers -- we do not use IDFA, GAID, or any advertising identifiers for any purpose
How We Currently Use (and Do Not Use) Your Data
As of the date of this Privacy Policy:
We currently do not sell, rent, or trade your personal data to anyone
We currently do not display third-party advertisements in the App
We currently do not build advertising profiles or behavioral profiles about you
We do not use your content, posts, messages, or any personal data to train artificial intelligence or machine learning models
We currently do not share your data with data brokers
We currently do not perform cross-app or cross-site tracking
Our revenue currently comes from in-app token purchases
If we ever introduce advertising or materially change how we use your data, we will update this Privacy Policy, notify you in advance through the App, and where required by law, obtain your consent before any such changes take effect.
Contacts & Friend Discovery
If you choose to use the "Find Friends from Contacts" feature, here is exactly what happens:
We ask for permission to access your device contacts
The phone numbers from your contacts are sent to our server over an encrypted (TLS) connection and immediately converted into irreversible, keyed hashes -- a one-way transformation using a secret key held only on our server, so the hashes cannot be reversed back into phone numbers
We do not store the raw phone numbers from your contacts -- they are used only momentarily to generate the hashes and are then discarded
We compare these hashes against hashes of other users who have opted in to be discoverable by phone number
Matching hashes are used to suggest friends; the hashes from your contacts are not retained on our servers after the comparison is complete
You can add your own phone number in your profile settings to let your contacts find you. If you do, we store only its irreversible keyed hash -- never the number itself. You can remove it at any time from your profile settings, and the hash will be deleted from our servers.
This feature is entirely optional. You can use Heatwave fully without ever granting contacts access, and the core functionality of the App is not affected.
How We Use Your Information
We use your information to:
Provide, operate, and maintain the Heatwave App and all its features
Process in-app purchases and manage your token balance
Deliver push notifications you have opted into (flames, comments, follows, unlocks, messages, and other activity)
Enforce our age verification requirement (18+ only)
Moderate content using automated systems to ensure platform safety (see "Content Moderation & AI" below)
Detect and prevent fraud, abuse, spam, and security threats
Analyze aggregated and anonymized usage data to improve the App
Comply with legal obligations, including mandatory CSAM reporting to NCMEC and Cybertip.ca
Respond to your support requests and communications
Content Moderation & AI
We use automated systems to keep Heatwave safe. Here is exactly what we use and why:
Image & Video Moderation
When you upload a photo or video, it is screened by:
Automated image classifiers that run on our own servers (your content is not sent to a third party for this check) -- detect nudity and explicit imagery
Amazon Web Services (AWS) Rekognition -- detects explicit, suggestive, or violent visual content
For video content, individual frames are sampled for moderation analysis. This sampling does NOT affect video playback quality or resolution -- it only determines which frames are checked for safety compliance.
Based on the results, content is approved, flagged for human review, or rejected. Content flagged as potential CSAM is immediately reported to the appropriate authorities and retained as required by law.
Message Moderation
When you send a message in an Unlock Chat or share a post message, the text is screened by:
OpenAI Moderation API -- checks for hate speech, harassment, threats, self-harm content, violence, and child sexual exploitation material
This is a one-time safety check. OpenAI does not retain your message text after the moderation check completes, and your messages are not used to train any AI models. We allow normal adult conversation, including sexually suggestive language between consenting adults. We block content involving: minors in any sexual context, hate speech, credible threats of violence, self-harm promotion, and targeted harassment.
These automated systems may produce errors. If your content is incorrectly flagged or rejected, you may contact us at [email protected] for a human review. We review all appeals in good faith and retain final discretion over content moderation decisions.
By using Heatwave, you consent to automated content moderation as a condition of using the platform.
Screenshot Protection
Heatwave employs technical measures designed to discourage unauthorized capture of unlocked content within the App. These measures operate on a best-effort basis.
No technology can fully prevent screenshots, screen recording, or capture by external devices (such as photographing a screen with another device). We make reasonable efforts to protect content creators, but we cannot guarantee that these protections will prevent all forms of unauthorized capture.
We are not liable for content that is captured despite these protective measures.
Unlock Chats (Ephemeral Messaging)
When you spend a token to unlock someone's post, a temporary direct message channel ("Unlock Chat") is created between you and the post's author. Here is how your data is handled:
The post author has 24 hours to respond. If they do, the chat becomes active for another 24 hours. Additional unlocks on the same author's posts extend the chat window.
