Password recovery and local recording safety
Recovery uses random 30-minute one-use links with hashed tokens, current-password binding, request limits and session revocation on success. Request responses do not identify registered addresses. Browser recording is explicit and remains in tab memory until an AI request. Cancelling a request or leaving the workspace releases tracks, including late permission grants. A pagehide handler cancels capture when navigating away even if the browser caches the page without unmounting it. Returning never resumes capture automatically. Selectable auto-stop timers bound the requested recording duration; browser suspension can delay them. Local recording downloads require your action; keep copies private and remove them through your device when no longer needed. These safeguards do not certify browser, device or microphone behavior.
How we protect the service
HearThis uses HttpOnly, Secure, SameSite session cookies, hashed passwords, signed sessions, and origin checks on state-changing requests. Account responses are private and marked no-store. Temporary audio paths are tied to the account; uploads are private and subject to best-effort deletion after processing. We apply rate limits to uploads and email verification. Stripe handles payment card data, and app pages are restricted from being framed by other sites.
Protecting your account
Use a strong, unique password. You can sign out other sessions in Account & Usage. Keep exported workspace backups private: they may contain your notes and reports.
Report a vulnerability
Email syndicatehubllc@gmail.com with a description of the issue and steps to reproduce it. Include only the information needed to investigate safely. We aim to acknowledge reports. A machine-readable contact is available at /.well-known/security.txt.
Good-faith research
Please do not access other people's data, disrupt the service, use social engineering, or send spam. Give us reasonable time to investigate before public disclosure. To the extent permitted by law, we will not pursue legal action against good-faith research that follows these guidelines.
Scope
hearthis.floot.app is in scope. Third-party providers, including Floot, Stripe, and Google, are out of scope and may have their own reporting programs. Volumetric denial-of-service testing and missing best-practice headers without demonstrated impact are also out of scope.
Limits
We do not promise bug bounty payments. No system is perfectly secure, and these measures do not eliminate every risk.
Machine-readable reporting contact: security.txt.
487 Grey Swallow St.
Brighton, Colorado 80601, United States