PRIVACY

Private by link. Quiet by design.

Heart.fm has no accounts. Every tape, note, and shared space lives behind an unguessable link, and the app stores only what it needs to play it back to the person it was made for.

What we store

• Mixtapes: the names you type, the title, the note, the track list with its links and artwork, your cover image if you upload one, love coupons, and an open counter.
• Bedtime notes: the two names, the date, the one to four reflections the writer kept, which prompts they answered, the song if there is one, the sticker signed under the name, any photos dropped into them, how many times the note was opened, and the stickers, hearts, emoji, and lines written back. A note made outside a shared space is hard-deleted 30 days after it is made; a note tucked into a shared space is kept for as long as the space exists.
• Shared spaces: both names, decisions and their messages and options, appreciations, weekly answers, important dates, the shared shopping list and what was bought, “ask me about” clues, and an activity log used for streaks and badges.
• “Save for tonight” moments: a line or a photo only its author can see. Unused moments are deleted after three days.
• Notification subscriptions: if you turn on notifications, the push address your browser creates is encrypted at rest and used only to tell you what your partner did in the space, or that a note or tape you sent from a device holding your space key was opened or answered.
• Replies and reactions left by a recipient on a tape.

Private links are stored only as SHA-256 hashes, so a copy of the database cannot reveal a single tape link. Edit keys and shared-space keys are stored the same way.

Email

Email is optional everywhere. If you leave an address to hear when your tape is opened or answered, it is encrypted at rest and used only for those messages. Bedtime routines encrypt addresses the same way and keep a one-way fingerprint to prevent duplicate sends. When someone answers a note a nightly routine delivered to them, the routine’s creator is emailed what came back, including any words written back; the note’s own reflections and song never go into email. Email is delivered by AgentMail with open tracking disabled.

Music and artwork

Songs play inside YouTube or Spotify embeds on their own terms. When Heart.fm matches a song to a video it sends only the song title and artist to YouTube, and when needed to a public Piped or Invidious index. Album artwork comes from the iTunes Search and Deezer catalogs. Names and links are never sent to any music service or AI model.

AI, only when you ask

When you ask for a song, the reflections you kept (and the titles of songs already suggested that night) go to Anthropic’s Claude or Cloudflare Workers AI, whichever this deployment has configured. When you tap “Stuck?”, only that one line and the prompt it answers are sent. Nothing is sent to an AI model unless you tap one of those buttons.

Rate limits and abuse protection

Anonymous features are protected by counters keyed on a keyed hash of your connection address. Raw IP addresses are not stored.

Payments

Plus upgrades and tips are handled by Stripe Checkout. Heart.fm never sees or stores card details; it keeps the Stripe session id, the product, and the amount so an upgrade can be applied exactly once.

Hosting

Heart.fm runs on Cloudflare Workers, D1, and R2. Cloudflare processes requests as a network provider under its own privacy terms. Notifications travel through your browser’s push service (Apple, Google, Mozilla, or Microsoft) encrypted end to end, so the push service cannot read them.

Deleting things

Anyone holding a tape’s edit key can unpublish it from the confirmation page, which deletes the tape, its tracks, coupons, replies, and uploaded images. Bedtime notes can be unpublished the same way, which also deletes their photos; notes outside a shared space expire on their own. Shared-space data is deleted when both people ask; write to the address on the terms page.

Last updated September 2026.