After the chat expires, messages are retained for 90 days for safety, abuse investigation, and legal compliance, then permanently deleted from our servers.
If a chat is reported or involves a blocked user, messages are retained for up to 1 year to support any investigation.
Chat metadata (participants, timestamps, chat status) is retained separately from message content.
All messages pass through our automated moderation system before delivery.
Sharing Your Information
We share your information in the following situations and no others:
With Other Users
Your public profile (username, display name, bio, profile picture) is visible to other users
Posts you create are visible based on your privacy settings (public or followers-only)
Your flame and unlock activity is visible to post authors (they can see who flamed or unlocked their post)
Messages you send in Unlock Chats are visible to the other participant
Shared post messages are visible to the recipient
With Service Providers (Data Processors Acting on Our Behalf)
We use the following third-party services that process your data strictly on our behalf and under our instructions:
Firebase / Google Cloud Platform -- hosting, database, authentication, cloud functions, push notifications, crash reporting (Firebase Crashlytics)
Cloudflare R2 -- content delivery network for media files (images, videos, thumbnails). Stores approved content only.
RevenueCat -- in-app purchase management (receives purchase receipts from Apple/Google, not your payment details)
Amazon Web Services (AWS) Rekognition -- image and video content moderation (receives uploaded media only)
OpenAI -- message text moderation only (receives message text for a one-time safety check; does not retain your data and does not train on it)
Apple Push Notification Service / Firebase Cloud Messaging -- push notification delivery
We do NOT sell your personal data to anyone. Ever.
For Legal Reasons
We may disclose your information when required to:
Comply with applicable law, regulation, or legal process
Protect the rights, safety, or property of Heatwave, our users, or the public
Report suspected CSAM to the National Center for Missing & Exploited Children (NCMEC) and the Canadian Centre for Child Protection (Cybertip.ca) as required by law
Respond to lawful requests by law enforcement or government authorities
Analytics
We use Firebase Analytics (Google Analytics for Firebase) to understand how Heatwave is used. This collects:
App opens, screen views, and feature usage
Device type and operating system
General geographic location (country and region level only -- NOT precise or GPS-based location)
Crash reports and performance metrics (via Firebase Crashlytics for stability monitoring)
This data is aggregated and used solely to improve the App. We do not sell analytics data to anyone.
iOS Users: Heatwave does not use App Tracking Transparency and does not request permission to track you, because we do not track you across other apps or websites and do not use advertising identifiers (such as IDFA). The analytics described above are first-party and aggregated, and are used solely to maintain and improve the App.
Device Permissions
Heatwave may request the following device permissions:
Camera -- to capture photos and videos for posts. Accessed only when you actively take a photo or video within the App.
Microphone -- to record audio during video capture. Accessed only during active video recording.
Photo Library -- to select existing photos and videos for posts. We access only the specific files you explicitly select.
Contacts -- to find friends who also use Heatwave (see "Contacts & Friend Discovery" above). We never store raw contact data. Entirely optional.
Notifications -- to alert you about flames, comments, follows, unlocks, messages, and other activity. You can disable any notification category in the App's settings, or disable all notifications in your device settings.
All permissions are optional. The core App works without granting any of them, though some features will be limited without the relevant permission.
In-App Purchases & Tokens
Heatwave uses a virtual token system for premium features such as instant post unlocks and initiating Unlock Chats.
Tokens are purchased through the Apple App Store or Google Play Store
All payment processing is handled by Apple, Google, and our partner RevenueCat -- we never see or store your payment card details, billing address, or financial account information
Purchase receipts are validated server-side to prevent fraud
Token credits are applied to your account only after successful server-side verification
Your token balance and complete transaction history (all purchases and expenditures) are stored securely in our database
Tokens have no cash value and are non-transferable (see our Terms of Service for full details)
Data Security
We implement industry-standard security measures to protect your data:
All data in transit is encrypted via TLS/HTTPS
Firestore security rules enforce per-user access control on every read and write operation
Token balances and purchase records are write-protected -- only our server-side Cloud Functions can modify them, never client devices
Firebase App Check verifies that requests originate from genuine instances of our App, blocking scrapers, bots, and forged requests
Phone numbers are converted to irreversible keyed hashes before storage -- the original numbers cannot be recovered
Content flagged as potential CSAM is stored in isolated, restricted-access storage with strict access controls
All sensitive operations (token deduction, purchase credits, content moderation decisions) are executed server-side via Cloud Functions, never on client devices
No system is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data using commercially reasonable measures. If you discover a security vulnerability, please report it responsibly to [email protected].
Data Retention
We retain your data as follows:
Account Information: Kept while your account is active. Upon server-side account deletion: your user document, profile data, feed entries, follows, blocks, and notifications are removed, and your posts are taken down from the platform and scheduled for permanent deletion (their media is purged within 90 days -- see Posts and Media below). Financial records (token ledger and purchase records) are retained for 1 year after deletion for financial record-keeping and dispute resolution. Moderation logs and reports involving your account are retained as required by law or policy.
Posts and Media: Kept while visible on the platform. Soft-deleted posts are retained for 90 days, after which associated media files are permanently removed from our servers. Content removed for policy violations may be retained for up to 1 year for legal compliance and appeals. CSAM material is retained as required by law and is never deleted by us.
Unlock Chat Messages: Retained for 90 days after chat expiration, then permanently deleted. Messages from reported or blocked chats are retained for up to 1 year to support investigations.
Activity Data: Flame, unlock, and repost activity is retained while your account is active.
Token Transaction History: Retained while your account is active and for 1 year after account deletion.
Purchase Receipts: Retained for the lifetime of the account plus 1 year (required for refund disputes with Apple and Google).
IP Logs: Retained for 90 days for security and abuse prevention purposes.
Analytics & Crash Data: Analytics data and crash reports (collected via Firebase Crashlytics) are retained in aggregated, anonymized form indefinitely and are used solely for app improvement and stability monitoring. This data cannot be linked back to individual users.
Hashtag Index: Contains aggregated post counts only -- no personal data.
CSAM Reports: Retained as required by applicable law.
Age Requirements
Heatwave is an 18+ platform. You must be at least eighteen (18) years of age to create an account or use the App. We collect your date of birth during registration solely for the purpose of verifying that you meet this age requirement.
We do not knowingly collect personal information from anyone under the age of 18. If we learn or have reason to believe that a user is under 18, we will immediately terminate their account and delete all associated data.
If you believe someone under 18 has created an account on Heatwave, please report it immediately to [email protected].
CSAM Policy
Heatwave maintains an absolute zero-tolerance policy for child sexual abuse material (CSAM). We employ automated detection systems that screen all uploaded content during the upload process. Any content suspected of being CSAM is immediately reported to the National Center for Missing & Exploited Children (NCMEC) and the Canadian Centre for Child Protection (Cybertip.ca) as required by United States and Canadian law. The associated account is permanently and irrevocably banned. We cooperate fully with law enforcement investigations related to CSAM. Content identified as CSAM is retained as required by law and is never deleted.
Your Rights
All Users
Regardless of where you reside, you may have the right to:
Access the personal data we hold about you
Correct inaccurate or incomplete data
Delete your data
Object to or restrict certain processing of your data
Data portability (receive your data in a structured, commonly used format)
Withdraw consent at any time for consent-based processing
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your verified request.
United States Residents
We do not sell personal information as defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). California residents have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. Since we do not sell personal information, there is no sale to opt out of. These rights extend to residents of all US states with applicable consumer privacy laws.
Canadian Residents
You have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including Alberta's Personal Information Protection Act (PIPA). These include the right to access your personal information held by us, request corrections to inaccurate information, and withdraw consent for the collection, use, or disclosure of your personal information (subject to legal and contractual restrictions).
We honor all applicable consumer protection and data privacy laws in every jurisdiction where we operate.
International Data Transfers
Heatwave is operated from Alberta, Canada by Heatwave Social Inc. Your data is stored on Google Cloud Platform and Cloudflare R2 infrastructure, with servers that may be located in the United States and other countries. By using Heatwave, you consent to your data being transferred to and processed in these locations. We ensure that appropriate safeguards are in place for all international data transfers in accordance with applicable data protection laws.
Children’s Privacy
Heatwave is an explicitly adult-only platform restricted to users aged 18 and older. We do not target, market to, or knowingly collect personal information from children or minors. Because our platform is restricted to adults, the Children's Online Privacy Protection Act (COPPA) does not apply; however, in the event that we discover a minor has provided personal information to us, we will immediately delete that information and terminate the associated account.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through a prominent notice within the App or via email to the address associated with your account. The "Last Updated" date at the top of this policy will always reflect the most recent revision. Your continued use of Heatwave after any changes to this Privacy Policy constitutes your acceptance of the updated terms.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:
Heatwave Social Inc. Alberta, Canada
